We have already running windows process. How to determine what parameters it has been ran with?

Question

For example I have a running process seen in windows task manager (.exe). I'd like to see the parameters that's been passed to the process when it was started. I do not start this proces, nor I have any control or an easy way of debugging the spot it's getting started. Any suggestions ?

Answer 1

See if this works for you: http://windowsxp.mvps.org/listproc.htm

Type the command given below exactly:

WMIC /OUTPUT:C:\ProcessList.txt PROCESS get Caption,Commandline,Processid

or

WMIC /OUTPUT:C:\ProcessList.txt path win32_process get Caption,Processid,Commandline

Now, open the file C:\ProcessList.txt. You can see the details of all the processes in that file.