Process Highlighting in Process Explorer

Learn what Process Explorer highlight colors mean, how to open Configure Colors, and how to investigate new, exited, service, suspended, .NET, packed, and job-associated processes.

Process Explorer is a Windows process-inspection utility that displays a hierarchical process tree. The tree shows parent-child relationships and detailed information about running processes.

Process highlighting adds color-based visual classifications to process entries. These colors help you notice process categories and recent lifecycle events quickly, but a color alone does not prove that a process is safe, malicious, or problematic.

Why Process Explorer highlights processes

Color makes changes in a busy process tree easier to spot. For example, a newly launched helper process may briefly appear green, while a process that has just terminated may briefly appear red. Other colors identify characteristics such as service hosting, suspension, .NET usage, job association, or a possible packed executable.

A row can change appearance as its state or classification changes. Highlighting is therefore a visual aid for investigation, not a security verdict. When a color raises a question, verify it with the process properties and relevant columns.

View the color legend and configure colors

Open Process Explorer.
Open the Options menu.
Select Configure Colors.

The color configuration dialog describes the available highlight categories and shows their assigned colors. In versions that provide the controls, you can customize colors or disable particular highlighting categories.

Interface details and available controls can differ between Process Explorer versions. If a color or setting is not present, consult the descriptions shown by the installed version rather than assuming that every version has identical options.

Process Explorer highlight colors and meanings

Color	Process classification	Meaning	Typical investigative use	Important caveat
Green	Newly started process	The process has recently started.	Find helper or child processes created after launching an application, signing in, opening a file, or performing another action.	The emphasis is temporary and depends on refresh activity and configured behavior.
Red	Recently exited process	The process has recently terminated.	Spot short-lived helpers or programs that close immediately.	Exited entries are transient, not a permanent history of every terminated process.
Light blue	Same user account	The process runs under the same account as the Process Explorer instance.	Separate the current user's applications from service, system, or other-user processes.	The result depends on the account running Process Explorer, including whether it was launched elevated or under another account.
Pink	Service-hosting process	The process hosts one or more Windows services.	Investigate service hosts, startup behavior, and background system components.	A service-hosting process is not the same thing as an ordinary user application.
Dark gray	Fully suspended process	All threads in the process are suspended.	Investigate debugging, startup suspension, or control by another tool.	The process cannot be scheduled to execute until its threads are resumed.
Violet	Potentially packed image	Process Explorer heuristics identify the executable image as potentially packed, compressed, encrypted, or a combination of these.	Identify files that may be more difficult to inspect.	This is a heuristic indicator, not proof of malware or malicious intent.
Yellow	.NET process	The process uses the Microsoft .NET Framework or runtime.	Identify managed applications during application and runtime troubleshooting.	Not every modern Windows application is necessarily a .NET process.
Brown	Job-associated process	The process is associated with a Windows job object.	Investigate process containment, resource controls, accounting, or application-launched child processes.	Job association describes management by Windows; it does not by itself indicate a problem.

Understanding each highlight category

Green: newly started processes

A green row represents a process that has recently started. This is especially useful when you want to learn what an application launches behind the scenes. Start Process Explorer, launch the application, and watch for green entries beneath the expected parent process.

Green highlighting can reveal helper programs, updaters, browser subprocesses, or other child processes created by an action. The emphasis is temporary. A fast refresh rate and appropriate highlight settings make short events easier to see.

Red: recently exited processes

A red row represents a process that has recently exited. This can expose a helper process that performs a brief task or a program that terminates immediately after launch.

Exited entries are transient. They should not be treated as a permanent record of all processes that have ever run. If the process disappears before you can inspect it, repeat the action with a faster refresh interval or use complementary monitoring and logging tools.

Light blue: the same user account

Light blue identifies a process running under the same user account as the Process Explorer instance. This helps separate your applications from processes running as a service account, the system account, or another interactive user.

The comparison is based on the account running Process Explorer. Running it elevated, through a different account, or in another security context can change which rows receive this classification. Confirm the result in the User Name field and in the process properties.

Pink: a process hosting Windows services

Pink identifies a process hosting one or more Windows services. A Windows service is a background component managed by the Windows Service Control Manager.

This color is useful when examining service startup, background system activity, and service-host processes. A service-hosting process may contain one or more services and should not be interpreted as an ordinary user application simply because it appears in the same process tree.

Dark gray: a fully suspended process

Dark gray identifies a process whose threads are all suspended. A suspended process cannot be scheduled to execute until its threads are resumed.

Suspension may be expected during debugging, application startup control, inspection by another tool, or deliberate process management. Check the process and thread details before resuming or terminating it, because changing its state can affect the application or system.

Violet: a potentially packed executable

Violet identifies an executable image that Process Explorer's heuristics consider potentially packed, compressed, encrypted, or otherwise transformed. A packed image may obscure its original code layout, making static inspection more difficult.

A heuristic is a practical detection rule that suggests a condition without proving it. Legitimate software can use packing or protection techniques, so violet highlighting is not a malware verdict.

Review the full path, publisher, digital signature verification result, hash reputation, parent process, command line, and observed behavior. Escalate according to your organization's security procedures when several indicators are suspicious.

Yellow: .NET processes

Yellow identifies a process using the Microsoft .NET Framework or runtime. A .NET process is a managed application process that relies on that runtime environment.

