Прочитать параметры запуска чужого процесса

Dim ntStatus As Long
Dim objBasic As PROCESS_BASIC_INFORMATION 
Dim objFlink As Long
Dim objPEB As Long, objLdr As Long
Dim objBaseAddress   As   Long
Dim bytName(260 * 2 - 1) As Byte
Dim strModuleName As String, objName As Long
Dim objCid As CLIENT_ID 
Dim objOa As OBJECT_ATTRIBUTES 
Dim hProcess As Long
Dim lngRet As Long, lngReturn As Long
 
    objOa.Length = Len(objOa) 
    objCid.UniqueProcess = dwProcessId ' здесь pid процесса access.exe
    ntStatus = NtOpenProcess(hProcess, PROCESS_QUERY_INFORMATION Or PROCESS_VM_READ, objOa, objCid) 
    If hProcess = 0 Then
       GetProcessCommandLine = ""
       Exit Function
    End If
    ntStatus = NtQueryInformationProcess(hProcess, ProcessBasicInformation, VarPtr(objBasic), Len(objBasic), ByVal 0&) 
    If (NT_SUCCESS(ntStatus)) Then
       objPEB = objBasic.PebBaseAddress 
       lngRet = ReadProcessMemory(hProcess, ByVal objPEB + &H10, objLdr, 4, ByVal 0&) 
       If lngRet <> 1 Then Exit   Function
       lngRet = ReadProcessMemory(hProcess, ByVal objLdr + &H44, objName, 4, ByVal 0&) 
       If lngRet <> 1 Then Exit   Function
          lngRet = ReadProcessMemory(hProcess, ByVal objName, bytName(0), 260 * 2, ByVal 0&) 
          If lngRet <> 1 Then Exit Function
          strModuleName = bytName 
          If InStr(strModuleName, """") = 0 Then
             strModuleName = Mid(strModuleName, InStr(strModuleName, Chr(0)) + 1, Len(strModuleName) - InStr(strModuleName, Chr(0))) 
          Else
             strModuleName = Mid(strModuleName, InStr(strModuleName, """"), Len(strModuleName) - InStr(strModuleName, """")) 
          End If
          strModuleName   =   Left(strModuleName   &   Chr(0),   InStr(strModuleName   &   Chr(0),   Chr(0))   -   1) 
          GetProcessCommandLine   =   strModuleName 
       End   If
       CloseHandle   hProcess 
End   Function

Option Explicit
Private Type PROCESS_BASIC_INFORMATION
    ExitStatus As Long
    PebBaseAddress As Long
    AffinityMask As Long
    BasePriority As Long
    UniqueProcessId As Long
    InheritedFromUniqueProcessId As Long
End Type
Private Type UNICODE_STRING
    Length As Integer
    MaxLength As Integer
    lpBuffer As Long
End Type
Private Declare Function OpenProcess Lib "kernel32" (ByVal dwDesiredAccess As Long, ByVal bInheritHandle As Long, ByVal dwProcessId As Long) As Long
Private Declare Function CloseHandle Lib "kernel32" (ByVal hObject As Long) As Long
Private Declare Function NtQueryInformationProcess Lib "ntdll" (ByVal ProcessHandle As Long, ByVal InformationClass As Long, ByRef ProcessInformation As Any, ByVal ProcessInformationLength As Long, ByRef ReturnLength As Any) As Long
Private Declare Function ReadProcessMemory Lib "kernel32" (ByVal hProcess As Long, lpBaseAddress As Any, lpBuffer As Any, ByVal nSize As Long, lpNumberOfBytesWritten As Long) As Long
 
 
Private Const PROCESS_QUERY_INFORMATION As Long = &H400&
Private Const PROCESS_VM_READ As Long = &H10&
 
Private Sub Form_Load()
    MsgBox GetCommandLineFromPID(2956)
End Sub
Private Function GetCommandLineFromPID(PID As Long) As String
    Dim hProcess As Long
    Dim pbi As PROCESS_BASIC_INFORMATION
    Dim lpPP As Long                ' Óêàçàòåëü íà ïàðàìåòðû ïðîöåññà
    Dim cmd As UNICODE_STRING       ' Ñòðóêòóðà äëÿ õðàíåíèÿ þíèêîäíîé ñòðîêè
 
