You're right, Sysinternals Process Monitor will show lots of stuff going on for your example.