Decoding the FileAttributes field in ProcessMonitor Jeremy M [MSFT] 27 May 2010 10:43 AM 0 Random tip: if you’re using procmon.exe to monitor file system activity, you’ll see a FileAttributes field with a bunch of letters.  It’s not immediately obvious which letters correspond to which Win32 file attribute constants.  I asked around internally, and got […]