Community Hub0 Subscribers
Community hub
Process Explorer
View on Wikipediafrom Wikipedia
 | This article needs additional citations for verification. (June 2011) |
| Process Explorer | |
|---|---|
 Process Explorer v17.06 running on Windows 11 | |
| Original author | Winternals Software |
| Developer | Microsoft |
| Stable release | v17.08
/ November 20, 2025 |
| Operating system | Windows 8.1 / Windows Server 2012 and later |
| Type | Task manager and system monitor |
| License | Freeware |
| Website | learn |
Process Explorer is a freeware task manager and system monitor for Microsoft Windows created by SysInternals, which has been acquired by Microsoft and re-branded as Windows Sysinternals. It provides the functionality of Windows Task Manager along with a rich set of features for collecting information about processes running on the user's system.[1] It can be used as the first step in debugging software or system problems.
Process Explorer can be used to track down problems. For example, it provides a means to list or search for named resources that are held by a process or all processes. This can be used to track down what is holding a file open and preventing its use by another program. As another example, it can show the command lines used to start a program, allowing otherwise identical processes to be distinguished. Like Task Manager, it can show a process that is maxing out the CPU, but unlike Task Manager it can show which thread (with the callstack) is using the CPU – information that is not even available under a debugger.[2]
History
[edit]Process Explorer began in the early Sysinternals days as two separate utilities, HandleEx and DLLView, which were merged in 2001.[3] Until 2008, Process Explorer worked on Windows 9x, Windows NT 4.0 and Windows 2000. Versions of Process Explorer up to 12.04 work on Windows 2000; versions 14.0 and higher do not require credui.dll (which is only available since Windows XP/2003). Windows XP is supported up to version 16.05, Windows Vista until version 16.42,[4][5] Windows 8.1 and Server 2012 until 17.05.[6] The current version runs on Windows 10 and upwards. The open source software "Process Hacker" has been developed with the aim to replicate its functionality.[7]
Features
[edit]- Hierarchical view of processes
- Ability to display an icon and company name next to each process
- Live CPU activity graph in the task bar
- Ability to suspend selected process
- Ability to raise the window attached to a process, thus "unhiding" it
- Complete process tree can be killed
- Interactively alter a service process's access security
- Interactively set the priority of a process
- Disambiguates service executables which perform multiple service functions. For example, when the pointer is placed over a svchost.exe, it will tell if it is the one performing automatic updates/secondary logon/etc., or the one providing RPC, or the one performing terminal services, and so on
- There is an option (in a process's context menu) to verify a process in VirusTotal
- There is an option to display DLLs loaded by process (View → Lower Pane View → DLLs); an option Show Lower Pane has to be switched on
- There is an option to display processes' handles which includes named mutants, events, sockets, files, registry keys etc. (View → Lower Pane View → Handles); an option Show Lower Pane has to be switched on
- In properties of a process a user can view the process's threads and threads' stack traces
- There is a command to create a process dump (mini or full) (Process → Create Dump)
- There is a Find command which allows for searching a handle or DLL which can be used to identify the process(es) holding a file lock
- There is an option (in handle context menu) to close a selected handle
- Version 15 added GPU monitoring
See also
[edit]- Activity Monitor
- Process Lasso
- Resource Monitor
- Taskkill
- Tasklist
- Process Monitor – capturing file system and Registry activity.
- ProcDump
References
[edit]- ^ How to use Process Explorer, Microsoft's free, supercharged Task Manager alternative
- ^ Process Explorer, Part 2
- ^ RTM’d today: Windows Sysinternals Administrator's Reference
- ^ "Process Explorer - Windows Sysinternals". Archived from the original on 11 December 2015. Retrieved 26 January 2021.
{{cite web}}: CS1 maint: bot: original URL status unknown (link) - ^ "Process Explorer - Windows Sysinternals | Microsoft Docs". Archived from the original on 25 July 2021. Retrieved 30 June 2024.