    ' Ïîëó÷àåì õåíäë
    hProcess = OpenProcess(PROCESS_QUERY_INFORMATION Or PROCESS_VM_READ, False, PID)
    If hProcess Then
        ' Ïîëó÷àåì óêàçàòåëü íà PEB
        If NtQueryInformationProcess(hProcess, 0, pbi, Len(pbi), ByVal 0) Then Exit Function
        ' Ïîëó÷àåì óêàçàòåëü íà ïàðàìåòðû ïðîöåññà
        If ReadProcessMemory(hProcess, ByVal pbi.PebBaseAddress + &H10, lpPP, 4, 0) = 0 Then Exit Function
        ' Ïîëó÷àåì ñòðóêòóðó UNICODE_STRING ñîäåðæàùóþ êîììàíäíóþ ñòðîêó
        If ReadProcessMemory(hProcess, ByVal lpPP + &H40, cmd, Len(cmd), 0) = 0 Then Exit Function
        ' ×èòàåì ñòðîêó
        GetCommandLineFromPID = Space(cmd.Length \ 2) ' Âûäåëÿåì áóôåð äîñòàòî÷íîé äëèíû
        If ReadProcessMemory(hProcess, ByVal cmd.lpBuffer, ByVal StrPtr(GetCommandLineFromPID), cmd.Length, 0) = 0 Then Exit Function
        CloseHandle hProcess
    End If
End Function

Set ArgObj = WScript.Arguments 
Set AccApp = CreateObject("Access.Application")
AccApp.OpenCurrentDatabase argobj(0), False
sArg = argobj(1) 
if InStr(1, sArg, "/x", 1) = 1 then sArg = Right(sArg, Len(sArg) - 2)
AccApp.DoCmd.RunMacro sArg

Sub Test()
Dim objWMI As Object, objCollection  As Object, objApp  As Object
Set objWMI = GetObject("winmgmts:\\.\root\cimv2")
Set objCollection = objWMI.ExecQuery("SELECT * FROM Win32_Process WHERE Name='excel.exe'")
Select Case objCollection.Count
    Case 1
        Set objApp = GetObject(, "Excel.Application")
        MsgBox objApp.ActiveWorkbook.Path & "\" & objApp.ActiveWorkbook.Name
        Set objApp = Nothing
    Case 0: MsgBox "Не найдено ни одного процесса."
    Case Else: MsgBox "Найдено более одного процесса."
End Select
Set objCollection = Nothing
Set objWMI = Nothing
End Sub

    For Each Obj In GetObject("winmgmts:\\.\root\cimv2").ExecQuery _
        ("SELECT * FROM Win32_Process WHERE ProcessID=" & pid)
'       ...
'       ...
    Next

Set objWMIService = GetObject("winmgmts:\\.\root\cimv2")
Set colMonitoredEvents = objWMIService.ExecNotificationQuery("SELECT * FROM __InstanceOperationEvent WITHIN 1 WHERE TargetInstance ISA 'Win32_Process'")
Do
    Set objLatestEvent = colMonitoredEvents.NextEvent()
    Set oProc = objLatestEvent.TargetInstance
    With oProc
      ParentPID = .ParentProcessId
      If ParentPID <> 0 Then
         Set oParentProcesses = objWMIService.ExecQuery("SELECT * FROM Win32_Process WHERE ProcessId = '" & ParentPID & "'")
         If Not oParentProcesses Is Nothing Then
            For Each oParentProc In oParentProcesses
              ParentName = oParentProc.Name
            Next
            Set oParentProcesses = Nothing: Set oParentProc = Nothing
         End If
         Set oParentProc = Nothing
      End If
      ProcInfo = vbTab & Now & vbTab & .ProcessId & vbTab & .Name & vbTab & .ParentProcessId & vbTab & ParentName & vbTab & .CommandLine
If InStr(1, ProcInfo, "ttt.mde") <> 0 Then
Debug.Print ProcInfo
Exit Do
End If
      DoEvents
    End With
Loop
Set objWMIService = Nothing
Set colMonitoredEvents = Nothing