Discover associated files of a certain process through WMI?

Question

Is it possible to determine for a certain process (id), which files are associated to it (i.e. the executable file as well as all files that are currently accessed by the process)?

I have to use WMI unless there is no other option to avoid NtQuerySystemInformation. I already have a piece of code which can determine for a certain file, which processes are currently using it. But I need an efficient way for the opposite direction.

Thank you very much.

Answer 1

I cannot find anything with WMI but if the process is local, you can use the Modules of the System.Diagnostics.Process class.

Process[] processesByName = Process.GetProcessesByName("Myexe.exe");
foreach (ProcessModule module in processesByName[0].Modules)
{
    Console.WriteLine(module.FileName);
} 

Answer 2

As far i know there is not a wmi class to request the open handles for a running process, you must use the NtQuerySystemInformation function. check this link for a demo project using this function in C#.