SnapProcHandle := CreateToolhelp32Snapshot(TH32CS_SNAPPROCESS, 0);
Result := (SnapProcHandle <> INVALID_HANDLE_VALUE);
if Result then
  try
    ProcEntry.dwSize := SizeOf(ProcEntry);
    NextProc := Process32First(SnapProcHandle, ProcEntry);
    while NextProc do
    begin
       FileName := ProcessFileNameByPID(ProcEntry.th32ProcessID, True);
       if FileName = '' then FileName := ProcEntry.szExeFile;
      Form1.ListBox1.Items.AddObject(FileName, Pointer(ProcEntry.th32ProcessID));
      NextProc := Process32Next(SnapProcHandle, ProcEntry);
    end;
  finally
    CloseHandle(SnapProcHandle);
  end;

EnumProcesses(@PIDArray, SizeOf(PIDArray), cb);
 ProcCount := cb div SizeOf(DWORD);
 for I := 0 to ProcCount - 1 do
 begin
   hProcess := OpenProcess(PROCESS_QUERY_INFORMATION or PROCESS_VM_READ, False, PIDArray[I]);
   if not (hProcess=0) then
   begin
     EnumProcessModules(hProcess, @hMod, SizeOf(hMod), cb);
     GetModuleFilenameEx(hProcess, hMod, ModuleName, SizeOf(ModuleName));
     Form1.ListBox1.Items.Add(ModuleName);
     CloseHandle(hProcess);
   end;
 end;

type
 TWinStationGetProcessSid = function(hServer: Cardinal;
   ProcessId: Cardinal;
   ProcessStartTime: _FILETIME;
   pProcessUserSid: PByte;
   var dwSidSize: Cardinal): Boolean; stdcall;

var
 _WinStationGetProcessSid: TWinStationGetProcessSid;

function _GetOSVersion: Cardinal;
var
 OSVersionInfo: TOSVersionInfo;
begin
 Result:= 0;
 FillChar(OSVersionInfo, Sizeof(OSVersionInfo), 0);
 OSVersionInfo.dwOSVersionInfoSize:= SizeOf(OSVersionInfo);
 if GetVersionEx(OSVersionInfo) then
 begin
   if OSVersionInfo.dwPlatformId = VER_PLATFORM_WIN32_NT then
   begin
     if OSVersionInfo.dwMajorVersion = 5 then
     begin
       if OSVersionInfo.dwMinorVersion = 0 then
         Result:= 50
       else if OSVersionInfo.dwMinorVersion = 2 then
         Result:= 52
       else if OSVersionInfo.dwMinorVersion = 1 then
         Result:= 51
     end;
     if OSVersionInfo.dwMajorVersion = 6 then
     begin
       if OSVersionInfo.dwMinorVersion = 0 then
         Result:= 60
       else if OSVersionInfo.dwMinorVersion = 1 then
         Result:= 61;
     end;
   end;
 end;
end;

function _EnablePrivilege(Privilege: string): Boolean;
var
 TokenHandle: THandle;
 TokenPrivileges: TTokenPrivileges;
 ReturnLength: Cardinal;
begin
 Result:= False;
 if OpenProcessToken(GetCurrentProcess, TOKEN_ADJUST_PRIVILEGES or TOKEN_QUERY, TokenHandle) then
 begin
   LookupPrivilegeValue(nil, PChar(Privilege), TokenPrivileges.Privileges[0].Luid);
   TokenPrivileges.PrivilegeCount:= 1;
   TokenPrivileges.Privileges[0].Attributes:= SE_PRIVILEGE_ENABLED;
   if AdjustTokenPrivileges(TokenHandle, False, TokenPrivileges, 0, nil, ReturnLength) then
     Result:= True;
 end;
end;

