I stumbled upon an instance of rundll32 while checking on the running processes on my windows 10 box.

This is the command line that started it according to Process Explorer:

C:\Windows\system32\rundll32.exe -localserver 22d8c27b-47a1-48d1-ad08-7da7abd79617

What does it mean? I tried researching this but found nothing.

Is it good/normal? Should I kill it and investigate further?

  • 22d8c27b-47a1-48d1-ad08-7da7abd79617 is a clsid. Can you find it in your registry?
    – DavidPostill
    Feb 4, 2017 at 20:48
  • 3
    I tried both Edit-> Find (checked all checkboxes) and Exporting the whole HKEY_CLASSES_ROOT and searching it with a text editor. I found no trace of that class id...
    – beppe9000
    Feb 5, 2017 at 23:33
  • I also have this mystery process running. Funnily enough I have exactly the same ID string in the arguments. Nov 17, 2017 at 15:58
  • On my machine, this process is crashing frequently. I am able to find that the parent process is a DllHost for "Shell Create Object Task Server", from shell32.dll. I believe at least the server itself is a Windows builtin; I haven't found any third-party influence yet. superuser.com/posts/1279807
    – sourcejedi
    Dec 25, 2017 at 9:22

3 Answers 3


I have found the origin of this process. It is quite simple and kinda dumb.

When you play a video (be it youtube or vlc or whatever), and you change the volume using a keyboard shortcut you see this:


This is what the process does, right here. If you do a fresh reboot, and change the volume while watching a video, the process will appear right as the slider with the video title appears. And if you kill the rundll32 process, the picture on the right will disappear.

I was driven crazy trying to find what the hell this rundll32 could be, and the answer made me feel dumb for having tried in the first place

  • this makes sense
    – beppe9000
    Nov 9, 2020 at 18:16
  • 2
    But when I kill this process the volume overlay still works as supposed and the process hasn't been restarted. I don't understand.
    – TotalAMD
    Aug 13, 2021 at 16:06
  • Thank you for the info. I was just thinking that this was some sort of malware. Nov 10, 2021 at 16:25

According to someone over at MSDN it is a part of windows called the "Process Profiling Performance Analysis Program (Windows Performance Counter Program)"



I saw this process on Windows 10, processing User Tiles - more commonly known as User Account Pictures. Possibly it is used to process other types of untrusted user data; I don't know.

The code is part of the Windows "shell" (desktop interface) package, and the process is running as the user "NT Authority/SYSTEM". I think this means it is part of the login / "fast user switching" interface. The behaviour I observed is all down to Windows. I was specifically looking out for any (buggy) third-party code, and I did not find anything suspicious.

Windows Rundll32 (child process of DllHost) is crashing. How can I even identify it?


I captured a stack trace of thread 0, while it processed an incoming COM request. It shows a class Windows_UI_Immersive!CUserTileValidator. I was capturing this trace as the process was crashing, when it processed the picture. In my mental model, this is a sandboxed process that decompresses the user picture, but I expect a precise description would be more complex.

The issue was specific to one user: I was able to reproduce the crash by locking my session and logging in as this specific user, but not the other way round. The user's profile picture was displayed as the default icon. Changing the user's profile picture stopped the crashes.

I cannot find documentation for the -localserver option of Rundll32. As per other commenters, the UUID value cannot be found anywhere in the registry. I don't know how Rundll32 looks up this value! The term LocalServer is used elsewhere when talking about a command used to launch a dedicated COM server process. (Often DllHost.exe, as mentioned below).

Technical details

The Rundll32 process had a parent process, an instance of DllHost.exe ("COM Surrogate"). Looking at the command line of the DllHost, the /ProcessID parameter was an AppID listed in the registry as "Shell Create Object Task Server", from shell32.dll. Both processes ran as "NT Authority/SYSTEM".

In some sense, the crashes I saw were anticipated. DllHost.exe was designed to run unreliable COM objects. Apparently this was within a user session. My link doesn't comment on don't know how well it protects insecure COM objects; a particular concern when run as SYSTEM.

  • Hmmm, weird. My instance didn't have a parent, so seems that it outlived it somehow.
    – Adrian
    Nov 7, 2019 at 16:34

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .