Dump Running DLL List to File on Windows 7

Q

How to dump the list of all processes with their DLL files that are running on my Windows 7 system? I want save names of all running processes and DLL into a file.

✍: FYIcenter.com

A

You can dump all processes with DLL files they are using on your Windows 7 using the "tastlist.exe" command as shown in this tutorial:

1. Enter "cmd.exe" in the Start button search box. Then click "cmd.exe" in the suggested match list.

2. Enter "tasklist.exe /M *" at the prompt. You will see a list of all running processes with their DLL files, also called modules. Some of them represent one or more services:

Image Name                     PID Modules                                     
========================= ======== ===================================
System Idle Process              0 N/A                                         
System                           4 N/A                                         
smss.exe                       308 N/A                                         
csrss.exe                      428 N/A                                         
...
taskhost.exe                  5744 
    ntdll.dll, kernel32.dll, KERNELBASE.dll, msvcrt.dll, ole32.dll, 
    GDI32.dll, USER32.dll, LPK.dll, USP10.dll, RPCRT4.dll, 
    OLEAUT32.dll, IMM32.DLL, MSCTF.dll, CRYPTBASE.dll, sechost.dll, 
    ADVAPI32.dll, uxtheme.dll, dwmapi.dll, CLBCatQ.DLL, wininet.dll, 
    api-ms-win-downlevel-user32-l1-1-0.dll, 
    api-ms-win-downlevel-shlwapi-l1-1-0.dll, shlwapi.DLL, 
    api-ms-win-downlevel-version-l1-1-0.dll, version.DLL, 
    api-ms-win-downlevel-normaliz-l1-1-0.dll, normaliz.DLL, 
    iertutil.dll, api-ms-win-downlevel-advapi32-l1-1-0.dll, 
    USERENV.dll, profapi.dll, api-ms-win-downlevel-ole32-l1-1-0.dll, 
    api-ms-win-downlevel-advapi32-l2-1-0.dll, RpcRtRemote.dll, 
    ESENT.dll, psapi.dll, SHELL32.dll, dimsjob.dll, MsCtfMonitor.dll, 
    MSUTB.dll, WINSTA.dll, WTSAPI32.dll, taskschd.dll, SspiCli.dll, 
    PlaySndSrv.dll, netprofm.dll, NSI.dll, nlaapi.dll, CRYPTSP.dll, 
    rsaenh.dl, npmproxy.dll, CRYPT32.dll, MSASN1.dll, dsrole.dll, 
    WINMM.dll, sqmapi.dll, MMDevAPI.DLL, PROPSYS.dll, wdmaud.drv, 
    ksuser.dll, AVRT.dll, SETUPAPI.dll, CFGMGR32.dll, DEVOBJ.dll, 
    AUDIOSES.DLL, msacm32.drv, MSACM32.dll, midimap.dll 
dwm.exe                       5804 
    ntdll.dll, kernel32.dll, KERNELBASE.dll,  GDI32.dll, USER32.dll, 
    LPK.dll, USP10.dll,  msvcrt.dll, UxTheme.dll, IMM32.dll,  
    MSCTF.dll, dwmredir.dll, dwmcore.dll,  ADVAPI32.dll, sechost.dll, 
    RPCRT4.dll,  WindowsCodecs.dll, ole32.dll, d3d10_1.dll,  
    d3d10_1core.dll, dxgi.dll, VERSION.dll,  dwmapi.dll, d3d11.dll, 
    DXGIDebug.dll,  WINTRUST.dll, CRYPT32.dll, MSASN1.dll,  
    igd10umd32.dll, D3Dx10_40.dll, uDWM.dll,  slc.dll   
explorer.exe                  5836 
    ntdll.dll, kernel32.dll, KERNELBASE.dll, ADVAPI32.dll, msvcrt.dll, 
    sechost.dll, RPCRT4.dll, GDI32.dll, USER32.dll, LPK.dll, USP10.dll, 
    SHLWAPI.dll, SHELL32.dll, ole32.dll, OLEAUT32.dll, 
    EXPLORERFRAME.dll, DUser.dll, DUI70.dll, IMM32.dll, MSCTF.dll, 
    UxTheme.dll, POWRPROF.dll, SETUPAPI.dll, CFGMGR32.dll, DEVOBJ.dll, 
    dwmapi.dll, slc.dll, gdiplus.dll, Secur32.dll, SSPICLI.DLL, 
    PROPSYS.dll, WINSTA.dll, CRYPTBASE.dll, comctl32.dll, 
    WindowsCodecs.dll, profapi.dll, apphelp.dll, CLBCatQ.DLL, 
    FileSyncShell.dll, MSVCP110.dll, MSVCR110.dll, Telemetry.dll, 
    LoggingPlatform.DLL, WSOCK32.dll, WS2_32.dll, NSI.dll, PSAPI.DLL, 
    VERSION.dll, Cabinet.dll, WINHTTP.dll, webio.dll, XmlLite.dll, 
    WININET.dll, api-ms-win-downlevel-user32-l1-1-0 .dll, 
    api-ms-win-downlevel-shlwapi-l1-1- 0.dll, 
    api-ms-win-downlevel-version-l1-1- 0.dll, 
    api-ms-win-downlevel-normaliz-l1-1 -0.dll, normaliz.DLL, 
    iertutil.dll, api-ms-win-downlevel-advapi32-l1-1 -0.dll, 
    USERENV.dll, GROOVEEX.DLL, MSVCR100.dll, MSVCP100.dll, ATL100.DLL, 
    msi.dll, GrooveIntlResource.dll, EhStorShell.dll, GROOVEEX.DLL, 
    MSVCR90.dll, MSVCP90.dll, ATL90.DLL, office.odf, 
    GrooveIntlResource.dll, IconCodecService.dll, CRYPTSP.dll, 
    rsaenh.dll, RpcRtRemote.dll, SndVolSSO.DLL, HID.DLL, MMDevApi.dll, 
    timedate.cpl, ATL.DLL, actxprxy.dll, ntmarta.dll, WLDAP32.dll, 
    shdocvw.dll, LINKINFO.dll, msls31.dll, tiptsf.dll, authui.dll, 
    CRYPTUI.dll, CRYPT32.dll, MSASN1.dll, gameux.dll, wer.dll, 
    urlmon.dll, api-ms-win-downlevel-ole32-l1-1-0. dll, 
    api-ms-win-downlevel-advapi32-l2-1 -0.dll, msiltcfg.dll, 
    ieframe.dll, api-ms-win-downlevel-shell32-l1-1- 0.dll, 
    api-ms-win-downlevel-shlwapi-l2-1- 0.dll, WINMM.dll, wdmaud.drv, 
    ksuser.dll, AVRT.dll, AUDIOSES.DLL, msacm32.drv, MSACM32.dll, 
    midimap.dll, MLANG.dll, UIAnimation.dll, stobject.dll, 
    BatMeter.dll, WTSAPI32.dll, WINTRUST.dll, es.dll, prnfldr.dll, 
    WINSPOOL.DRV, dxp.dll, Syncreg.dll, ehSSO.dll, netshell.dll, 
    IPHLPAPI.DLL, WINNSI.DLL, nlaapi.dll, AltTab.dll, 
    wpdshserviceobj.dll, PortableDeviceTypes.dll, 
    PortableDeviceApi.dll, btncopy.dll, ntshrui.dll, srvcli.dll, 
    cscapi.dll, netutils.dll, mssprxy.dll, pnidui.dll, QUtil.dll, 
    wevtapi.dll, dhcpcsvc.DLL, dhcpcsvc6.DLL, npmproxy.dll, cscui.dll, 
