Map 1
WINDOWS SYSTEM PROCESSES
  Session Manager Subsystem - SMSS.EXE
    - PID: Random
- Parent Process: System
- Child Processes: SMSS.EXE (Session 0), SMSS.EXE (Session 1), AUTOCHK.EXE, A new SMSS.EXE instance for each new session
- User: NT AUTHORITY\SYSTEM (S-1-5-18)
- Image: %SystemRoot%\System32\smss.exe
- N° Of Instances: Multiple during boot-up and only one without arguments after boot-up.
  System Idle Process
    - PID: 0
- Parent Process: None
- Child Processes: None
- User: NT AUTHORITY\SYSTEM (S-1-5-18)
- Image: None
- N° Of Instances: 1
  Registry
    - PID: Random
- Parent Process: None
- Child Processes: None
- User: NT AUTHORITY\SYSTEM (S-1-5-18)
- Image: None
- N° Of Instances: 1
  System
    - PID: 4
- Parent Process: None
- Child Processes: None
- User: NT AUTHORITY\SYSTEM (S-1-5-18)
- Image: %SystemRoot%\System32\ntoskrnl.exe (Task Manager / Process Hacker) and None (Process Explorer)
- N° Of Instances: 1
  Memory Compression
    - PID: Random
- Parent Process: System
- Child Processes: None
- User: NT AUTHORITY\SYSTEM (S-1-5-18)
- Image: None
- N° Of Instances: 1
  Service Host Process - SVCHOST.EXE
    - PID: Random
- Parent Process: “services.exe”
- Child Processes: Multiple (Depends on the services being launched)
- User: Multiple (NT AUTHORITY\SYSTEM, NT AUTHORITY\LOCAL SERVICE, NT AUTHORITY\NETWORK SERVICE…etc.)
- Image: %Systemroot%\System32\svchost.exe
- N° Of Instances: Multiple
  Service Control Manager - SERVICES.EXE
    - PID: Random
- Parent Process: “wininit.exe”
- Child Processes: Multiple (Any services defined in “HKLM/SYSTEM/CurrentControlSet/Services/”. For example: “spoolsv.exe”, “svchost.exe”, “SearchIndexer.exe” …etc.)
- User: NT AUTHORITY\SYSTEM (S-1-5-18)
- Image: %SystemRoot%\System32\services.exe
- N° Of Instances: 1
  Windows Initialization Process - WININIT.EXE
    - PID: Random
- Parent Process: Orphan process (Parent was the sessions 0 SMSS.EXE during boot)
- Child Processes: “services.exe”, “lsass.exe”, “fontdrvhost.exe”
- User: NT AUTHORITY\SYSTEM (S-1-5-18)
- Image: %SystemRoot%\System32\wininit.exe
- N° Of Instances: 1
  Windows Logon Process - WINLOGON.EXE
    - PID: Random
- Parent Process: Orphan process (Parent was the SMSS.EXE child process with session > 0)
- Child Processes: “LogonUI.exe”, “userinit.exe”, “dwm.exe”, “fontdrvhost.exe” and anything else listed in the “Userinit” value
- User: NT AUTHORITY\SYSTEM (S-1-5-18)
- Image: %SystemRoot%\System32\winlogon.exe
- N° Of Instances: One for each user session
  LOGONUI.EXE
    - PID: Random
- Parent Process: “winlogon.exe”
- Child Processes: None
- User: NT AUTHORITY\SYSTEM (S-1-5-18)
- Image: %SystemRoot%\system32\LogonUI.exe
- N° Of Instances: One for each connected / logged on user with a locked screen.
  EXPLORER.EXE
    - PID: random
- Parent Process: Orphan process (Parent was the “userinit.exe” process)
- Child Processes: Multiple process
- User: A user that is connected on the machine and not System
Image: %Systemroot%\system32\explorer.exe
- N° Of instances: 1 for each user connected on the machine.
  USERINIT.EXE
    - PID: Random
- Parent Process: “winlogon.exe”
- Child Processes: Shell process which is by default “explorer.exe” and anything executed via logon script stored in the value “UserInitLoginScript”.
- User: Logged on user
- Image: %Systemroot%\system32\userinit.exe
- N° Of Instances: 0 (The process exists after launching the shell “explorer.exe”).
  Desktop Window Manager - DWM.EXE
    - PID: Random
- Parent Process: “winlogon.exe”
- Child Processes: None
- User: Window Manager\DWM-X (Where “X” is the number of the session of the USER)
- Image: %Systemroot%\System32\dwm.exe
- N° Of Instances: 1 per logged on user
  Local Security Authentication Service - LSASS.EXE
    - PID: Random
- Parent Process: “wininit.exe”
- Child Processes: None (Exlcuding password filters)
- User: NT AUTHORITY\SYSTEM (S-1-5-18)
- Image: %Systemroot%\system32\lsass.exe
- N° Of Instances: 1
  Windows Subsystem Process - CSRSS.EXE
    - PID: Random
- Parent Process: Orphan process (Parent was the SMSS.EXE child process of the master SMSS.EXE)
- Child Processes: None
- User: NT AUTHORITY\SYSTEM (S-1-5-18)
- Image: %SystemRoot%\System32\csrss.exe
- N° Of Instances: One for each session (In general you’ll find two at least, one for session 0 and one for session 1)