我正在寻找像 chp.exe 这样的东西,它可以运行一个命令并返回它的 pid。我无法使用 CHP.EXE,因为它似乎在某些防病毒软件中被报告为受感染的文件。
谢谢
Wmic process where (Name like '%CHP%') get caption, name, commandline, ProcessId | more
Run Code Online (Sandbox Code Playgroud)
真实样本:
Wmic process where (Name like '%ie%') get caption, name, commandline, ProcessId | more
Run Code Online (Sandbox Code Playgroud)
输出:

Wmic process get ProcessId
Run Code Online (Sandbox Code Playgroud)
从查询输出中仅将 processId 提取到变量中:
进程ID.cmd:
@ECHO OFF
FOR /F %%T IN ('Wmic process where^(Name^="explorer.exe"^)get ProcessId^|more +1') DO (
SET /A ProcessId=%%T) &GOTO SkipLine
:SkipLine
echo ProcessId = %ProcessId%
Run Code Online (Sandbox Code Playgroud)
输出:
ProcessId = 2372
Run Code Online (Sandbox Code Playgroud)