    CSCDLL.dll, cscobj.dll, Wlanapi.dll, wlanutil.dll, wwanapi.dll, 
    wwapi.dll, QAgent.dll, srchadmin.dll, SXS.DLL, SyncCenter.dll, 
    Actioncenter.dll, imapi2.dll, hgcpl.dll, provsvc.dll, SAMLIB.dll, 
    wkscli.dll, fxsst.dll, FXSAPI.dll, FXSRESM.DLL, MsftEdit.dll, 
    bthprops.cpl, DEVRTL.dll, MPR.dll, wscinterop.dll, WSCAPI.dll, 
    wscui.cpl, werconcpl.dll, framedynos.dll, wercplsupport.dll, 
    msxml6.dll, bcrypt.dll, hcproviders.dll, ieproxy.dll, OLEACC.dll, 
    UIAutomationCore.dll, thumbcache.dll, NetworkExplorer.dll, 
    StructuredQuery.dll, SearchFolder.dll, FirewallAPI.dll, 
    ShellStreams.dll, COMDLG32.dll, MSVCP120.dll, MSVCR120.dll, 
    RegNamespace.dll, log4cxx.dll, ODBC32.dll, CatalogBrowser.dll, 
    Utility.dll, zlib1.dll, libxml2.dll, iconv.dll, cryptopp.dll, 
    NETAPI32.dll, SAMCLI.DLL, odbcint.dll, napinsp.dll, pnrpnsp.dll, 
    mswsock.dll, DNSAPI.dll, winrnr.dll, wshbth.dll, WLIDNSP.DLL, 
    mdnsNSP.dll, PropSysDllHandler.dll, zipfldr.dll, msohevi.dll, 
    twext.dll, QQShellExt.dll, ATL80.DLL, MSVCR80.dll, MSVCP80.dll, 
    WZSHLSTB.DLL, UIRibbon.dll, rarext.dll, shellext.dll, mpclient.dll, 
    imagehlp.dll, ncrypt.dll, bcryptprimitives.dll, GPAPI.dll, 
    msxml3.dll, syncui.dll, SYNCENG.dll, NppShell_06.dll, MSIMG32.dll, 
    NaturalLanguage6.dll, NLSData0009.dll, NLSLexicons0009.dll, 
    ApplePhotoStreamsPS.dll, wmpnssui.dll, PhotoViewer.dll, d3d9.dll, 
    d3d8thk.dll, PhotoBase.dll, mmcshext.dll, hhsetup.dll, wship6.dll, 
    Wpc.dll, van.dll, RasMM.dll, RASAPI32.dll, rasman.dll, WWanMM.dll, 
    WlanMM.dll, wlanhlp.dll, OneX.DLL, eappprxy.dll, eappcfg.dll, 
    SFC.DLL, sfc_os.DLL, wpdshext.dll, SqmApi.dll, igfxpph.dll, 
    hccutils.DLL, igfxrENU.lrc, igfxsrvc.dll, sbdrop.dll, igfxress.dll, 
    DSROLE.DLL, SPPC.DLL, WinSATAPI.dll, dxgi.dll, SPINF.dll, 
    DXGIDebug.dll, Display.dll, themecpl.dll, RstrtMgr.DLL, mf.dll, 
    MFPlat.DLL
...

3. Type in "tasklist.exe /M * > C:\fyicenter\running_processes_with_dll.txt" in the command window. The output will be stored in a file.

Guess how many DLL files are used by the explorer.exe process? There are 274 DLL files used by the explorer.exe process!

By the way, explorer.exe is the Windows Program Manager or Windows Explorer. It manages the Windows Graphical Shell including the Start menu, taskbar, desktop, and File Manager. By removing this process the graphical interface for Windows will disappear.

 

Process Explorer on Windows 7

Dump Process List with Services to File on Windows 7

"tasklist.exe" Command on Windows 7

⇑⇑ Windows 7 Processes Tutorials

2016-08-06, 3400🔥, 0💬