Process Explorer (Sysinternals)

What Process Explorer does

Process Explorer replaces Task Manager's Details tab with a much richer view: a color-coded process tree, per-process handle and DLL listings, CPU/GPU/memory graphs, and the ability to search for which process has a specific file or registry key open.

It's a single portable executable — no installer, no service — that runs directly from the downloaded ZIP.

Key features

• Process tree showing parent-child spawn relationships, useful for spotting malware launched from an unexpected parent.
• Lower pane shows every DLL loaded by a process, or every handle (file, registry, mutex, event) it holds open.
• Find Handle or DLL search to locate which process is locking a file or folder.
• Color highlighting for new/exiting processes, services, and .NET processes.
• Optional VirusTotal hash-check column for quick reputation lookups on running images.
• Replace Task Manager option so Process Explorer opens from Ctrl+Shift+Esc.

System requirements and download

Process Explorer runs on any supported version of Windows 10 or 11 (32-bit and 64-bit) and requires no installation. Download it as part of the Sysinternals Suite or as a standalone ZIP from the official Microsoft Sysinternals page.

Process Explorer vs. Task Manager

Task Manager is fine for basic end-a-task work and quick CPU/memory checks. Process Explorer goes further: it shows handles and DLLs, lets you verify digital signatures in bulk, exposes threads and their call stacks, and can suspend a process without killing it — all useful when diagnosing malware, file locks, or unstable services.

Safety and authenticity

Only download Process Explorer from learn.microsoft.com/sysinternals or the live.sysinternals.com share. Third-party download sites sometimes bundle unrelated installers with Sysinternals tools, so avoid mirrors you don't recognize.