The GetMappedFileName function checks if the specified address is within a memory-mapped file in the address space of the specified process. If so, the function returns the name of the memory-mapped file.
DWORD GetMappedFileName(
HANDLE hProcess, // handle to the process
LPVOID lpv, // the address to verify
LPTSTR lpFilename, // buffer that receives the filename
DWORD nSize // size of the buffer
);
If the function succeeds, the return value specifies the length of the string copied to the buffer.
If the function fails, the return value is zero. To get extended error information, call GetLastError.
Process Status Helper Overview, PSAPI Functions, EnumProcesses