Another peculiarity: after an in-place upgrade of Windows 10 to 11, fsmainui.exe sometimes spawns two instances. One is the legitimate UI server; the second is a zombie process left behind by a failed Fast User Switching event. Killing the second instance does nothing to security, yet users panic, assuming a rootkit.