[[cHackAll]]

Código Delphi [-]
uses TlHelp32;
 
function GetProcessImageFileName(dwProcessId: Cardinal): string overload;
var
 hSnapshot: Integer;
 ModuleEntry: TModuleEntry32;
begin
// Result := '';
 hSnapshot := CreateToolhelp32Snapshot(TH32CS_SNAPMODULE, dwProcessId);
 if hSnapshot <> -1 then
  begin
   if Module32First(hSnapshot, ModuleEntry) then
    Result := ModuleEntry.szExePath;
   CloseHandle(hSnapshot);
  end;
end;
 
procedure TForm1.Button1Click(Sender: TObject);
begin
 ShowMessage(GetProcessImageFileName(666));
end;