Windows Server

Process Explorer – SysInternal Tools

Process Explorer is most widely used Sysinternals tool and it helps visualize about details about every processor and active DLL sessions in your system, kill and suspend processes set process priority, gives graphical statistics about CPU, memory and I/O usage, a tree view to show processes and their dependencies.

Here are some steps I utilized in finding registry keys written during program installation via Process Explorer. The following are the steps to detect the registry key associated with a program,

  • Select the desired process (program) a
  • Right-click and
  • Select Properties.

This will open the explorer properties window as shown below.

  • Click on explore, this will open the Registry hive where the associated keys, DWORD etc. are located.

Other possible tools: Test on your own peril J

See how this can be achieved also via the process monitor from SysInternal https://techdirectarchive.com/2020/03/07/how-to-detect-registry-keys-written-during-program-installation-process-monitor-sysinternal-tools/

More on Process Explorer can be found here https://techdirectarchive.com/2020/03/08/process-explorer-replace-built-in-task-manager/

For other SysInternal tool tours, see https://techdirectarchive.com/2020/01/25/windows-sysinternals-tools-psexec-and-auto-logon/

Subscribe
Notify of
guest
0 Comments
Inline Feedbacks
View all comments
0
Would love your thoughts, please comment.x
()
x