Batch program to to check if process exists - windows

I want a batch program, which will check if the process notepad.exe exists.
if notepad.exe exists, it will end the process,
else the batch program will close itself.
Here is what I've done:
#echo off
tasklist /fi "imagename eq notepad.exe" > nul
if errorlevel 1 taskkill /f /im "notepad.exe"
exit
But it doesn't work. What is the wrong in my code?

TASKLIST does not set errorlevel.
echo off
tasklist /fi "imagename eq notepad.exe" |find ":" > nul
if errorlevel 1 taskkill /f /im "notepad.exe"
exit
should do the job, since ":" should appear in TASKLIST output only if the task is NOT found, hence FIND will set the errorlevel to 0 for not found and 1 for found
Nevertheless,
taskkill /f /im "notepad.exe"
will kill a notepad task if it exists - it can do nothing if no notepad task exists, so you don't really need to test - unless there's something else you want to do...like perhaps
echo off
tasklist /fi "imagename eq notepad.exe" |find ":" > nul
if errorlevel 1 taskkill /f /im "notepad.exe"&exit
which would appear to do as you ask - kill the notepad process if it exists, then exit - otherwise continue with the batch

This is a one line solution.
It will run taskkill only if the process is really running otherwise it will just info that it is not running.
tasklist | find /i "notepad.exe" && taskkill /im notepad.exe /F || echo process "notepad.exe" not running.
This is the output in case the process was running:
notepad.exe 1960 Console 0 112,260 K
SUCCESS: The process "notepad.exe" with PID 1960 has been terminated.
This is the output in case not running:
process "notepad.exe" not running.

TASKLIST doesn't set an exit code that you could check in a batch file. One workaround to checking the exit code could be parsing its standard output (which you are presently redirecting to NUL). Apparently, if the process is found, TASKLIST will display its details, which include the image name too. Therefore, you could just use FIND or FINDSTR to check if the TASKLIST's output contains the name you have specified in the request. Both FIND and FINDSTR set a non-null exit code if the search was unsuccessful. So, this would work:
#echo off
tasklist /fi "imagename eq notepad.exe" | find /i "notepad.exe" > nul
if not errorlevel 1 (taskkill /f /im "notepad.exe") else (
specific commands to perform if the process was not found
)
exit
There's also an alternative that doesn't involve TASKLIST at all. Unlike TASKLIST, TASKKILL does set an exit code. In particular, if it couldn't terminate a process because it simply didn't exist, it would set the exit code of 128. You could check for that code to perform your specific actions that you might need to perform in case the specified process didn't exist:
#echo off
taskkill /f /im "notepad.exe" > nul
if errorlevel 128 (
specific commands to perform if the process
was not terminated because it was not found
)
exit

That's why it's not working because you code something that is not right, that's why it always exit and the script executer will read it as not operable batch file that prevent it to exit and stop
so it must be
tasklist /fi "IMAGENAME eq Notepad.exe" 2>NUL | find /I /N "Notepad.exe">NUL
if "%ERRORLEVEL%"=="0" (
msg * Program is running
goto Exit
)
else if "%ERRORLEVEL%"=="1" (
msg * Program is not running
goto Exit
)
rather than
#echo off
tasklist /fi "imagename eq notepad.exe" > nul
if errorlevel 1 taskkill /f /im "notepad.exe"
exit

Try this:
#echo off
set run=
tasklist /fi "imagename eq notepad.exe" | find ":" > nul
if errorlevel 1 set run=yes
if "%run%"=="yes" echo notepad is running
if "%run%"=="" echo notepad is not running
pause