- ^ "Process Explorer - Sysinternals | Microsoft Learn". Archived from the original on 28 May 2024. Retrieved 22 August 2024.
- ^ Arntz, Pieter (9 November 2018). "Advanced tools: Process Hacker". Malwarebytes Labs. Retrieved 22 January 2022.
External links
[edit]- Process Explorer Official Webpage Microsoft Retrieved on December 29, 2008
- Using Process Explorer to tame svchost.exe - Advanced topics February 9, 2008
- Process Explorer Part 2 February 10, 2008
- Process Explorer Guide for Newbies Archived 2010-03-18 at the Wayback Machine February 27, 2009
- Sysinternals Suite at Microsoft Technet Updated continuously as of August 2009
Process Explorer
View on Grokipediafrom Grokipedia
History and Development
Origins
Process Explorer was developed in 2001 by Mark Russinovich and Bryce Cogswell as part of Winternals Software LP, a company they co-founded to create advanced Windows utilities.[4][5] The tool emerged from the merger of two prior Sysinternals utilities: HandleEx, which viewed open handles, and DLLView, which displayed loaded dynamic-link libraries (DLLs).[6] This combination addressed limitations in existing process monitoring tools by providing a unified interface for deeper system diagnostics. The initial purpose of Process Explorer was to serve as a more powerful alternative to the Windows Task Manager, enabling administrators and developers to diagnose process issues, track resource usage, and identify potential problems like handle leaks or DLL conflicts.[7][1] Unlike the basic overview offered by Task Manager, it emphasized real-time visualization of running processes, including hierarchical views of parent-child relationships and basic inspection of open handles.[6] Version 1.0 of Process Explorer was released in 2001 and made freely available for download through the Winternals website, quickly gaining popularity among IT professionals for its practical troubleshooting capabilities.[4][6] Early iterations prioritized ease of use with a graphical interface that updated process data in real time, laying the foundation for its role as an essential diagnostic resource in Windows environments.[1]Acquisition by Microsoft
On July 18, 2006, Microsoft announced the acquisition of Winternals Software LP, the company behind the Sysinternals suite of utilities, including Process Explorer.[5] This move brought the popular free tools, developed by Mark Russinovich and Bryce Cogswell since 1996, under Microsoft's ownership, with the founders joining the company—Russinovich as a Technical Fellow in the Platforms and Services Division and Cogswell as a Software Architect on the Windows Component Platform Team.[5] The acquisition aimed to enhance Microsoft's efforts in reducing the total cost of ownership for Windows users by integrating advanced diagnostic and management tools into its ecosystem.[5] Following the acquisition, Sysinternals tools were temporarily unavailable for public download as Microsoft conducted a licensing review to ensure compliance and standardize terms.[8] During this period, some older or incompatible utilities (such as those limited to Windows 9x or DOS) were not reinstated, but the core suite, including Process Explorer, was preserved and re-released as the "Sysinternals Suite"—a bundled package available as a single download from Microsoft's TechNet site.[8] This re-release featured updated, more permissive click-through licensing that broadened usage rights without requiring custom agreements, allowing continued free access for troubleshooting and system analysis.[9] The integration positioned Sysinternals within Microsoft's freeware offerings, committing to no commercialization or paywalls for the tools, which aligned with their longstanding availability to millions of users worldwide.[5] Russinovich, as a Microsoft employee, assumed responsibility for ongoing maintenance and updates, ensuring the tools' evolution while leveraging Microsoft's resources for broader compatibility and support.[5] This shift marked a pivotal moment, transitioning Process Explorer from an independent utility to a key component of Microsoft's diagnostic portfolio without disrupting its community-driven utility.[8]Version Updates
