VMware ESXi and vSphere Cluster Management

Using the DLL View in Process Explorer

Learn how to use Process Explorer's lower-pane DLL View to inspect loaded DLLs, executable images, mapped files, paths, publishers, and module activity.

Process Explorer’s DLL View shows the executable image, libraries, and mapped files associated with one selected process. It is useful for troubleshooting application errors, understanding dependencies, and investigating unexpected modules.

What DLL View is for

A DLL, or Dynamic Link Library, is a file containing compiled code that provides reusable functions to Windows programs. Multiple programs can load the same library instead of each containing a separate copy of common functionality. For example, several applications can use a shared Windows dialog library rather than independently implementing equivalent dialog behavior.

A process is a running instance of a program. Each process has its own execution context and virtual address space, which is the range of virtual memory where the process maps executable code, libraries, and data.

DLL View is a per-process inspection view. It does not list every DLL installed on the computer. It lists items currently associated with the process selected in the main Process Explorer window.

What DLL View displays

The view lists the selected process’s primary executable image, loaded DLL modules, and mapped data files. An image file is the primary executable file associated with a running process. A module is a loaded executable image or library associated with that process.

A mapped file is a file whose contents have been made available in a process’s address space. It may be a DLL, an executable component, or a data file. Therefore, not every entry in DLL View is necessarily a DLL. The important relationship is that each listed item is mapped into, or otherwise associated with, the address space of the currently selected process.

Opening and closing the lower-pane DLL View

Select the target process in the main Process Explorer window.
Press Ctrl+D to display DLL View in the lower pane.
Review the modules associated with the active process selection.
To hide the lower pane, press Ctrl+L.

Changing the lower-pane mode affects the current selection. If you select another process in the main list, the lower pane updates to show that process’s associated modules.

Live updates and load or unload activity

DLL View refreshes according to Process Explorer’s configured automatic update schedule. The update interval controls how frequently the list and its change indicators are refreshed, so a very brief module transition may be easier to observe with an appropriate refresh interval.

Indicator	Meaning	Suggested next step
Green highlight for recent loads	The module was recently loaded into the selected process.	Correlate the load with an application action, startup event, plugin, or suspicious behavior; then inspect the path and file details.
Red highlight for recent unloads	The module was recently unloaded from the selected process.	Reproduce the event and determine what process activity caused the module to appear and disappear.

These colors are transient change indicators, not security verdicts. They help reveal module load and unload activity across refresh cycles. For example, if an application loads a library immediately after opening a document, the green entry can help connect that library with the action. If the entry later turns red or disappears, investigate the unload in the same context.

Understanding DLL View columns

File metadata is descriptive information embedded in or associated with a file, such as its description and company name. Use metadata together with the complete path and the process context rather than treating any one field as proof of legitimacy.

Column	Meaning	How to use it
Name	The module or mapped-file filename.	Identify the component and sort alphabetically to locate a particular filename or group similarly named entries.
Description	File metadata describing the component’s purpose.	Compare the stated purpose with the application or Windows feature that is expected to load it.
Company Name	Publisher or vendor metadata associated with the file.	Check whether the publisher matches the operating-system component, application vendor, or trusted software expected in the process.
Path	The complete filesystem location of the listed item.	Determine whether the file is in an expected Windows or application directory, or in an unusual user-writable or temporary location.

Compare the filename, publisher, description, and path as a set. A familiar name in an expected system or application directory provides useful context. The same name in an unrelated directory may require investigation.

Organizing the module list

Sort columns: Sort by Name to group similar filenames, or by Company Name to group components by publisher and locate entries that do not fit the surrounding group.
Resize columns: Widen Path when the directory is important, or widen Description and Company Name when metadata is the focus.
Reorder columns: Move the fields most useful to the investigation toward the visible area of the list.

These are standard Process Explorer list interactions. Organizing the list does not alter the process or its loaded modules; it only changes how the information is displayed.

Context-menu actions for a selected entry

Right-click a module or mapped-file entry to access actions for investigating that item.

Action	Purpose	Typical investigative use
Properties	Opens the selected file’s Properties dialog.	Review file information and other available details, then compare them with the module’s path, publisher, and process context.
Search Online	Starts a browser search for the selected filename or component.	Find initial identification information, documentation, vendor references, or reports about the component.
Check VirusTotal	Uses Process Explorer’s VirusTotal integration to submit or query the selected DLL’s hash for reputation and analysis information.	Look for detections and reputation signals that can guide further investigation.

VirusTotal is an online service that provides reputation and analysis information based on file hashes or submitted files. Online results are investigative signals, not definitive verdicts. Evaluate them with the file path, digital signature information when available, publisher, description, process behavior, and the reason the module was loaded.

Practical example: reviewing a selected application

Select an application process in the main Process Explorer list.
Press Ctrl+D to switch the lower pane to DLL View.
Sort by Name or Company Name to organize the entries.
Inspect the Path column for loaded components.
Choose an unfamiliar entry, open Properties, and review its file information.
Use Search Online for initial identification, or use Check VirusTotal for reputation data.

Suppose a common Windows dialog library appears with a description and publisher consistent with Windows and a path under an expected Windows system directory. Those details together provide context for why the application loaded it. The filename alone would provide much less information.

Investigating an unexpected module

When an unfamiliar DLL appears after a process performs a relevant or suspicious action, first identify the entry and note whether it was recently highlighted green. Then examine its filename, full path, description, and company metadata.

A module in the expected Windows system directory or the application’s installation directory may be consistent with normal operation, but still deserves context-sensitive review.
A module in a user-writable directory or temporary directory may warrant additional investigation because those locations can be changed by applications or users more easily than protected installation directories.
A familiar DLL name does not establish legitimacy. A similarly named file can exist outside the expected Windows or application directory.
Use the load and unload highlights to correlate module changes with startup, plugins, document handling, user actions, errors, or other process behavior.

For an unexpected library, open Properties, compare the publisher and description with the expected product, use online lookup, and check VirusTotal when appropriate. Treat every result as evidence to combine with path, signature, and process context.

Troubleshooting common situations

An unfamiliar DLL appears in an application

Review the complete path rather than relying on the filename.
Compare the publisher and description with the expected application or Windows component.
Open Properties to inspect available file details.
Use Search Online and Check VirusTotal as additional evidence.

A DLL appears briefly and then disappears

Watch for a green highlight indicating a recent load and a red highlight indicating a recent unload.
Reproduce the user action that triggers the behavior while observing the list across refreshes.
Relate the module transition to application startup, a plugin, an error, or another process event.
Use the module path and Properties information to determine which product or component owns the file.

A known DLL name appears suspicious

Verify its path and company metadata. Do not assume that a familiar filename is legitimate when it is loaded from an unexpected directory. Use Properties, online lookup, and reputation information to gather corroborating evidence.

The expected DLL list is not visible

Select the intended process in the main window.
Press Ctrl+D to enable DLL View.
Confirm that the lower pane has not been hidden with Ctrl+L.

Exam-relevant notes

DLL View is associated with the currently selected process, not a system-wide inventory of DLL files.
The list can contain the process image, DLL modules, and mapped files; not every entry is necessarily a DLL.
Ctrl+D displays DLL View, while Ctrl+L hides the lower pane.
Green indicates a recently loaded entry and red indicates a recently unloaded entry.
Filename, description, company, and path should be interpreted together.
A reputation result supports an investigation but does not replace path, signature, publisher, and behavioral analysis.

For related study, see the DLL View reference.