Related

Batch File which checks for another Batch File process

so google didn't help me at all i need to ask here again.
I use this kind of method to check if my servers are running in 2 batch files.
tasklist /FI "IMAGENAME eq server_64.exe" 2> nul | find "server_64.exe" > nul
IF ERRORLEVEL == 1 (
echo Server is not running
echo.
) else (
echo Stopping Server ...
echo.
taskkill /F /IM server_64.exe > nul 2>&1
)
One to start and one to stop the servers.
Well this works great but when it comes to batch files it wont work for me...
I have one server which runs on phyton so start it via batch file.
My question is, is there a way to get somehow the batch file process status and stop it like it works for exe?
I hope i explained it good enough.
Thx in advance! :)
You can try it with a batch file like this :
#echo off
set "Process=server_64.exe"
Title Checking for status of this process ===^> "%Process%"
tasklist /nh /fi "imagename eq %Process%" 2>nul |find /i "%Process%" >nul
IF '%ERRORLEVEL%' EQU '1' (
Color 0B
echo.
echo "%Process%" is not running
) else (
Color 0C
echo.
echo Stopping "%Process%" ...
taskkill /F /IM "%Process%" > nul 2>&1
)
pause
Omg i found the solution, this was a beast...
tasklist /fi "imagename eq cmd.exe" /v /fo table /nh | find /i "Broker" 2>nul
but what is starmnge is that i cant get the output to be silnce...
when i try to mute it it gives me always error level 1.
tasklist /fi "imagename eq cmd.exe" /v /fo table /nh 2>nul | find /i "Broker" 2>nul
so whats wrong with this? ^

Find opened process in Windows batch

I'm trying to write code which loops and tells if a certain process is opened or not. It should be a loop that will show me in real time if the process is opened or not. In other words, a text will change when the program is opened and change again when it's closed. Instead what I got was a flood with the same text and it doesn't show the 'echos' below it.
I tried this:
#echo off
goto xera
:start
tasklist /FI "IMAGENAME eq notepad.exe" | find /I "notepad.exe" > nul
IF %ERRORLEVEL% equ 0 ECHO is opened
IF %ERRORLEVEL% equ 1 ECHO isnt opened
:xera
set /p "=Status: " <nul &call :start //the code got 'stuck' here
ECHO Text 2 (doesnt show)
pause>nul
You are not terminating your sub-routine :start correctly. Try the following:
#echo off
goto xera
:start
tasklist /FI "IMAGENAME eq notepad.exe" | find /I "notepad.exe" > nul
IF %ERRORLEVEL% equ 0 ECHO is opened
IF %ERRORLEVEL% equ 1 ECHO isnt opened
exit /b
:xera
set /p "=Status: " <nul &call :start
ECHO Text 2 (doesnt show)
pause>nul
I inserted exit /b which tells the command interpreter to return to the command after the call statement that actually called it. You could also use goto :EOF instead. Type call /? for more information on how to call sub-routines in batch.

How to kill process that may not exist on prebuild step in Visual studio?

Problem is if this process doesn't exist, build fails. I try to write something like this
tasklist /nh /fi "imagename eq XDesProc.exe" | find /i "XDesProc.exe" && (
TASKKILL /F /IM "XDesProc.exe"
) || (
echo XAML designer is not running
)
But ERRORLEVEL is equal to 1 too and bild fails if XDesProc.exe is not running.
You could use a conditional test on the PID to avoid this:
taskkill /f /fi "pid gt 0" /im xdesproc.exe

how to get PID from command line filtered by username and imagename

I need to be able to get the PID from a running process (cmd.exe) using the command line.
The problem is there are two cmd.exe running. One is under the username SYSTEM and one is compUser. Is there a way that I can grab the PID of the compUser cmd.exe?
Edit: This needs further explanation.
I'm doing this from a batch file. One of the calls that I'm making in my batch file starts a cmd.exe that never dies. So killing that cmd.exe would be simple:
taskkill /F /IM cmd.exe /FI "username eq compUser"
The problem is that the batch file that I'm in is being handled by another instance of cmd.exe under the username compUser. What I'm attempting to do is get the PID from the original cmd.exe before I start the second cmd.exe. That way I can just use the command:
taskkill /F /IM cmd.exe /FI "username eq compUser" /FI "PID neq [orignal task's PID]"
The way I ended up having to do this was use:
TASKLIST /NH /FI "IMAGENAME eq cmd.exe" /FI "username eq compUser"> psid.txt
FOR /F "tokens=2" %%I in (psid.txt ) DO set pIdNotToKill=%%I
right before I started the batch script that hangs. Then when I was ready to kill the hanging cmd window:
taskkill /F /IM cmd.exe /FI "PID ne %pIdNotToKill%" /FI "username eq compUser"
There is probably a better way, but this worked.
This will display all processes named "cmd.exe" for the user "compUser":
tasklist /FI "IMAGENAME eq cmd.exe" /FI "USERNAME eq compUser"
I set the Title to my own cmd window, other cmd windows what I call or run by "start /b" I rename to other window title name. Next I detect PID, set MYPID and kill all other cmd with OTHER PID of my.
All on one file, working in other label loop with timeout dalay.
#(#Title TitleOfMyScript)
for /f "tokens=2" %%a in ('tasklist /fi "imagename eq cmd.exe" /fi "windowtitle eq TitleOfMyScript" /nh') do set MYPID=%%a
taskkill /FI "PID ne %MYPID%" /FI "IMAGENAME eq cmd.exe" /F
I'd like just to share my piece of code, maybe it will be useful for somebody. It is based on the comment from jiggawagga, but it can terminate many processes:
#ECHO off
SETLOCAL ENABLEDELAYEDEXPANSION
REM kill old server process
SET pIdNotToKill=
SET pIdFilter=
FOR /F "tokens=2" %%I IN (%SERVER_HOME%\psid.txt) DO (
IF NOT "%%I"=="No" (
SET pIdNotToKill=!pIdNotToKill! %%I
SET pIdFilter=!pIdFilter! /FI "PID ne %%I"
)
)
IF NOT "!pIdNotToKill!"=="" (
ECHO Killing all Java processes except%pIdNotToKill%
ECHO TASKKILL command will be called with the filter%pIdFilter%
TASKKILL /F /IM java.exe %pIdFilter%
)
DEL %SERVER_HOME%\psid.txt
TASKLIST /NH /FI "IMAGENAME eq java.exe" > %SERVER_HOME%\psid.txt
right before I start server process.