This category helps during application and runtime troubleshooting, such as separating managed applications from native programs. It does not mean that all modern Windows applications use .NET.

Brown: processes associated with job objects

Brown identifies a process associated with a Windows job object. A job object is a Windows kernel mechanism that groups one or more processes for shared limits, accounting, containment, or lifecycle rules.

Job association can matter when investigating resource controls, process containment, forced termination behavior, or child processes launched by an application framework or management tool.

When classifications overlap

A process can satisfy more than one classification. For example, a .NET application can run under the same account as Process Explorer, and a service-hosting process can also be associated with a job object.

Do not assume that one visible color represents an exclusive category or rely on a universal color-precedence order. Display behavior can vary with the Process Explorer version and configuration. When the color does not answer the question, select the process and inspect its properties and columns, including the user name, image path, command line, parent process, services, threads, signature status, and other available details.

A repeatable monitoring workflow

Open Process Explorer and arrange the process tree so parent-child relationships are easy to follow.
Ensure process highlighting is enabled and review Options > Configure Colors if you need to confirm categories.
Reproduce one action, such as launching an application, opening a file, signing in, or attempting to start a program.
Observe green newly started entries and red recently exited entries.
Select a relevant process and inspect its parent process, command line, full image path, user account, services, threads, and digital signature information.
Compare the process with related entries in the tree instead of interpreting its color in isolation.
Repeat the test with a suitable refresh speed if a short-lived event is difficult to observe.

The refresh interval is how frequently Process Explorer updates the displayed process information. Faster refresh can make brief start and exit highlights easier to observe, although it may increase the amount of screen activity. Use the refresh settings available in your installed version and choose an interval that makes the event visible without making the tree difficult to follow.

Practical examples

Find processes launched by an application

Open Process Explorer and ensure highlighting is enabled.
Start the application being investigated.
Look for newly highlighted green entries.
Inspect each candidate's parent process, command line, image path, and user account.

This workflow uses temporary new-process highlighting to identify helper and child processes.

Investigate a program that closes immediately

Keep the process tree visible while reproducing the launch attempt.
Look for recently exited red entries.
Select a short-lived entry before it disappears, when possible, and inspect its available details.
If it is too brief to inspect, increase refresh frequency and repeat the reproduction, then use additional logging or monitoring.

A red entry is a clue that activity occurred; it does not explain why the process terminated.

Separate user applications from system activity

Run Process Explorer under the account relevant to the investigation.
Identify light-blue entries running under that same account.
Compare them with service-hosting and other-account processes.
Verify the User Name field and process properties rather than relying only on the color.

Assess a potentially packed executable

Identify the violet process entry.
Check its full path, publisher, signature verification result, parent process, and command line.
Treat the packed indicator as a reason for further review, not a verdict.
Escalate according to organizational security procedures if other indicators are suspicious.

Recognize a suspended application

Locate the dark-gray process.
Use process and thread details to confirm that its threads are suspended.
Determine whether suspension is expected from debugging, a launcher, or a management tool.
Avoid terminating or resuming the process until you understand the operational impact.

Color observation follow-up checks

Observed highlight	Recommended verification	Useful Process Explorer details
New or exited process	Reproduce the action and relate the event to its parent.	Parent process, command line, image path, start or exit timing, and user account.
Same-user process	Confirm the account running Process Explorer and compare it with the process account.	User Name, elevation context, and process properties.
Service-hosting process	Identify which services the process hosts and whether its startup is expected.	Services view or process properties, image path, parent process, and command line.
Suspended process	Confirm that all threads are suspended and identify what caused the suspension.	Threads, thread state, process properties, and related debugging or management tools.
Potentially packed image	Validate the file with multiple independent indicators.	Full path, publisher, signature status, hash reputation, parentage, command line, and behavior.
.NET process	Determine whether managed runtime behavior is relevant to the issue.	Image details, modules or runtime information, command line, and application properties.
Job-associated process	Determine what limits, containment, accounting, or lifecycle rules apply.	Process properties, child processes, resource behavior, and job-related details available in the installed version.

Troubleshooting unexpected highlighting

A color is not visible long enough to inspect

The process may start or exit very quickly.
The refresh interval may be too slow for the event.
Increase refresh frequency if appropriate and repeat the triggering action.
Use complementary process-monitoring or logging tools when the process is too short-lived.

A process has an unexpected user-account color

Process Explorer may be running elevated or under a different account.
The process may actually run under a service, system, or alternate user account.
Check the User Name field and process properties.
Confirm which account launched Process Explorer.

A violet highlight is interpreted as malware

Remember that packed-image detection is heuristic.
Legitimate software can use compression, encryption, or protection techniques.
Validate the signature, publisher, source, path, parentage, command line, and observed behavior before reaching a conclusion.

A process seems to match multiple categories

A process can simultaneously use .NET, run under the current account, host services, or belong to a job object.
Inspect process properties and relevant columns.
Do not infer a single exclusive category solely from the displayed color.

Exam-relevant notes

Green means recently started; red means recently exited.
Light blue compares the process account with the account running Process Explorer.
Pink identifies a process hosting one or more Windows services.
Dark gray means all process threads are suspended.
Violet is a heuristic indication of a potentially packed image, not proof of malware.
Yellow identifies a .NET process, while brown identifies association with a Windows job object.
Highlighting is visual classification and must be confirmed with process properties and other evidence.
Refresh speed affects how easily brief start and exit events can be observed.