VMware ESXi and vSphere Cluster Management

Using the Strings Tab in Process Explorer

Learn how to inspect, search, compare, and save printable strings from a process image on disk or loaded in memory with Process Explorer.

The Strings tab in Process Explorer helps you inspect readable text associated with a running process. You can examine strings from the executable image on disk, compare them with strings from the process image in memory, search for indicators, and save the displayed results for later analysis.

This lesson assumes basic familiarity with Windows processes, selecting a process in Process Explorer, and the difference between an executable file on disk and a process loaded into memory.

What the Strings tab does

The Strings tab belongs to the selected process's Process Properties window. Process Properties is the Process Explorer dialog that exposes detailed information about one running process.

A string is a contiguous sequence of characters, often representing human-readable text. A printable string consists primarily of displayable text characters rather than binary values or control data. Examples include:

  • Application names and product identifiers
  • File and directory paths
  • URLs, domain names, and protocol names
  • Registry key names
  • Error messages and diagnostic text
  • Command-line fragments and configuration references

Strings can provide clues about application behavior, embedded configuration, imported text, or suspicious indicators. They are clues rather than proof: a process may contain text that it never uses, or the text may come from a shared library or embedded resource.

Displayed string criteria

The list displays printable character strings that meet a minimum length of 3 characters. Shorter fragments are not shown as normal entries, and non-printable binary data is not represented as a readable string in the list.

Open the Strings tab

  1. In Process Explorer, select the process you want to investigate.
  2. Open the selected process's Properties window.
  3. Select the Strings tab.

The tab presents a list of printable strings and controls for choosing the source, searching the list, and saving the current output.

Choose the string source

The source options determine where Process Explorer reads the strings. Image is selected by default.

Image — Strings are extracted from the process image file stored on disk. This represents the executable file itself, not necessarily the exact bytes currently present in memory. Use it to understand what readable text is embedded in the on-disk executable.

Memory — Strings are read from the process image as it is loaded in memory. This can expose runtime changes, content revealed by unpacking or decompression, and text decrypted after loading.

Image strings

The Image option examines the executable image associated with the process as stored on disk. It is the default source and is useful for establishing a baseline of the file's embedded text.

Image strings may include paths, URLs, product names, messages, registry references, and other text compiled into the executable. They do not necessarily show text generated at runtime or text that exists only in memory.

Memory strings

Select Memory to inspect the process image as represented in memory after loading. Memory inspection is useful when an executable is packed, compressed, unpacked, decrypted, or modified during execution.

Access limitations can affect this view. Insufficient permissions, protected processes, security controls, or a process that exits before inspection can result in limited output or prevent memory inspection.

Image versus Memory string sources

Source option: Image
Where strings are read from: The executable image file on disk.
Default state: Selected by default.
Typical use: Establish a baseline of text embedded in the file.
Why results may differ: Runtime-generated, unpacked, decrypted, or modified content may not exist in the file.

Source option: Memory
Where strings are read from: The process image loaded in memory.
Default state: Selected manually when needed.
Typical use: Inspect the image after loading and reveal runtime-readable content.
Why results may differ: Decompression, unpacking, decryption, loading changes, and runtime modifications can add or alter readable text.

Compare Image and Memory results

Strings from disk and memory may not match. An executable can contain compressed or packed data that is expanded through decompression, meaning compressed data is converted into a usable form after loading. The expanded content may contain strings that were not visible in the Image list.

An application may also perform decryption, converting encrypted content into readable form in memory. In that case, sensitive configuration, commands, URLs, or other text may appear in Memory strings even though the corresponding disk content is not readable.

Differences can also result from normal loading behavior, runtime-generated text, or changes made by the application. A difference supports further investigation, but it does not by itself prove malicious activity, tampering, or compromise.

Search the strings list

Select Find to open the standard Find dialog. This dialog lets you search for text in the current string list.

Useful search terms include:

  • A domain name, URL fragment, IP-address fragment, or protocol name
  • A filename or directory path
  • A registry key or application setting
  • A product name or internal server name
  • A command-line fragment
  • An error message or distinctive configuration phrase

Use specific terms where possible. A short or common term can produce many irrelevant matches. Search for distinctive paths, filenames, domains, or product identifiers, and review related entries around a match.

Save string results

Select Save to export the current strings list to a text file. Save output can support incident reports, offline review, comparisons between Image and Memory sources, sharing of indicators, and documentation of an investigation.

Record whether the export came from Image or Memory. The source type is necessary for interpreting the results later.

Handle saved output carefully. Strings may contain sensitive file paths, credentials, internal hostnames, customer data, configuration values, or other operational information. Store and share the export according to your organization's evidence-handling and data-protection requirements.

Strings Tab controls

Image radio button: Selects strings from the executable image file on disk. Use it for the on-disk baseline.

Memory radio button: Selects strings from the loaded process image in memory. Use it when runtime-unpacked, decrypted, or modified content is suspected.

Find button: Opens the standard Find dialog. Use it to locate a known phrase, path, domain, filename, or other indicator.

Save button: Writes the current strings output to a text file. Use it for reporting, comparison, sharing, or evidence documentation.

Recommended investigation workflow

  1. Select the process being investigated and open its Properties window.
  2. Select the Strings tab.
  3. Review Image strings first to understand text present in the on-disk executable.
  4. Use Find to search for relevant domains, paths, filenames, registry keys, product names, commands, or error messages.
  5. Switch to Memory when runtime-unpacked, decrypted, or modified content is suspected.
  6. Repeat searches and compare findings between the two sources.
  7. Save relevant results and record the selected source.
  8. Correlate the findings with the process name, executable path, publisher, command line, network activity, loaded modules, parent process, and other Process Explorer views.

Practical examples

Check an unfamiliar executable for network references

  1. Select the unfamiliar running process and open its Properties window.
  2. Open the Strings tab with Image selected.
  3. Search for recognizable domain suffixes, URLs, IP-address fragments, or protocol names.
  4. Switch to Memory and repeat the search if the executable appears packed or uses runtime-generated content.
  5. Treat matches as leads and validate them with network activity and process metadata.

Investigate a packed or protected application

  1. Review Image strings and note whether they contain little meaningful text.
  2. Select Memory to inspect the image after it has loaded.
  3. Compare whether product names, paths, messages, or configuration text appear only in memory.
  4. Save relevant output for later comparison and analysis.

Locate a configuration clue

  1. Use Find to search for a known filename, setting name, internal server name, or directory fragment.
  2. Review nearby strings for related configuration values.
  3. Confirm the finding through the process path, command line, environment, or application configuration files.

Document an incident-review finding

  1. Choose Image or Memory according to the question being investigated.
  2. Search for the suspected indicator.
  3. Save the visible strings to a text file.
  4. Record the process identity and source type with the exported result.

Troubleshooting missing or noisy results

Expected text is not present in Image strings

Possible causes include dynamically generated text, compressed, packed, encrypted, or encoded content, and text stored in a separate module, resource, configuration file, or downloaded content.

  • Check Memory strings.
  • Review loaded modules and related process information.
  • Search for alternate fragments rather than only an exact complete phrase.

Memory strings contain text not found in Image strings

The image may have been decompressed or unpacked after loading, content may have been decrypted in memory, or the application may have generated or modified the text during execution.

  • Document which source produced the finding.
  • Correlate it with process behavior and other evidence.
  • Do not treat the difference alone as conclusive proof of compromise.

The list contains many irrelevant strings

Executables commonly include library text, resources, diagnostic messages, and unused content. A short search term can also match common or unrelated strings.

  • Use more specific search phrases.
  • Search for distinctive paths, domains, filenames, or product identifiers.
  • Validate findings against the process identity and activity.

Memory inspection is limited or cannot be completed

Insufficient permissions, a protected process, a security control, or a process that has exited or changed state may restrict inspection.

  • Run with appropriate administrative rights where authorized.
  • Use the Image source when memory access is unavailable.
  • Collect supporting process details before the process terminates.

Limitations and safe interpretation

  • The presence of a string does not establish that the process used it.
  • The absence of a string does not establish that the application lacks the associated capability. Text may be generated dynamically, encoded, encrypted, compressed, or stored in another component.
  • Shared libraries and embedded resources can contribute strings unrelated to the immediate investigation.
  • Image and Memory differences are useful investigative leads, but they do not alone prove malicious activity or tampering.
  • Validate conclusions with other Process Explorer views and appropriate security-analysis tools.

Key terms

  • String: A contiguous sequence of characters, often representing human-readable text.
  • Printable string: A character sequence made of displayable text characters rather than binary or control data.
  • Process image: The executable image associated with a running process.
  • Image strings: Strings read from the executable image file on disk.
  • Memory strings: Strings read from the process image as represented in memory.
  • Decompression: Expansion of compressed or packed data into usable form, which can reveal strings at runtime.
  • Decryption: Conversion of encrypted content into readable form, potentially exposing strings after loading.
  • Find dialog: The standard search dialog opened by Find for locating text in the current string list.

For a focused reference, return to the Process Explorer Strings tab guide.