How to check if a process is running via a batch script

How can I check if an application is running from a batch (well cmd) file?
I need to not launch another instance if a program is already running. (I can't change the app to make it single instance only.)
Also the application could be running as any user.
Another possibility I came up with, which does not require to save a file, inspired by using grep is:
tasklist /fi "ImageName eq MyApp.exe" /fo csv 2>NUL | find /I "myapp.exe">NUL
if "%ERRORLEVEL%"=="0" echo Program is running
/fi "" defines a filter of apps to find, in our case it's the *.exe name
/fo csv defines the output format, csv is required because by default the name of the executable may be truncated if it is too long and thus wouldn't be matched by find later.
find /I means case-insensitive matching and may be omitted
See the man page of the tasklist command for the whole syntax.
Here's how I've worked it out:
tasklist /FI "IMAGENAME eq notepad.exe" /FO CSV > search.log
FOR /F %%A IN (search.log) DO IF %%~zA EQU 0 GOTO end
start notepad.exe
:end
del search.log
The above will open Notepad if it is not already running.
Edit: Note that this won't find applications hidden from the tasklist. This will include any scheduled tasks running as a different user, as these are automatically hidden.
I like Chaosmaster's solution! But I looked for a solution which does not start another external program (like find.exe or findstr.exe). So I added the idea from Matt Lacey's solution, which creates an also avoidable temp file. At the end I could find a fairly simple solution, so I share it...
SETLOCAL EnableExtensions
set EXE=MyProg.exe
FOR /F %%x IN ('tasklist /NH /FI "IMAGENAME eq %EXE%"') DO IF NOT %%x == %EXE% (
echo %EXE% is Not Running
)
This is working for me nicely...
The above is an edit. The original code apparently had a GOTO in it, which someone in the comments thought uncouth.
Spaces
If you are concerned that the program name may have spaces in it then you need to complicate the code very slightly:
SETLOCAL EnableExtensions
set EXE=My Prog.exe
FOR /F %%x IN ("%EXE%") do set EXE_=%%x
FOR /F %%x IN ('tasklist /NH /FI "IMAGENAME eq %EXE%"') DO IF NOT %%x == %EXE_% (
echo %EXE% is Not Running
)
The original code will work fine whether or not other running processes have spaces in their names. The only concern is whether or not the process we are targeting has space(s).
ELSE
Keep in mind that if you add an ELSE clause then it will be executed once for every instance of the application that is already running. There is no guarantee that there be only a single instance running when you run this script.
Should you want one anyway, either a GOTO or a flag variable is indicated.
Ideally the targeted application should already mutex itself to prevent multiple instances, but that is a topic for another SO question and is not necessarily applicable to the subject of this question.
GOTO again
I do agree with the "ELSE" comment. The problem with the GOTO-less solution, that is may run the condition part (and the ELSE part) multiple times, so it is a bit messy as it has to quit the loop anyway. (Sorry, but I do not deal with the SPACE issue here, as it seems to be pretty rare and a solution is shown for it)
SETLOCAL EnableExtensions
SET EXE=MyProg.exe
REM for testing
REM SET EXE=svchost.exe
FOR /F %%x IN ('tasklist /NH /FI "IMAGENAME eq %EXE%"') DO IF NOT %%x == %EXE% (
ECHO %EXE% is Not Running
REM This GOTO may be not necessary
GOTO notRunning
) ELSE (
ECHO %EXE is running
GOTO Running
)
...
:Running
REM If Running label not exists, it will loop over all found tasks
The suggestion of npocmaka to use QPROCESS instead of TASKLIST is great but, its answer is so big and complex that I feel obligated to post a quite simplified version of it which, I guess, will solve the problem of most non-advanced users:
QPROCESS "myprocess.exe">NUL
IF %ERRORLEVEL% EQU 0 ECHO "Process running"
The code above was tested in Windows 7, with a user with administrator rigths.
TASKLIST | FINDSTR ProgramName || START "" "Path\ProgramName.exe"
Under Windows you can use Windows Management Instrumentation (WMI) to ensure that no apps with the specified command line is launched, for example:
wmic process where (name="nmake.exe") get commandline | findstr /i /c:"/f load.mak" /c:"/f build.mak" > NUL && (echo THE BUILD HAS BEEN STARTED ALREADY! > %ALREADY_STARTED% & exit /b 1)
TrueY's answer seemed the most elegant solution, however, I had to do some messing around because I didn't understand what exactly was going on. Let me clear things up to hopefully save some time for the next person.
TrueY's modified Answer:
::Change the name of notepad.exe to the process .exe that you're trying to track
::Process names are CASE SENSITIVE, so notepad.exe works but Notepad.exe does NOT
::Do not change IMAGENAME
::You can Copy and Paste this into an empty batch file and change the name of
::notepad.exe to the process you'd like to track
::Also, some large programs take a while to no longer show as not running, so
::give this batch a few seconds timer to avoid a false result!!
#echo off
SETLOCAL EnableExtensions
set EXE=notepad.exe
FOR /F %%x IN ('tasklist /NH /FI "IMAGENAME eq %EXE%"') DO IF %%x == %EXE% goto ProcessFound
goto ProcessNotFound
:ProcessFound
echo %EXE% is running
goto END
:ProcessNotFound
echo %EXE% is not running
goto END
:END
echo Finished!
Anyway, I hope that helps. I know sometimes reading batch/command-line can be kind of confusing sometimes if you're kind of a newbie, like me.
I use PV.exe from http://www.teamcti.com/pview/prcview.htm installed in Program Files\PV with a batch file like this:
#echo off
PATH=%PATH%;%PROGRAMFILES%\PV;%PROGRAMFILES%\YourProgram
PV.EXE YourProgram.exe >nul
if ERRORLEVEL 1 goto Process_NotFound
:Process_Found
echo YourProgram is running
goto END
:Process_NotFound
echo YourProgram is not running
YourProgram.exe
goto END
:END
The answer provided by Matt Lacey works for Windows XP. However, in Windows Server 2003 the line
tasklist /FI "IMAGENAME eq notepad.exe" /FO CSV > search.log
returns
INFO: No tasks are running which match the specified criteria.
which is then read as the process is running.
I don't have a heap of batch scripting experience, so my soulution is to then search for the process name in the search.log file and pump the results into another file and search that for any output.
tasklist /FI "IMAGENAME eq notepad.exe" /FO CSV > search.log
FINDSTR notepad.exe search.log > found.log
FOR /F %%A IN (found.log) DO IF %%~zA EQU 0 GOTO end
start notepad.exe
:end
del search.log
del found.log
I hope this helps someone else.
I like the WMIC and TASKLIST tools but they are not available in home/basic editions of windows.Another way is to use QPROCESS command available on almost every windows machine (for the ones that have terminal services - I think only win XP without SP2 , so practialy every windows machine):
#echo off
:check_process
setlocal
if "%~1" equ "" echo pass the process name as forst argument && exit /b 1
:: first argument is the process you want to check if running
set process_to_check=%~1
:: QPROCESS can display only the first 12 symbols of the running process
:: If other tool is used the line bellow could be deleted
set process_to_check=%process_to_check:~0,12%
QPROCESS * | find /i "%process_to_check%" >nul 2>&1 && (
echo process %process_to_check% is running
) || (
echo process %process_to_check% is not running
)
endlocal
QPROCESS command is not so powerful as TASKLIST and is limited in showing only 12 symbols of process name but should be taken into consideration if TASKLIST is not available.
