-1

In my pc, something is repetadly starting an app1.exe. Whether the starter is exe, dll, task,service, etc. I want to find out what application that starts app1.exe. Is there way to find it? Is there a way to track and monitor it?

Task Manager startup, task sched checked app1.exe is not there. There is no entry about app1.exe anywhere.

It's not something you can look at tasksched. or services. It's embedded as source code.

Code logic is like this.

if file not exist "c:\app1.exe" {  
    download app1.exe to "C:\"
}

run "c:\app1.exe"
karel
  • 13,706
bh_earth0
  • 99

1 Answers1

1

Get and run the Process Explorer from Microsoft Sysinternals.

You can double-click any process and in its Properties window on Image tab there is a field Parent which shows the parent app and its PID. That is the process which launched your app.

If parent process no longer exists, then only PID is shown there. In such cases, you can find the parent process as described in related superuser Q&A.

miroxlav
  • 14,845