Following Microsoft's acquisition of Sysinternals in 2006, Process Explorer has received regular updates to enhance compatibility and functionality with evolving Windows operating systems.[1] Version 11.0, released in September 2007, introduced improved support for 64-bit Windows systems, including better handling of 64-bit processes and threads.[10] In July 2011, version 15.0 added GPU utilization and memory monitoring capabilities for Windows Vista and later, allowing users to track graphics processor usage per process via new column options in the view menu.[11][12] Version 16.0, released in January 2014, integrated VirusTotal scanning for process hashes to aid in malware detection, with subsequent updates in the 16.x series through 2016 enhancing search functionality for handles and DLLs.[13] Dark mode support was added later in the 16.x series in October 2022, aligning the tool's interface with Windows theming options.[14] Version 17.06, released on May 28, 2024, addressed bugs such as window display issues on startup, process suspend/resume menu problems, and compatibility fixes for Windows 11, including security enhancements.[1][15] The most recent version, 17.09, was released on December 16, 2025, fixing an image type bug and enabling the assemblies tab for .NET (Core) processes.[1][16] Updates to Process Explorer are typically issued every 1-2 years, often coinciding with major Windows releases to ensure ongoing compatibility and incorporate new system APIs.[17]Core Functionality
Process and Thread Monitoring
Process Explorer provides a hierarchical tree view that organizes active processes according to their parent-child relationships, enabling users to visualize how processes spawn and interact within the system. By default, this tree structure indents child processes beneath their parents, offering a clear representation of process hierarchies that surpasses the flat list in Windows Task Manager.[18] This view updates dynamically to reflect the current state of running processes, facilitating real-time oversight of system activity.[1] In the main process view, users can access real-time metrics such as CPU usage percentage, process start time, and full command-line arguments for each entry. The CPU usage column highlights resource-intensive processes immediately, while the start time indicates longevity and potential anomalies like unexpectedly persistent tasks. Command-line details reveal invocation parameters, aiding in identifying scripted or automated executions. These elements are displayed in customizable columns, allowing tailored monitoring without external tools.[18] For deeper thread-level analysis, double-clicking a process opens a properties dialog with a dedicated Threads tab, listing all active threads within that process along with their priority levels—ranging from idle to real-time—and base priority values. Selecting a thread enables viewing of its current stack trace, including both user-mode and kernel-mode stacks if appropriate privileges are enabled, which helps diagnose blocking or erroneous thread behavior. This granular visibility supports troubleshooting multithreaded applications by exposing execution contexts not visible in standard process lists.[18][19] Direct management options are integrated into the interface via context menus, permitting users to suspend or resume individual processes or threads to temporarily halt execution for debugging, or to kill them outright for termination. Suspending a process freezes all its threads, while thread-specific suspension targets only the selected one, preserving overall system responsiveness. Resuming reverses suspension, and killing removes the target from memory, with options to end entire process trees including descendants. These actions require administrative privileges and provide immediate control over potentially problematic elements.[18]Handle and DLL Inspection
Process Explorer includes dedicated views for examining the handles and dynamic-link libraries (DLLs) associated with running processes, enabling users to identify resource conflicts, dependency issues, and potential leaks. The Handle view displays all open handles held by a selected process, categorizing them by type such as files, registry keys, threads, mutexes, and network connections.[1] This allows administrators to pinpoint which resources a process is accessing, which is essential for troubleshooting scenarios like file locking or registry access problems.[1] To access the Handle view, users select a process in the upper pane of the Process Explorer interface and switch to the handle tab in the lower pane, revealing a comprehensive list of handles with details including the handle type, name, and status.[1] Search and filter options facilitate quick navigation; for instance, the built-in search function (accessible via Ctrl+F or the Find menu) scans across all processes for specific handles by name or type, while filters can narrow results to particular categories like file handles only.[1] Double-clicking a handle in this view populates the lower pane with expanded details, such as the full file path for a file handle or the associated process ID for a thread handle, aiding in deeper investigation without leaving the tool.[1] The DLL view, similarly accessed by selecting a process and switching tabs in the lower pane, lists all loaded modules including DLLs and memory-mapped files, providing critical metadata like the module's version number, file path, timestamp, and digital signature verification status to confirm authenticity and detect tampering.