More simple usage where it uses the name if the process as an argument (the .exe suffix is mandatory in this case where you pass the executable name):
#echo off
:check_process
setlocal
if "%~1" equ "" echo pass the process name as forst argument && exit /b 1
:: first argument is the process you want to check if running
:: .exe suffix is mandatory
set "process_to_check=%~1"
QPROCESS "%process_to_check%" >nul 2>&1 && (
echo process %process_to_check% is running
) || (
echo process %process_to_check% is not running
)
endlocal
The difference between two ways of QPROCESS usage is that the QPROCESS * will list all processes while QPROCESS some.exe will filter only the processes for the current user.
Using WMI objects through windows script host exe instead of WMIC is also an option.It should on run also on every windows machine (excluding the ones where the WSH is turned off but this is a rare case).Here bat file that lists all processes through WMI classes and can be used instead of QPROCESS in the script above (it is a jscript/bat hybrid and should be saved as .bat):
#if (#X)==(#Y) #end /* JSCRIPT COMMENT **
#echo off
cscript //E:JScript //nologo "%~f0"
exit /b
************** end of JSCRIPT COMMENT **/
var winmgmts = GetObject("winmgmts:\\\\.\\root\\cimv2");
var colProcess = winmgmts.ExecQuery("Select * from Win32_Process");
var processes = new Enumerator(colProcess);
for (;!processes.atEnd();processes.moveNext()) {
var process=processes.item();
WScript.Echo( process.processID + " " + process.Name );
}
And a modification that will check if a process is running:
#if (#X)==(#Y) #end /* JSCRIPT COMMENT **
#echo off
if "%~1" equ "" echo pass the process name as forst argument && exit /b 1
:: first argument is the process you want to check if running
set process_to_check=%~1
cscript //E:JScript //nologo "%~f0" | find /i "%process_to_check%" >nul 2>&1 && (
echo process %process_to_check% is running
) || (
echo process %process_to_check% is not running
)
exit /b
************** end of JSCRIPT COMMENT **/
var winmgmts = GetObject("winmgmts:\\\\.\\root\\cimv2");
var colProcess = winmgmts.ExecQuery("Select * from Win32_Process");
var processes = new Enumerator(colProcess);
for (;!processes.atEnd();processes.moveNext()) {
var process=processes.item();
WScript.Echo( process.processID + " " + process.Name );
}
The two options could be used on machines that have no TASKLIST.
The ultimate technique is using MSHTA . This will run on every windows machine from XP and above and does not depend on windows script host settings. the call of MSHTA could reduce a little bit the performance though (again should be saved as bat):
#if (#X)==(#Y) #end /* JSCRIPT COMMENT **
#echo off
setlocal
if "%~1" equ "" echo pass the process name as forst argument && exit /b 1
:: first argument is the process you want to check if running
set process_to_check=%~1
mshta "about:<script language='javascript' src='file://%~dpnxf0'></script>" | find /i "%process_to_check%" >nul 2>&1 && (
echo process %process_to_check% is running
) || (
echo process %process_to_check% is not running
)
endlocal
exit /b
************** end of JSCRIPT COMMENT **/
var fso= new ActiveXObject('Scripting.FileSystemObject').GetStandardStream(1);
var winmgmts = GetObject("winmgmts:\\\\.\\root\\cimv2");
var colProcess = winmgmts.ExecQuery("Select * from Win32_Process");
var processes = new Enumerator(colProcess);
for (;!processes.atEnd();processes.moveNext()) {
var process=processes.item();
fso.Write( process.processID + " " + process.Name + "\n");
}
close();
I don't know how to do so with built in CMD but if you have grep you can try the following:
tasklist /FI "IMAGENAME eq myApp.exe" | grep myApp.exe
if ERRORLEVEL 1 echo "myApp is not running"
Just mentioning, if your task name is really long then it won't appear in its entirety in the tasklist result, so it might be safer (other than localization) to check for the opposite.
