用Process Explorer
threads栏 可以看到
shcore.dll占用最多 不过光看这个dll没啥用，这个dll有很多功能
再点stack 看调用栈
ntdll.dll!NtReadFile+0x14
KERNELBASE.dll!ReadFile+0x73
windows.storage.dll!SHGetKnownFolderItem+0x1a6
coml2.dll!StgOpenStorageOnILockBytes+0x9929
coml2.dll!StgOpenStorageOnILockBytes+0x99ac
coml2.dll!StgOpenStorageOnILockBytes+0x95b9
windows.storage.dll!SHCreateItemWithParentAndChildId+0x1ebb
windows.storage.dll!SHChangeNotification_Lock+0x209c
windows.storage.dll!SHChangeNotification_Lock+0xe41
windows.storage.dll!SHChangeNotification_Lock+0x674
windows.storage.dll!Ordinal873+0x296
windows.storage.dll!SHChangeNotifyRegister+0x165d
windows.storage.dll!SHChangeNotification_Lock+0x35e8
windows.storage.dll!SHChangeNotification_Lock+0x32af
windows.storage.dll!Global_WindowsStorage_ccIcon+0x2d
windows.storage.dll!Global_WindowsStorage_csIconCache+0xaa4
windows.storage.dll!SHTestTokenMembership+0x5e6
windows.storage.dll!SHTestTokenMembership+0x2c4
SHELL32.dll!Ordinal859+0x168467
SHELL32.dll!Ordinal859+0x167455
SHELL32.dll!Ordinal859+0x1690a6
shcore.dll!Ordinal172+0x1e9
KERNEL32.DLL!BaseThreadInitThunk+0x14
ntdll.dll!RtlUserThreadStart+0x21
好吧，搜了搜栈里的这几个函数，没搜着啥有用的。。。
