VMware ESXi and vSphere Cluster Management

Using the .NET Assemblies Tab in Process Explorer

Learn when the .NET Assemblies tab appears in Process Explorer and how to inspect AppDomains, assembly names, flags, and full file paths.

The .NET Assemblies tab is a process-specific view in Process Explorer. It helps you examine managed code loaded by a qualifying .NET Framework process, including the AppDomains that contain the assemblies and the physical locations from which those assemblies were loaded.

What the .NET Assemblies Tab Is For

Process Explorer is a Windows process-inspection utility. Its process properties window includes diagnostic tabs that expose information about the selected process.

The .NET Assemblies tab is one of those views. It shows managed assemblies loaded inside the selected process and organizes them by AppDomain. This makes it useful when you need to confirm which .NET Framework components an application has loaded, where those components came from, or whether an unexpected library is present.

The view is not a machine-wide inventory of installed assemblies. It describes the currently selected process only. A different process may have a different set of assemblies, AppDomains, paths, and assembly flags.

.NET and .NET Framework Context

.NET is Microsoft's general-purpose application development platform. Applications built with it use managed code and runtime services instead of relying only on native Windows code.

.NET Framework is a Windows runtime environment for applications that target the .NET Framework. Many traditional Windows desktop, server, and business applications use this runtime.

The .NET Assemblies tab is intended for processes using the .NET Framework. A generic native Windows process does not load managed .NET Framework assemblies, so there is no managed assembly information for the tab to display. A process using another runtime, or a process that has not loaded the relevant managed runtime, may also not expose this view.

When the Tab Appears

Two conditions are important:

• The selected process must use the .NET Framework.
• Process Explorer must be running with administrative rights.

Administrative rights are elevated Windows permissions. To launch Process Explorer with elevation, start its executable using the Windows administrator option and approve the User Account Control prompt when Windows displays it.

If the tab is absent, do not immediately conclude that the application has no managed code. First check whether Process Explorer was started with elevation. Then check whether the selected process is actually a .NET Framework process. A native process or a process using a different runtime may not provide this tab even when other processes on the same computer do.

Opening the .NET Assemblies View

1. Start Process Explorer with administrative rights.
2. In the process list, select the application process you want to investigate.
3. Open the selected process's properties window.
4. Look for the .NET Assemblies tab.
5. If the tab is available, review the AppDomains first.
6. Expand or select each AppDomain and inspect the assemblies associated with it.

The exact arrangement of controls can vary with the Process Explorer version, but the investigation sequence is the same: select one process, open its properties, identify the AppDomains, and then examine the assemblies grouped under each AppDomain.

Understanding AppDomains

An AppDomain is a .NET Framework isolation and assembly-loading context inside a process. It provides a boundary in which an application or component can load assemblies and manage managed execution.

A single process can contain one or more AppDomains. Consequently, the same process may show several groups of assemblies rather than one flat list. Applications that use plug-ins, hosted components, or separate application contexts may load different assemblies into different AppDomains.

The tab organizes assemblies according to the AppDomain in which they are loaded. Review that grouping before deciding that an assembly is unexplained. An assembly that looks unusual in one group may be expected for a component hosted in that AppDomain.

What an Assembly Is

An assembly is a deployable .NET code unit. It is commonly a DLL or an executable containing managed code and related metadata. An application may load its main program assembly, framework dependencies, third-party libraries, plug-ins, and other supporting components.

The tab presents information about each loaded assembly. The most useful fields for routine inspection are the assembly name, assembly flags, and full assembly image path.

Information Shown in the .NET Assemblies Tab

The path is especially valuable because an assembly name alone does not identify its physical copy. Two files with the same or similar name can exist in different directories. Matching the name with the full executable image path can distinguish an approved application component from a copy loaded from a temporary, user-writable, or otherwise unexpected directory.

A Practical Inspection Method

1. Establish the process context

Confirm the process name and application you intended to inspect. The tab reports data for the selected process, so selecting a similarly named process can produce a misleading result.

2. Review AppDomains

List the AppDomains shown by the tab. Note whether the process contains one context or several. Multiple AppDomains are not automatically suspicious; they may reflect the application's architecture or its use of hosted components and plug-ins.

3. Review assemblies in each group

Within each AppDomain, examine assembly names, flags, and full paths. Identify the main application assemblies, framework-related dependencies, vendor libraries, and plug-ins that you expect the application to use.

4. Compare paths with trusted locations

Compare each full assembly image path with the application's approved installation directory and other known deployment locations. A familiar assembly name loaded from an unexpected directory deserves additional investigation.

5. Record findings precisely

When documenting an investigation, record the process, AppDomain, assembly name, flags, and complete path. This preserves the relationship between the component and its loading context instead of recording only a filename.

Example: Confirming an Application's Expected Libraries

1. Run Process Explorer with elevation and approve the User Account Control prompt.
2. Select the business application's .NET Framework process.
3. Open the process properties and select the .NET Assemblies tab.
4. Locate the AppDomain containing the application's primary assemblies.
5. Review the assembly names and compare them with the application's documented dependencies.
6. Compare each displayed full path with the expected installation directory.

This procedure helps verify that expected managed components are loaded from expected locations. It also separates a legitimate dependency from a file with a familiar name that was loaded from an unapproved location.

Example: Investigating an Unexpected Managed DLL

Suppose an application contains an assembly name that is unfamiliar, or a familiar name appears in an unusual directory.

1. Inspect every AppDomain rather than reviewing only the first group.
2. Record the assembly name, flags, and complete executable image path.
3. Compare the path with approved application deployment locations and trusted library directories.
4. Consider whether the application uses plug-ins, extensions, or a nonstandard deployment layout.
5. Use the displayed path as the starting point for additional file and security investigation.

The tab does not by itself prove that a component is malicious or unauthorized. It supplies process and loading-context evidence that can guide further verification.

Troubleshooting Missing or Unexpected Information

The tab is missing

Restart Process Explorer with elevation. If the tab is still missing, select a known .NET Framework application to determine whether the issue is specific to the original process. A process that uses no managed runtime, or a runtime other than the relevant .NET Framework environment, may not expose this view.

An assembly name is familiar but its location is unexpected

The application may have loaded a copy from a nonstandard directory, or a third-party extension or altered deployment may be present. Review the full executable image path, compare it with approved deployment locations, and investigate the file as appropriate.

The process has more assemblies than expected

The application may use dependencies, plug-ins, or multiple AppDomains. It may also have loaded additional managed components during normal operation. Review the AppDomain grouping first, then correlate assembly names and paths with the application's design and installed components.

Key Points

• The .NET Assemblies tab is found in the properties of a selected process.
• It is used to inspect managed assemblies loaded by qualifying .NET Framework processes.
• Process Explorer must be run with administrative rights for the tab to appear.
• Assemblies are grouped by AppDomain, an isolation and assembly-loading context inside the process.
• Assembly names identify components, flags provide additional displayed metadata or status, and full image paths identify their physical locations.
• Comparing assembly names and paths with expected deployment locations supports application verification and security investigation.