Process Explorer Cheatsheet
What It Is
Advanced task manager replacement showing process hierarchy, DLLs, handles, and more.
Why It Matters
Quickly identify suspicious processes, injected DLLs, and process relationships.
Quick Start
- Launch Process Explorer (as Administrator)
- Options → Verify Image Signatures
- Options → VirusTotal.com → Check VirusTotal.com
Key Features
- Process tree: See parent-child relationships
- DLL view: Toggle with
Ctrl+Dto see loaded DLLs - Handle view: Toggle with
Ctrl+Hto see open handles - Properties: Double-click process for detailed info
- Strings: View in-memory strings for a process
Suspicious Indicators
- Process with no icon or generic icon
- Process signed by unknown publisher
- Process running from
%TEMP%or%APPDATA% - Purple highlight = packed/compressed image
- High VirusTotal detection count
Shortcuts
Ctrl+D– Toggle DLL viewCtrl+H– Toggle handle viewCtrl+F– Find handle/DLLSpace– Refresh