Those processes are weird compared to normal processes. The main place the user mode information about a process is tracked in a normal windows process is throu

Those processes are weird compared to normal processes. The main place the user mode information about a process is tracked in a normal windows process is through the Process Environment Block (PEB). You get the list of modules and commandline and tons of other information by reading the PEB of a process. The processes in the Linux subsystem does not interact with the usual usermode parts of Windows at all, so they don't need a PEB. Actually their PEB is mapped to address 0 which is reserved. A lot of APIs for getting information about processes will try to read the PEB, and fail if they can't read that. So if you want useful information about those processes you can only use those APIs that queries the kernel about its information about the process. The Task Manager probably just assumes that it can get all the information normally, and ignores the process if something fails. Maybe it's even the API it uses that's the issue, someone could check whether the ToolHelp32 API even returns those processes (I don't know whether the Task Manager uses the ToolHelp32 API or the lower level PSAPI).