open cmd exe shell and run file_monitor pyc:\python exe file_monitor py open second cmd exe shell and execute the following commandsc:\cd %tempc:\docume~ \admini~ \locals~ \tempecho hello filetest :\docume~ \admini~ \locals~ \temprename filetest file test :\docume~ \admini~ \locals~ \tempdel file test you should see output that looks like the followingspawning monitoring thread for pathc:\windows\temp spawning monitoring thread for pathc:\docume~ \admini~ \locals~ \temp created :\docume~ \admini~ \locals~ \temp\filetest modified :\docume~ \admini~ \locals~ \temp\filetest [vvvdumping contents hello [^^^dump complete renamed fromc:\docume~ \admini~ \locals~ \temp\filetest renamed toc:\docume~ \admini~ \locals~ \temp\file test modified :\docume~ \admini~ \locals~ \temp\file test [vvvdumping contents hello [^^^dump complete deleted :\docume~ \admini~ \locals~ \temp\file ~ if all of the above has worked as plannedi encourage you to keep your file monitor running for hours on target system you may be surprised (or notto see files being createdexecutedand deleted you can also use your process-monitoring script to try to find interesting file paths to monitor as well software updates could be of particular interest let' move on and add the ability to automatically inject code into target file