With my limited knowledge on the matter, NOD32 (ESET) has 3 processes : ekrn.exe (SYSTEM), eguiProxy.exe (User) and egui.exe (User). egui.exe is responsible of

With my limited knowledge on the matter, NOD32 (ESET) has 3 processes : ekrn.exe (SYSTEM), eguiProxy.exe (User) and egui.exe (User). egui.exe is responsible of the UI interacting with the user and seems to not be running at all if the user never brings up the UI. Considering the memory usage of the UI (~25 MB), looks like they choose to run a very lightweight UI (tray icon only) with eguiProxy.exe (2 MB) then start egui.exe if the user brings up the UI. To be noted: the memory usage of the UI is almost the same as ekrn.exe which I suppose is the AV engine (1) [1] I don't run the full suite and some features have been disabled (SSL MITM, web inspection and email inspection)