Every program executed on Windows runs within a process.

Examples:

notepad.exe
chrome.exe
explorer.exe
powershell.exe

When a program starts, Windows creates a process to execute it.

Conceptually:

Program on Disk
        ↓
Windows Starts Program
        ↓
Process Created
        ↓
Code Executes

A process is therefore commonly described as:

A running instance of a program.

Why This Matters

Nearly every activity performed on a Windows system involves processes.

Examples include:

Activity	Process Involved
Browsing the web	chrome.exe
Opening a document	winword.exe
Running PowerShell	powershell.exe
Starting a service	services.exe
User logon	winlogon.exe
Malware execution	Various processes

Process Creation

When a program is launched:

notepad.exe

Windows creates a process.

Example:

notepad.exe
	↓
Windows Creates Process
	↓
Process Receives Memory
	↓
Execution Begins

The executable file remains on disk.

The process exists in memory.

Process Identifiers (PIDs)

Every process receives a unique identifier.

This identifier is known as a:

PID

Example:

notepad.exe
PID 4216

chrome.exe
PID 7384

Operators frequently identify processes by PID during investigations.

Parent and Child Processes

Processes may create additional processes.

Example:

explorer.exe
	↓
powershell.exe
	↓
notepad.exe

Conceptually:

Parent Process
	↓
Child Process

This relationship is commonly examined during:

Incident Response
Threat Hunting
Malware Analysis

Process Trees

Parent-child relationships form process trees.

Example:

explorer.exe
├── chrome.exe
├── notepad.exe
└── powershell.exe

Process trees often reveal how activity originated.

Process Memory

Each process receives its own memory space.

Examples:

chrome.exe

stores:

Program code
Variables
Open documents
Runtime data

powershell.exe

stores:

Commands
Scripts
Variables
Runtime data

Processes generally cannot directly access another process's memory.

Threads

Processes perform work through threads.

Conceptually:

Process
	↓
Contains Threads

Example:

chrome.exe
 ├─ Thread
 ├─ Thread
 ├─ Thread
 └─ Thread

A process contains at least one thread.

Many processes contain multiple threads.

Without threads, a process cannot execute instructions.

Threads help with concurrent executions without stalling the process.

Handles

Processes frequently interact with resources.

Examples:

Files
Registry Keys
Network Connections
Events
Other Processes

Windows does not allow a process to directly manipulate these resources.

Instead, Windows provides the process with a reference known as a:

Handle

Conceptually:

Process  
	↓  
Requests Resource  
	↓  
Windows Creates Handle  
	↓  
Process Uses Handle  
	↓  
Resource

Example:

notepad.exe  
	↓  
Opens report.txt  
	↓  
Windows Creates Handle  
	↓  
Notepad Uses Handle  
	↓  
report.txt

The process does not interact with the file directly.

It interacts with the handle that Windows created for the file.

Handles can reference many types of resources, including:

Files
Directories
Registry Keys
Network Sockets
Processes
Threads
Events

Security Context

Every process executes within a security context.

Examples:

Alice

Administrator

NT AUTHORITY\SYSTEM

The process inherits permissions, privileges, and restrictions associated with that identity.

Example:

Alice
	↓
powershell.exe

The process can generally perform only the actions Alice is permitted to perform.

Process Lifetime

Processes do not exist forever.

Conceptually:

Process Created
		↓
Process Executes
		↓
Process Terminates

Examples:

notepad.exe

may execute until terminated as it is designed to await user input.

However,

ipconfig.exe

may execute for less than a second and automatically close.

Once execution ends, the process is destroyed and its resources are released.

Viewing Processes

Common commands:

Command Prompt:

tasklist

PowerShell:

Get-Process

Examples:

PS C:\Users\PC\Desktop\Demo> Get-Process

 NPM(K)    PM(M)      WS(M)     CPU(s)      Id  SI ProcessName
 ------    -----      -----     ------      --  -- -----------
     17    11.92      19.25       0.00    5776   0 AdjustService
     11     3.12      13.82       0.00    5472   0 AggregatorHost
      6     0.94       6.25       0.00    5544   0 amd3dvcacheSvc
     11     2.60      10.44       0.00    3420   0 amdfendrsr
     47    60.30       7.01       2.78   19676   1 AMDInstallManager
     12     2.33       1.91       0.02   13452   1 amdow
     21     6.13       8.52       3.03    3984   1 AMDRSServ
     46   153.20      13.04      26.06   12320   1 AMDRSSrcExt
     48    85.61     100.03      21.55   16592   1 ApCent
     20    12.11      44.72       0.78    9644   1 AppActions
     20    10.70      45.29       1.55   26636   1 ApplicationFrameHost
     ...

Terminating Processes

Processes can be stopped.

Command Prompt:

taskkill /PID 4216 /F

PowerShell:

Stop-Process -Id 4216

Important Windows Processes

Operators should immediately recognize several common processes.

Process	Purpose
explorer.exe	Desktop and user shell
winlogon.exe	User logon
lsass.exe	Authentication
services.exe	Service management
svchost.exe	Service hosting
csrss.exe	Windows subsystem
wininit.exe	System initialization

Operator Perspective

When approaching an unfamiliar Windows system, Operators typically ask:

Identity

Which processes are running?
Which users own them?

Relationships

Which process started them?
Does the process tree make sense?

Security

Is the process elevated?
Is it running as SYSTEM?

Investigation

Which processes appear unusual?
Which processes were recently created?
Which processes communicate externally?

Malware

Which process launched the malware?
Which process hosts the payload?
Has code been injected into another process?

Many investigations begin with process-related questions.

Mental Model

A useful mental model is:

Process
=
Identity
+
Memory
+
Threads
+
Handles
+
Executable Code

Key Takeaways

Every running program executes within a process.
Processes are created when programs start.
Every process receives a PID.
Processes may create child processes.
Parent-child relationships form process trees.
Processes contain memory and threads.
Processes interact with resources through handles.
Processes execute within a security context.
Process analysis is a fundamental operational skill.
Understanding processes is essential for both offensive and defensive operations.

The next lesson explores Networking and how Windows systems communicate with other systems and services.