Variation of this answer:
:: in case your task name is really long, check for the 'opposite' and find the message when it's not there
tasklist /fi "imagename eq yourreallylongtasknamethatwontfitinthelist.exe" 2>NUL | find /I /N "no tasks are running">NUL
if "%errorlevel%"=="0" (
echo Task Found
) else (
echo Not Found Task
)
If you have more than one .exe-file with the same name and you only want to check one of them (e.g. you care about C:\MyProject\bin\release\MyApplication.exe but not C:\MyProject\bin\debug\MyApplication.exe) then you can use the following:
#echo off
set "workdir=C:\MyProject\bin\release"
set "workdir=%workdir:\=\\%"
setlocal enableDelayedExpansion
for /f "usebackq tokens=* delims=" %%a in (`
wmic process where 'CommandLine like "%%!workdir!%%" and not CommandLine like "%%RuntimeBroker%%"' get CommandLine^,ProcessId /format:value
`) do (
for /f "tokens=* delims=" %%G in ("%%a") do (
if "%%G" neq "" (
rem echo %%G
set "%%G"
rem echo !ProcessId!
goto :TheApplicationIsRunning
)
)
)
echo The application is not running
exit /B
:TheApplicationIsRunning
echo The application is running
exit /B
I needed a solution with a retry. This code will run until the process is found and then kill it. You can set a timeout or anything if you like.
Notes:
The ".exe" is mandatory
You could make a file runnable with parameters, version below
:: Set programm you want to kill
:: Fileextension is mandatory
SET KillProg=explorer.exe
:: Set waiting time between 2 requests in seconds
SET /A "_wait=3"
:ProcessNotFound
tasklist /NH /FI "IMAGENAME eq %KillProg%" | FIND /I "%KillProg%"
IF "%ERRORLEVEL%"=="0" (
TASKKILL.EXE /F /T /IM %KillProg%
) ELSE (
timeout /t %_wait%
GOTO :ProcessNotFound
)
taskkill.bat:
:: Get program name from argumentlist
IF NOT "%~1"=="" (
SET "KillProg=%~1"
) ELSE (
ECHO Usage: "%~nx0" ProgramToKill.exe & EXIT /B
)
:: Set waiting time between 2 requests in seconds
SET /A "_wait=3"
:ProcessNotFound
tasklist /NH /FI "IMAGENAME eq %KillProg%" | FIND /I "%KillProg%"
IF "%ERRORLEVEL%"=="0" (
TASKKILL.EXE /F /T /IM %KillProg%
) ELSE (
timeout /t %_wait%
GOTO :ProcessNotFound
)
Run with .\taskkill.bat ProgramToKill.exe
I'm assuming windows here. So, you'll need to use WMI to get that information. Check out The Scripting Guy's archives for a lot of examples on how to use WMI from a script.
I used the script provided by Matt (2008-10-02). The only thing I had trouble with was that it wouldn't delete the search.log file. I expect because I had to cd to another location to start my program. I cd'd back to where the BAT file and search.log are, but it still wouldn't delete. So I resolved that by deleting the search.log file first instead of last.
del search.log
tasklist /FI "IMAGENAME eq myprog.exe" /FO CSV > search.log
FOR /F %%A IN (search.log) DO IF %%-zA EQU 0 GOTO end
cd "C:\Program Files\MyLoc\bin"
myprog.exe myuser mypwd
:end
Building on vtrz's answer and Samuel Renkert's answer on an other topic, I came up with the following script that only runs %EXEC_CMD% if it isn't already running:
#echo off
set EXEC_CMD="rsync.exe"
wmic process where (name=%EXEC_CMD%) get commandline | findstr /i %EXEC_CMD%> NUL
if errorlevel 1 (
%EXEC_CMD% ...
) else (
#echo not starting %EXEC_CMD%: already running.
)
As was said before, this requires administrative privileges.
I usually execute following command in cmd prompt to check if my program.exe is running or not:
tasklist | grep program
You should check the parent process name, see The Code Project article about a .NET based solution**.
A non-programmatic way to check:
Launch Cmd.exe
Launch an application (for instance, c:\windows\notepad.exe)
Check properties of the Notepad.exe process in Process Explorer
Check for parent process (This shows cmd.exe)
The same can be checked by getting the parent process name.

Resources