Parent processes

Child processes

wrtmon.exe executes as a process with the local user's privileges usually within the context of Windows Explorer. It is set to be start when the PC boots and any user logs into Windows (added to the Run registry key for the all users under the local machine). The file is digitally signed by Newsoft Technology Company which was issued by the VeriSign certificate authority (CA).

CPU
Total CPU:	0.00012693%	0.028634%
Kernel CPU:	0.00007333%	0.013761%
User CPU:	0.00005360%	0.014873%
Kernel CPU time:	130 ms/min	100,923,805ms/min
CPU cycles:	587,078/sec	17,470,203/sec
Context switches:	18/sec	284/sec
Memory
Private memory:	1.65 MB	21.59 MB
Private (maximum):	5.7 MB
Private (minimum):	5.4 MB
Non-paged memory:	1.65 MB	21.59 MB
Virtual memory:	61.38 MB	140.96 MB
Virtual memory (peak):	65.21 MB	169.69 MB
Working set:	5.44 MB	18.61 MB
Working set (peak):	5.71 MB	37.95 MB
Page faults:	1,534/min	2,039/min
I/O
I/O read transfer:	73 Bytes/sec	1.02 MB/min
I/O read operations:	1/sec	343/min
I/O other transfer:	10 Bytes/sec	448.09 KB/min
I/O other operations:	1/sec	1,671/min
Resource allocations
Threads:	1	12
Handles:	65	600
GUI GDI count:	17	103
GUI GDI peak:	22	142
GUI USER count:	14	49
GUI USER peak:	16	71