function _GetProcessUserAndDomainName_1(PID: DWORD; var UserName: string; var DomainName: string): Boolean;
type
 TOKEN_USER = record
   User: TSidAndAttributes;
 end;
 PTOKEN_USER = ^TOKEN_USER;
 TTOKEN_USER = TOKEN_USER;
var
 hToken: THandle;
 cbBuf: Cardinal;
 ptiUser: PTOKEN_USER;
 snu: SID_NAME_USE;
 Domain, User: array[0..1024] of Char;
 chUser: DWORD;
 chDomain: DWORD;
 hProcess: THandle;
begin
 Result:= False;
 UserName:= '';
 DomainName:= '';
 chDomain:= 1024;
 chUser:= 1024;
 hProcess:= OpenProcess(MAXIMUM_ALLOWED, False, PID);
 if hProcess <> 0 then
 begin
   if OpenProcessToken(hProcess, MAXIMUM_ALLOWED, hToken) then
   begin
     try
       GetTokenInformation(hToken, TokenUser, nil, 0, cbBuf);
       GetMem(ptiUser, cbBuf);
       if GetTokenInformation(hToken, TokenUser, ptiUser, cbBuf, cbBuf) then
       begin
         if LookupAccountSid(nil, ptiUser.User.Sid, User, chUser, Domain, chDomain, snu) then
         begin
           UserName:= User;
           DomainName:= Domain;
         end;
       end;
       FreeMem(ptiUser);
     finally
       CloseHandle(hToken);
     end;
   end;
 end;
end;

function _GetProcessUserAndDomainName_2(PID: DWORD; var UserName: string; var DomainName: string): Boolean;
var
 hProcess: THandle;
 lpCreationTime, lpExitTime, lpKernelTime, lpUserTime: _FILETIME;
 pProcessUserSid: Pointer;
 User, Domain: PChar;
 cbUser, cbDomain: Cardinal;
 dwSidSize: Cardinal;
 CreateTime: TSystemTime;
begin
 Result:= False;
 UserName:= '';
 DomainName:= '';
 if _GetOSVersion >= 60 then
   hProcess:= OpenProcess($1000, False, PID)
 else
   hProcess:= OpenProcess(MAXIMUM_ALLOWED, False, PID);
 if hProcess <> 0 then
 begin
   try
     dwSidSize:= 0;
     GetProcessTimes(hProcess, lpCreationTime, lpExitTime, lpKernelTime, lpUserTime);
     FileTimeToSystemTime(lpCreationTime, CreateTime);
     _WinStationGetProcessSid(0, PID, lpCreationTime, nil, dwSidSize);
     GetMem(pProcessUserSid, dwSidSize);
     if _WinStationGetProcessSid(0, PID, lpCreationTime, pProcessUserSid, dwSidSize) then
     begin
       cbUser:= 0;
       cbDomain:= 0;
       LookupAccountSid(nil, pProcessUserSid, nil, cbUser, nil, cbDomain, dwSidSize);
       GetMem(User, cbUser);
       GetMem(Domain, cbDomain);
       Result:= LookupAccountSid(nil, pProcessUserSid, User, cbUser, Domain, cbDomain, dwSidSize);
       SetLength(UserName, cbUser);
       SetLength(DomainName, cbDomain);
       lstrcpy(PChar(UserName), User);
       lstrcpy(PChar(DomainName), Domain);
       FreeMem(User);
       FreeMem(Domain);
     end;
     FreeMem(pProcessUserSid);
   finally
     CloseHandle(hProcess);
   end;
 end;
end;

function _GetProcessUserAndDomainName(PID: DWORD; var UserName: string; var DomainName: string): Boolean;
begin
 if _GetOSVersion > 50 then
   Result:= _GetProcessUserAndDomainName_2(PID, UserName, DomainName)
 else
   Result:= _GetProcessUserAndDomainName_1(PID, UserName, DomainName); //Windows 20000
end;

procedure TForm1.FormCreate(Sender: TObject);
begin
 _EnablePrivilege('SeDebugPrivilege');
 if _GetOSVersion > 50 then
   @_WinStationGetProcessSid:= GetProcAddress(LoadLibrary('winsta.dll'), 'WinStationGetProcessSid');
end;

procedure TForm1.Button1Click(Sender: TObject);
var
 User, Domain: String;
begin
 _GetProcessUserAndDomainName(1156, User, Domain);
 ShowMessage(Domain + '\' + User);
end;