High CPU Usage From a Process You’ve Never Heard Of
Your computer suddenly becomes slow.
The fans get louder. Teams starts stuttering. Outlook takes longer to respond. Your browser freezes for a moment.
So you do the sensible thing.
You open Task Manager.
And there it is.
Right at the top of the CPU column is something called:
WmiPrvSE.exe
Or:
RuntimeBroker.exe
Or:
SearchIndexer.exe
Or some completely unfamiliar collection of letters followed by .exe.
Using 72% CPU.
Naturally, the first thought is:
> “What on earth is that, and should I kill it?”
Maybe.
But don't start clicking End task just yet.
An unfamiliar process using a lot of CPU is not automatically malware, and high CPU usage is not automatically a fault. The important question is whether the process is doing legitimate work, temporarily working hard, malfunctioning, or genuinely something that should not be running on the computer. Microsoft similarly recommends identifying the process responsible before investigating the underlying cause of sustained high CPU usage.
Here's how to investigate it without accidentally making the problem worse.
First: High CPU Usage Is Not Automatically Bad
Your processor is there to do work.
If you ask your computer to:
Export a large video
Process a massive spreadsheet
Install an update
Scan thousands of files
Synchronise OneDrive
Run antivirus software
Build a search index
Compile software
you should expect the CPU to become busy.
A computer sitting at 90% CPU for five minutes while completing a large task is very different from a supposedly idle computer sitting at 90% CPU for three hours.
That's why the first question shouldn't be:
> “How do I get CPU usage down?”
It should be:
> “What is using the CPU, and why?”
This is the same approach Hamilton Group recommends when diagnosing other performance problems. The percentage itself is usually a symptom. You need to identify the process, the workload and the pattern behind it.
Step One: Open Task Manager
Press:
Ctrl + Shift + Esc
Open the Processes tab.
Click the CPU heading to sort processes from highest usage to lowest.
Now look at the process near the top.
Before doing anything else, note:
The exact process name
How much CPU it is using
Whether the usage is rising or falling
How long the computer has been slow
What you were doing when the problem started
For example:
> SearchIndexer.exe — 48% CPU — laptop recently updated
is useful information.
So is:
> unknownprocess.exe — 86% CPU — PC idle for two hours
The name alone doesn't tell you enough.
Step Two: Wait for a Few Minutes
This sounds obvious, but it prevents a lot of unnecessary troubleshooting.
A process briefly using 80% CPU might be completely normal.
Watch it for five or ten minutes.
Ask:
Is the CPU usage falling?
Does the process eventually finish?
Is the computer becoming responsive again?
A temporary spike often has a perfectly reasonable explanation.
For example, after a Windows update, the computer may still be:
Updating applications
Rebuilding indexes
Scanning files
Updating security software
Synchronising OneDrive
Completing background maintenance
These activities can temporarily increase CPU, memory and disk activity.
If the process settles down, you've probably found a temporary workload rather than a major problem.
If it remains high, keep investigating.
Step Three: Find Out Where the Process Actually Lives
This is one of the most useful checks.
Right-click the suspicious process in Task Manager.
Look for:
Open file location
Now pay attention to where Windows takes you.
A legitimate Microsoft system process will normally be located somewhere sensible, such as:
C:\Windows\System32
or another recognised Windows location.
A legitimate business application should normally be inside:
C:\Program Files
or:
C:\Program Files (x86)
A process running from somewhere like:
A temporary folder
A random folder inside AppData
An unusual Downloads location
A strangely named user directory
deserves more scrutiny.
That doesn't automatically prove malware. Plenty of legitimate applications use user-profile folders and temporary locations.
But the file location gives you an important clue.
The Buff IT Guy rule is:
> Don't judge a process by its name alone. Find out where it came from.
Step Four: Check the Properties and Publisher
Right-click the executable file and select:
Properties
Look for:
The publisher
Product name
File description
Version information
Digital signature, where available
A properly signed executable from a recognised software publisher is generally less suspicious than an anonymous executable with no meaningful publisher information.
