Узнать процесс родителя

  type
  PROCESS_BASIC_INFORMATION = packed record
    ExitStatus: DWORD;
    PebBaseAddress: Pointer;
    AffinityMask: DWORD;
    BasePriority: DWORD;
    uUniqueProcessId: Ulong;
    uInheritedFromUniqueProcessId: Ulong;
  end;

function  NtQueryInformationProcess(
    ProcessHandle : THandle;
    ProcessInformationClass : Byte;
    ProcessInformation : Pointer;
    ProcessInformationLength : ULONG;
    ReturnLength : PULONG
  ): DWORD; stdcall; external 'ntdll.dll';
 
function GetOwnedProcessID(const dwProcessHandle: DWORD): DWORD;
const
  ProcessBasicInformation = 0;
var
  Info: PROCESS_BASIC_INFORMATION;
begin
  Result := 0;
  if NtQueryInformationProcess(dwProcessHandle,
    ProcessBasicInformation, @Info, SizeOf(Info), nil) = NO_ERROR then
    Result := Info.uInheritedFromUniqueProcessId;
end;

DuplicateHandle(GetCurrentProcess, GetCurrentProcess, GetCurrentProcess, @dwProcessHandle, 0, False, DUPLICATE_SAME_ACCESS);
Edit1.text:= IntToStr(GetOwnedProcessID(dwProcessHandle));