Process Explorer

Process Explorer is a freeware task manager and system monitor for Microsoft Windows created by SysInternals, which has been acquired by Microsoft and re-branded as Windows Sysinternals. It provides the functionality of Windows Task Manager along with a rich set of features for collecting information about processes running on the user's system. It can be used as the first step in debugging software or system problems.

Process Explorer
Process Explorer v16.02 running on Windows 7
Original author(s)Winternals Software
Developer(s)Microsoft
Stable release
v16.32 / April 28, 2020 (2020-04-28)
Operating systemWindows XP and later
TypeTask manager and system monitor
LicenseFreeware
Websitedocs.microsoft.com/en-us/sysinternals/downloads/process-explorer

Process Explorer can be used to track down problems. For example, it provides a means to list or search for named resources that are held by a process or all processes. This can be used to track down what is holding a file open and preventing its use by another program. As another example, it can show the command lines used to start a program, allowing otherwise identical processes to be distinguished. Like Task Manager, it can show a process that is maxing out the CPU, but unlike Task Manager it can show which thread (with the callstack) is using the CPU – information that is not even available under a debugger.

History

Process Explorer began in the early Sysinternals days as two separate utilities, HandleEx and DLLView, which were merged in 2001.[1] Until 2008, Process Explorer worked on Windows 9x, Windows NT 4.0 and Windows 2000. Versions of Process Explorer up to 12.04 work on Windows 2000; versions 14.0 and higher do not require credui.dll (which is only available since Windows XP/2003). The current version runs on Windows XP and upwards. Version 15 added GPU monitoring for Windows Vista and later.

Features
  • Hierarchical view of processes.
  • Ability to display an icon and company name next to each process.
  • Live CPU activity graph in the task bar.
  • Ability to suspend selected process.
  • Ability to raise the window attached to a process, thus "unhiding" it.
  • Complete process tree can be killed.
  • Interactively alter a service process's access security
  • Interactively set the priority of a process
  • Disambiguates service executables which perform multiple service functions. For example, when the pointer is placed over a svchost.exe, it will tell if it is the one performing automatic updates/secondary logon/etc., or the one providing RPC, or the one performing terminal services, and so on.
  • There is an option (in a process's context menu) to verify a process in VirusTotal
  • There is an option to display DLLs loaded by process (View => Lower Pane View => DLLs); an option Show Lower Pane has to be switched on
  • There is an option to display processes' handles which includes named mutants, events, sockets, files, registry keys etc. (View => Lower Pane View => Handles); an option Show Lower Pane has to be switched on
  • In properties of a process a user can view the process's threads and threads' stack traces
  • There is a command to create a process dump (mini or full) (Process => Create Dump)
  • There is a Find command which allows for searching a handle or DLL which can be used to identify the process(es) holding a file lock.
  • There is an option (in handle context menu) to close a selected handle
gollark: There is no skynet for OC. The main issue is OC not having native websockets support.
gollark: Ah, a notos.
gollark: G?
gollark: Craftban
gollark: CC should be brought into the 5.3 age with limited backward compatibility.

See also

References
  1. RTM’d today: Windows Sysinternals Administrator's Reference
This article is issued from Wikipedia. The text is licensed under Creative Commons - Attribution - Sharealike. Additional terms may apply for the media files.