Ok now you can do the next step. Unlike ProcMon, I don't think you can export a bunch of info (you can do one at a time) in order for someone else to look at a log file. So when you open Process Explorer (ProcExp) go to View, Show Lower Pane. When this dot is present (you shouldn't have to use the crosshair anymore), click on the Explorer.exe on the top. In the lower pane it is going to show you all the things that Explorer is doing, such as files, regkeys/paths, handles, mutants, etc. You could try to screenshot the lower pane and post a link to that picture. Also, you should do a test and try dropping the crosshair on some other place on your desktop (the wallpaper where no icon is) and see if ProcExp still says Explorer. It may be that ProcExp can't see that dot like Au3info can?