Can get deleted immediately after they got applied (while the installer/updater is still in progress).The files are often compressed with a special method.Those paths are often only partial temp files and may get combined into one or more 'usable' files (like executables, assets, etc) somewhere else.The process named in the column Image may not be the one you're looking for. In the second view Disk Activity you can sort the column Write (B/sec) descending to see the most write demanding processes and the affected files.

Just search for Resource Monitor or resmon to open it and switch to tab Disk. Note: Even if it's not an online installer, it's a similar approach.Īnother option is the built-in Resource Monitor of Windows to see the current write operations on your disks, but without features to analyze it extensively. Unfortunately the Process Tree doesn't have a search function. Just find the main process and right-click to add process and children to include filter. The easiest way to include the main and all of its child processes at once is by using the Process Tree (keyboard shortcut: CTRL + T) in the menu Tools. The child processes may not be relevant if the download is done by the main process itself, but that depends on how the program was designed. Let it run for some seconds while downloading, then stop the capture, filter on the main and child processes of the program and on operations CreateFile and WriteFile.

ProcMon from Sysinternals is the best tool for such tasks as it provides many rich features to capture/track what processes are/were doing on disks, network and registry.

Procmon download