> For the complete documentation index, see [llms.txt](https://windows.dfirhandbook.com/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://windows.dfirhandbook.com/windows-artifacts/processes.md).

# Processes

- [at.exe](https://windows.dfirhandbook.com/windows-artifacts/processes/at.exe.md): Superseded by schtasks.exe in later versions of Windows, understanding at.exe remains relevant for analyzing older systems.
- [explorer.exe](https://windows.dfirhandbook.com/windows-artifacts/processes/explorer.exe.md)
- [lsass.exe](https://windows.dfirhandbook.com/windows-artifacts/processes/lsass.exe.md)
- [lsaiso.exe](https://windows.dfirhandbook.com/windows-artifacts/processes/lsaiso.exe.md)
- [PuTTy.exe](https://windows.dfirhandbook.com/windows-artifacts/processes/putty.exe.md)
- [X11 Forwarding](https://windows.dfirhandbook.com/windows-artifacts/processes/putty.exe/x11-forwarding.md)
- [runtimebroker.exe](https://windows.dfirhandbook.com/windows-artifacts/processes/runtimebroker.exe.md)
- [services.exe](https://windows.dfirhandbook.com/windows-artifacts/processes/services.exe.md)
- [smss.exe](https://windows.dfirhandbook.com/windows-artifacts/processes/smss.exe.md)
- [System](https://windows.dfirhandbook.com/windows-artifacts/processes/system.md)
- [svchost.exe](https://windows.dfirhandbook.com/windows-artifacts/processes/svchost.exe.md)
- [Services](https://windows.dfirhandbook.com/windows-artifacts/processes/svchost.exe/services.md): Common services seen running under svchost.exe
- [winlogon.exe](https://windows.dfirhandbook.com/windows-artifacts/processes/winlogon.exe.md)
- [wininit.exe](https://windows.dfirhandbook.com/windows-artifacts/processes/wininit.exe.md)