How does SysInternal's ProcessMonitor work? - Stack Overflow
https://stackoverflow.com/questions/4833972/how-does-sysinternals-processmonitor-work
WebJan 28, 2011 · For the Windows 9x driver, the heart of Filemon is in the virtual device driver, Filevxd.vxd. It is dynamically loaded, and in its initialization it installs a file system filter via the VxD service, IFSMGR_InstallFileSystemApiHook, to insert itself onto the call chain of all file system requests.
DA: 83 PA: 66 MOZ Rank: 86