DesktopProcess

http://technet.microsoft.com/en-us/library/cc938262.aspx

HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\DesktopProcess

值为0:All of the components of Windows Explorer (Explorer, Desktop, and Taskbar) run as separate threads in a single, multithreaded process called Explorer.exe. 这样只会有一个explorer.exe

值为1:All instances of Windows Explorer run in one process and the Desktop and Taskbar run in a separate process. Both processes are called Explorer.exe.这样可能出现2个explorer.exe.可用于DLL劫持后启动一个新的explorer.exe.