Viewing the Process Tree - tlist/tasklist [closed]

I think you want this:

tasklist /SVC

If this is not helpful then I recommend Process Explorer. It is a program which shows all parent and child processes.

This is the official link: http://technet.microsoft.com/en-us/sysinternals/bb896653.aspx

Also you can tried

tasklist /M

It will give you result like that:

BESClientUI.exe               4296 ntdll.dll, wow64.dll, wow64win.dll,                                   wow64cpu.dllSynTPHelper.exe               2216 N/Asihost.exe                    9340 ntdll.dll, KERNEL32.DLL, KERNELBASE.dll,                                   msvcrt.dll, combase.dll, ucrtbase.dll,                                   RPCRT4.dll, bcryptPrimitives.dll,                                   sechost.dll, advapi32.dll,                                   CoreMessaging.dll, ntmarta.dll,

Also you can filter it

tasklist /M /FI "xxx"

Where as xxx you can specyfi filter parameters

Filters:    Filter Name     Valid Operators           Valid Value(s)    -----------     ---------------           --------------------------    STATUS          eq, ne                    RUNNING | SUSPENDED                                              NOT RESPONDING | UNKNOWN    IMAGENAME       eq, ne                    Image name    PID             eq, ne, gt, lt, ge, le    PID value    SESSION         eq, ne, gt, lt, ge, le    Session number    SESSIONNAME     eq, ne                    Session name    CPUTIME         eq, ne, gt, lt, ge, le    CPU time in the format                                              of hh:mm:ss.                                              hh - hours,                                              mm - minutes, ss - seconds    MEMUSAGE        eq, ne, gt, lt, ge, le    Memory usage in KB    USERNAME        eq, ne                    User name in [domain\]user                                              format    SERVICES        eq, ne                    Service name    WINDOWTITLE     eq, ne                    Window title    MODULES         eq, ne                    DLL name

for example:

tasklist /M /FI "IMAGENAME eq explorer.exe"

Which give's you somethin similar:

Image Name                     PID Modules========================= ======== ============================================explorer.exe                  9912 ntdll.dll, KERNEL32.DLL, KERNELBASE.dll,                                   msvcrt.dll, combase.dll, ucrtbase.dll,                                   RPCRT4.dll, bcryptPrimitives.dll,                                   OLEAUT32.dll, msvcp_win.dll, shcore.dll,                                   advapi32.dll, sechost.dll, powrprof.dll,                                   user32.dll, win32u.dll, GDI32.dll,                                   gdi32full.dll, shlwapi.dll,                                   windows.storage.dll, kernel.appcore.dll,                                   profapi.dll, FLTLIB.DLL, SHELL32.dll,                                   cfgmgr32.dll, TWINAPI.dll, PROPSYS.dll,                                   winmm.dll, settingsynccore.dll,                                   UxTheme.dll, dwmapi.dll, SspiCli.dll,                                   USERENV.dll, twinapi.appcore.dll,                                   WININET.dll, WTSAPI32.dll,                                   TextInputFramework.dll, WINMMBASE.dll,                                   bcrypt.dll, cryptsp.dll, RMCLIENT.dll,                                   CoreUIComponents.dll, CoreMessaging.dll,                                   wintypes.dll, ntmarta.dll, IMM32.DLL,