set H=smss.exe csrss.exe winlogon.exe services.exe lsass.exe svchost.exe explorer.exewmic process get executablepath,caption|findstr /i "%h%" pause