[1] This view is particularly useful for diagnosing DLL hell scenarios, where incompatible versions lead to application instability, as it reveals dependencies and loaded paths that might conflict with system-wide installations.[1] Search capabilities extend here as well, allowing users to locate DLLs by name or attributes across processes, with filters to isolate verified versus unverified modules.[1] Double-clicking a DLL entry displays detailed properties in the lower pane, including export functions, import dependencies, and resource sections, which help trace cascading library issues.[1] For detecting handle leaks—where processes fail to release resources, potentially leading to system exhaustion—Process Explorer supports snapshot comparisons. Users can capture a baseline of open handles via the View menu, then generate a subsequent snapshot after running a workload; the tool highlights differences, such as newly opened handles that persist unexpectedly, quantifying potential leaks by count and type.[1] This feature integrates contextually with the process tree view, providing a hierarchical perspective on how parent-child processes share or accumulate handles.[1]CPU and Memory Analysis
Process Explorer offers robust tools for analyzing CPU and memory utilization, enabling users to monitor system-wide performance and diagnose per-process resource consumption. The primary interface includes mini-graphs at the top of the main window displaying real-time CPU, memory, and I/O history, providing an immediate overview of resource trends.[1] The System Information dialog, invoked through the View menu or by pressing Ctrl+I, presents comprehensive system-wide metrics in a dedicated window with multiple tabs. In the Summary tab, it features paired graphs showing current levels alongside historical data for CPU load, commit charge, and physical memory. The CPU graph differentiates kernel-mode usage in red from total usage (kernel plus user-mode) in green, with mouse-over tooltips revealing precise percentages, the top contributing process, and timestamps. For multi-processor systems, a checkbox option displays one graph per CPU core, highlighting per-processor loads and aiding in identifying uneven distribution. The commit charge graph illustrates committed virtual memory against the commit limit (total physical memory plus pagefile size), where approaching the limit signals potential system instability due to paging pressure. Physical memory stats include available and in-use RAM, paged pool, and non-paged pool allocations, helping users assess overall memory pressure.[20][21] For per-process analysis, double-clicking a process opens the Properties dialog, where the Performance Graph tab displays Task Manager-style historical charts for CPU usage and memory allocation. The CPU history chart uses color coding—red for kernel-mode execution and green for combined kernel and user-mode—to track consumption over time, allowing identification of spikes or sustained high usage that may indicate performance bottlenecks. Similarly, the private bytes graph visualizes the process's exclusive virtual memory allocation, scaled to its peak, to reveal trends in committed resources. Users can sort the main process list by CPU or memory columns to quickly spot high-usage processes, with visual cues like flashing green for new processes or purple for services enhancing prioritization.[1][22] Memory analysis distinguishes between private bytes and working set to facilitate leak detection. Private bytes measure the non-shareable virtual memory committed to the process, including heap and stack allocations, while the working set reflects the subset actively resident in physical RAM. In the Properties dialog's Performance or Memory tabs, these metrics are listed alongside graphs; a steadily rising private bytes value without proportional working set increases often signals a memory leak, as the process accumulates un-freed allocations over time. This differentiation helps troubleshoot issues like gradual resource exhaustion, with examples including applications that fail to release buffers, leading to escalating private bytes.[23][24] These visualization tools—graphs for trends and color-coded indicators for emphasis—enable efficient identification of resource hogs without exhaustive manual inspection, supporting proactive system tuning.[25]Advanced Features
Security and Virus Detection