But again, don't use one clue in isolation.
A legitimate process can have an unfamiliar name.
A malicious process can use a familiar-looking name.
For example, an attacker may deliberately choose something that resembles a Windows process:
svchost.exe
might be legitimate.
Something subtly different might not be:
svch0st.exe
Notice the zero instead of the letter o.
That's why you should look at:
Name + location + publisher + behaviour
rather than relying on one detail.
Step Five: Search the Exact Process Name
If the process is:
SomethingService.exe
search for the exact name.
Don't just search:
> “High CPU Windows”
Search:
> "SomethingService.exe" high CPU
You are looking for answers to questions such as:
Which application installed it?
Is it a Windows component?
Is it associated with a printer, security product or business application?
Are other people reporting high CPU usage?
Is there a known bug?
Has the software vendor published an update?
Be careful where you get your information.
A random website offering:
> “Download the official SomethingService.exe replacement!”
is not necessarily somewhere you want to download software from.
Prefer:
Microsoft documentation
The original software vendor
Your IT provider
Well-established technical resources
Step Six: Check the Details Tab
Task Manager's Details tab gives you more information about individual processes, including the process ID (PID). Microsoft documents the Details view as one way to identify running processes and their PIDs.
This becomes particularly useful when there are multiple processes with similar names.
For example, you might see several browser processes.
That isn't necessarily a problem.
Modern browsers deliberately separate:
Tabs
Extensions
Rendering processes
GPU processes
Background services
So seeing ten browser processes doesn't automatically mean something has gone wrong.
Instead, identify which individual process is using the CPU and what it is associated with.
Step Seven: Check Whether the Process Is Actually the Problem
This is important.
Imagine:
CPU: 12%
Memory: 94%
Disk: 100%
The computer may feel terrible.
But the problem probably isn't CPU.
Or imagine:
CPU: 100%
Memory: 55%
Disk: 8%
Now CPU is much more likely to be the bottleneck.
Task Manager and Resource Monitor are useful because they let you compare CPU activity with memory, storage and network activity rather than assuming the biggest number is automatically the cause.
Sometimes the process showing high CPU is simply reacting to another problem.
For example:
Low memory
↓
Windows relies more heavily on storage
↓
Applications become slower
↓
Processes wait and retry
↓
CPU behaviour becomes unusual
The visible symptom isn't always the original cause.
Step Eight: Use Resource Monitor
For more detail, press:
Windows key + R
Type:
resmon
Press Enter.
Resource Monitor gives you separate views for:
CPU
Memory
Disk
Network
This is particularly useful when Task Manager tells you:
> “Something is busy.”
but you want to know:
> “What exactly is it doing?”
You can investigate which processes are active and compare CPU activity against other resource usage. Hamilton Group's recent troubleshooting guidance recommends using Resource Monitor when a problem needs more detail than the standard Task Manager view provides.
Common Legitimate Processes That Can Use Lots of CPU
There are plenty of Windows processes that look suspicious simply because their names aren't particularly friendly.
Examples can include processes associated with:
Windows Search
Search indexing can become busy after:
Large numbers of files are added
A Windows update
A profile migration
A significant file reorganisation
Microsoft Defender
Antivirus software needs to inspect files.
A scan can temporarily use noticeable CPU and disk resources.
Windows Update
Installing updates is not always a lightweight operation.
Background servicing can consume resources before, during and after the visible update process.
OneDrive
Large synchronisation jobs can create CPU, disk and network activity.
Browser Processes
Chrome, Edge and other browsers may create multiple processes for different tabs, extensions and services.
Manufacturer Software
Laptop and desktop manufacturers frequently install background tools for:
Driver updates
Battery management
Audio
Graphics
Hardware monitoring
Some are useful.
Some are unnecessary.
Some occasionally misbehave.
That's why identifying the publisher is useful.
When Should You Be Worried?
There are several warning signs that justify further investigation.
The CPU Usage Never Drops
If a process has been using 70–100% CPU for hours without doing anything useful, something may be stuck.
