Windows sysinternals

54 Part II Usage Guide
FIGURE 3-7 The Process Image tab of the Select Columns dialog box.
Process Image Tab
The Process Image tab (shown in Figure 3-7) contains process attributes that, for the most
part, are established at process start and do not change over the life of a process. These
include the Process Name and PID columns, which are always displayed and cannot be
deselected. The other columns you can select from this tab are as follows:
■ User Name The user account in which the process is running, in DOMAIN\USER
format.
■ Description Extracted from the version resource of the executable image. If this
column is not enabled, the information appears in the process name tooltip.
■ Company Name Extracted from the version resource of the executable image. If this
column is not enabled, the information appears in the process name tooltip.
■ Verified Signer Indicates whether the executable image has been verified as digitally
signed by a certificate that chains to a root authority trusted by the computer. See the
“Verifying Image Signatures” section later in this chapter for more information.
■ Version The file version extracted from the version resource of the executable image.
■ Image Path The path to the executable image. Note that when this column is
enabled, the process name tooltip no longer shows the full path.
■ Image Type (64 vs 32-bit) On 64-bit versions of Windows, this field indicates whether
the program is running native 64-bit code or 32-bit code running in WOW64 (Windows
On Windows64). On 32-bit versions of Windows, this check box is disabled.
www.it-ebooks.info