Using Process Explorer

Question 1

Does a Task Manager have any sense of hierarchy?

Answer 1

no - it does not show the parent process that started the process or child process started by a certain process

Question 2

Does a Task Manager have any knowledge of threads?

Answer 2

• no - can only point to a correct direction to find a fault, but cannot explain what’s going on as it does not see what threads are doing
• at best it knows the number of threads running in a process

Question 3

What does it mean that Task Manager does not have any understanding on what resources are being used?

Answer 3

• doesn’t understand what DLLs/modules/files are loaded
• no understanding on what register keys a process is using

Question 4

What can a Task Manager never provide when using for troubleshooting an issue or malware analysis?

Answer 4

the actual reason why bad things happened

Question 5

How to run Process Explorer with elevated privileges to be able to see details for all processes?

Answer 5

File > Show Details for All Processes

Question 6

How to check what privileges are used by a running process?

Answer 6

Properties > Security