Process Explorer incorporates several built-in security features designed to assist users in detecting and analyzing potentially malicious processes, enhancing its utility beyond basic system monitoring. A prominent security capability is the integration with VirusTotal, added in version 16.0 released in January 2014. This feature enables users to scan running processes and associated files directly from the tool's context menu by right-clicking a process and selecting "Check VirusTotal." Process Explorer submits the file's cryptographic hash to VirusTotal's online service, which compares it against signatures from over 70 antivirus engines without uploading the full file, thereby maintaining user privacy. Results appear in a dedicated "VirusTotal" column, displaying the number of detections (e.g., "5/70" indicating five engines flagged it as malicious), allowing rapid identification of known threats. Users must opt in once via the Options > VirusTotal.com menu, and the tool also supports checking all running processes at once for comprehensive scans.[26][27] Complementing this, Process Explorer offers digital signature verification for executables and loaded DLLs, accessible when the "Verify Image Signatures" option is enabled under the Options menu. Upon inspection via the process properties dialog (double-click a process or right-click > Properties), the tool queries the Windows certificate store to determine if the image is signed by a trusted root authority. The verification status is explicitly indicated—such as "Signed" for valid signatures, "Unsigned" for lacking any signature, or "Not Verified" for failed checks due to expiration or revocation—helping users distinguish legitimate system components from potentially altered or rogue software. This feature is particularly useful for spotting unsigned processes that may indicate malware injection or unauthorized modifications.[28][29] To facilitate quick visual triage of potential threats, Process Explorer employs color-based highlighting in its process list view. Unsigned processes do not receive a unique color, but suspicious attributes are emphasized: for instance, processes exhibiting signs of packing or compression—a technique often used by malware for obfuscation—are highlighted in purple, drawing immediate attention to possible hidden payloads. Other security-relevant highlights include pink for processes hosting services (which could mask threats), dark gray for suspended processes (potentially evading detection), and red for recently terminated processes (useful for tracking short-lived malware). These customizable colors, configurable via Options > Configure Highlighting, provide an at-a-glance risk assessment without altering core monitoring functions.[30][31] Process Explorer also supports examination of boot execute entries to uncover startup threats, viewable through its integration with system startup mechanisms, though detailed analysis often pairs it with complementary tools for full visibility into early-boot persistence.[32]System Tray Integration
Process Explorer supports integration with the Windows system tray, allowing users to run the tool minimized for unobtrusive monitoring. By launching the application with the/t command-line parameter or enabling the "Hide When Minimized" option under the View menu, Process Explorer minimizes to the system tray instead of the taskbar, displaying a compact graph icon that visualizes real-time CPU usage.[33][34]
The tray icon dynamically updates to reflect overall system CPU utilization, with color coding to indicate load levels: green for under 70%, yellow for 70-90%, and red for over 90%. Users can toggle between a simple CPU usage meter and a detailed CPU history graph via the "CPU History in Tray" setting in the Options menu, providing at-a-glance performance insights without restoring the full interface. Hovering over the icon reveals tooltips with additional metrics, such as precise CPU percentage and the top consuming process.[34][1]
Right-clicking the tray icon accesses a context menu for quick actions, including restoring the main window, searching for specific processes by name or PID, and initiating shutdowns or terminations of selected processes directly from the tray. A single left-click on the icon restores the full Process Explorer window to the foreground.[1][18]
To enhance accessibility as a Task Manager alternative, Process Explorer includes an option under the Options menu to replace the default Windows Task Manager (taskmgr.exe). Selecting "Replace Task Manager" modifies the system registry to redirect invocations of Task Manager—such as via Ctrl+Shift+Esc or right-clicking the taskbar—to launch Process Explorer instead, enabling seamless substitution for routine process management. This replacement can be reversed through the same menu or by deleting the associated registry key at HKEY_LOCAL_MACHINE\SOFTWARE\[Microsoft](/page/Microsoft)\Windows [NT](/page/Windows_NT)\CurrentVersion\Image File Execution Options\taskmgr.exe.[35][1]
For continuous monitoring, the "Always on Top" feature, accessible via the View menu or the tray context menu, pins the Process Explorer window above other applications, ensuring visibility during multitasking without interrupting workflows. This mode is particularly useful for real-time oversight of system resources while using other software.[1][34]