Features\Process Manager
⚙️ The process manager feature offers an intuitive interface for viewing and managing running processes on a remote machine.
- Name and Image Path
- Process Identifier (PID)
- Parent Process Identifier (PPID)
- Thread Count
- Context User
- Domain or Machine Name
- Terminal Session ID
- Process Integrity Level (Limited / High / Unknown if insufficient privileges for probing)
- Process Creation Date
- Command Line Used to Launch the Process
Process architecture is indicated by the icon in the row, showing '32' for x86 (32-bit) and '64' for AMD64 (64-bit). Both 32-bit and 64-bit processes can list processes of the opposite architecture; however, it is important to note that certain features may not be compatible when interacting with processes of a different architecture.
Gracefully terminate the selected process by opening it with the PROCESS_TERMINATE access right using the OpenProcess function, and then calling the TerminateProcess API with an exit code of 0.
Dump the memory of the selected process using the MiniDumpWriteDump API. You can select the desired minidump types from the dedicated user interface. By default, the most suitable options for common use cases are preselected, but you may adjust them as needed. For detailed information about each flag, refer to the official Microsoft documentation.
Process Dump is an Optix Task, meaning it runs as a background and possible long-running operation. Once the task completes successfully, the generated dump file can be downloaded from the Optix Task window. By default, the dump file is saved as a temporary file in the system's temp directory. However, you can specify a custom output path if desired.
Note: This is currently the only supported method. Additional methods will be available in future updates.
In the process list, you can access several options and filters:
- Exclude Different Architecture: Hides processes whose architecture does not match that of the Client. This option is useful for focusing on processes that are more likely to be compatible with certain functions.
- Exclude Unreachable Processes: Hides processes that appear to be inaccessible, usually due to insufficient permissions. This may occur when the Client is running under a user context without the privileges required to interact with those processes.
- Color Background Option: Highlights processes with specific characteristics. Currently, a blue background indicates a process running with elevated privileges, while a green background identifies the Client process itself and purple identifies system process.
Jean-Pierre LESUEUR (@DarkCoderSc) - GPLv3
