PROCESS11 records
Windows Process Reference
What the processes in Task Manager actually do: purpose, publisher, normal file path, expected instances, resource behaviour and safe ways to investigate.
Each record explains what the process does, who publishes it, where its genuine executable lives, whether several copies are normal, and when unusual behaviour is worth investigating. A file name alone never proves a process is malware; the path and digital signature do. To check either, right-click the process in Task Manager → Open file location and → Properties → Digital Signatures.
Core system processes
Processes Windows cannot run without. Never end these.
- csrss.exeClient Server Runtime Subsystemcsrss.exe (Client Server Runtime Subsystem) is an essential Windows process that manages console windows,…
- lsass.exeLocal Security Authority Subsystem Servicelsass.exe (Local Security Authority Subsystem Service) enforces the security policy on Windows: it verifies…
- winlogon.exeWindows Logonwinlogon.exe (Windows Logon) manages interactive logon and logoff, the secure attention sequence…
Service hosts & workers
Processes that host services or do background work; high resource use here is worth understanding.
- dllhost.exeCOM Surrogatedllhost.exe (COM Surrogate) hosts COM components in an isolated process so that if one crashes, the program…
- MsMpEng.exeAntimalware Service Executable (Microsoft Defender)Antimalware Service Executable, the process MsMpEng.exe, is the core engine of Microsoft Defender Antivirus.…
- rundll32.exeRun a DLL as an apprundll32.exe is a legitimate Windows utility that runs a specific function exported by a DLL, which is how…
- RuntimeBroker.exeRuntime BrokerRuntimeBroker.exe (Runtime Broker) is a Windows process that checks and enforces permissions for Microsoft…
- svchost.exeService Hostsvchost.exe (Service Host) is a legitimate Windows process that hosts services which run from DLLs rather…
- TiWorker.exeWindows Modules Installer WorkerWindows Modules Installer Worker, the process TiWorker.exe, installs, changes and removes Windows updates…
Shell & desktop
The visible desktop, window management and console hosting.
A note on "is this a virus?"
Malware often names itself after a real Windows process to blend in. The genuine process runs from a specific folder (usually C:\Windows\System32) and is signed by Microsoft. A process with the right name in the wrong folder, or with no valid signature, is the thing to investigate. Each record below gives the correct path so you can check.