.. / taskhostw.exe

Star

• Image Path: System32 dir
• Parent Process: svchost.exe
• Number of Instances: 1+
• User Account: Multiple
• Start Time: Varies

The generic host process for Windows Tasks. Upon initialization, taskhostw.exe runs a continuous loop listening for trigger events. Example trigger events that can initiate a task include a defined schedule, user logon, system startup, idle CPU time, a Windows log event, workstation lock, or workstation unlock. There are more than 160 tasks preconfigured on a default installation of Windows 10 Enterprise (though many are disabled). All executable files (DLLs & EXEs) used by the default Windows 10 scheduled tasks are signed by Microsoft.

Image Path

Executable’s image path.

%SystemRoot%\System32\taskhostw.exe

Parent Process

A process which spawned the analyzed process.

svchost.exe

Number of Instances

Expected number of processes running which may normally run on Windows.

One or more

User Account

Windows account with which the process was launched. This defines what privileges given process has.

Multiple taskhostw.exe processes are normal. One or more may be owned by logged-on users and/or by local service accounts.

Start Time

Expected time of process to be launched.

Start times vary greatly