The Process Restarts Repeatedly
A process that crashes, restarts and immediately consumes CPU again may have:
Corrupt files
A software bug
A compatibility issue
A damaged configuration
A problematic update
The File Location Looks Wrong
An unfamiliar executable running from an unusual temporary or user folder deserves investigation.
The Publisher Is Unknown
Not every legitimate program has a famous publisher.
But an unknown executable with no meaningful information and unusual behaviour is more concerning than a signed Microsoft or recognised business application.
The Computer Is Idle
High CPU while rendering a video is expected.
High CPU while the computer is doing absolutely nothing is worth investigating.
The Problem Appeared Suddenly
Ask:
Did Windows update?
Did the application update?
Was new software installed?
Did a printer driver change?
Did the user connect a new device?
Did the problem start after a particular event?
Timing is often one of the best diagnostic clues.
Don't Immediately Delete the File
This is where people can make things considerably worse.
You find a process using 80% CPU.
You Google the name.
One forum says:
> “Just delete it.”
Please don't.
Deleting a system file can:
Stop Windows services
Break an application
Prevent the computer from starting correctly
Create additional security problems
Similarly, repeatedly ending a process might make the symptoms disappear temporarily without fixing the cause.
If the process belongs to a legitimate application, the better fix might be:
Updating the application
Repairing the installation
Reinstalling it
Updating a driver
Correcting a configuration problem
What About Malware?
Malware can absolutely consume significant CPU.
Some malicious software performs activities such as:
Cryptocurrency mining
Data processing
Network communication
Downloading additional software
Running malicious background tasks
But don't assume:
> High CPU = virus
Microsoft recommends using Windows Security to investigate suspected threats. You can run a quick scan or scan a specific suspicious file or folder with Microsoft Defender.
If you genuinely suspect the computer may be compromised:
1. Don't enter sensitive credentials unnecessarily.
2. Run an appropriate security scan.
3. Record the suspicious process name and location.
4. Contact your IT provider if the device belongs to the business.
5. Avoid downloading random “process removal” tools from the internet.
For business computers, it's usually better to investigate properly than let somebody experiment on a potentially compromised device.
The Buff IT Guy's High CPU Workout
The Buff IT Guy sees:
CPU: 98%
He does not immediately flex and click End task.
He asks:
What is it?
Where is it running from?
Who published it?
What is it doing?
When did it start?
Does the CPU usage eventually fall?
Is something else actually causing the problem?
Then he lifts the right problem.
Because killing the wrong Windows process is a bit like removing a warning light from your car dashboard.
The warning disappears.
The problem might still be there.
A Simple Troubleshooting Checklist
When you see an unfamiliar process using lots of CPU:
1. Open Task Manager with Ctrl + Shift + Esc
2. Sort by CPU usage
3. Record the exact process name
4. Watch whether usage falls after a few minutes
5. Check the process file location
6. Review the publisher and file properties
7. Search the exact process name
8. Compare CPU with memory and disk activity
9. Check Resource Monitor if more detail is needed
10. Run a security scan if the behaviour appears suspicious
11. Check whether updates or software changes happened recently
12. Contact IT support before deleting important files or ending critical processes
How Hamilton Group Can Help
Persistent high CPU usage can be frustrating because the visible process isn't always the real problem.
Hamilton Group can help businesses investigate performance issues properly rather than relying on trial and error.
We can help with:
Windows performance troubleshooting
High CPU and memory usage
Slow PCs and laptops
Application problems
Driver issues
Windows update problems
Malware investigations
Microsoft Defender and endpoint security
OneDrive and Microsoft 365 issues
Hardware health checks
Device replacement planning
Managed IT support
Monitoring recurring performance problems
The advantage of having experienced IT support is that you don't need your employees spending half a morning Googling mysterious .exe files.
We identify what's happening.
We work out whether it's normal.
We find the actual cause when it isn't.
And we fix the right thing.
If your business computers are regularly slowing down, freezing or sounding like they're preparing for take-off, Hamilton Group can help.
Call Hamilton Group on 0330 043 0069
Email: hello@hgmssp.com