Another AWF member who prefers to remain anonymous was kind enough to forward ******** original example which I just tried.
The splash screen opened in the Access form but PowerShell itself then opened as an external app with its own taskbar icon.
This is also what I saw with various other apps using Jason's modified version
Is that what happens for others as well? If so, I fail to see the point of doing this other than as a coding challenge - nothing wrong with that of course!
Jason's screenshot clearly shows his scanner app opening in an Access form but so far I haven't experienced this outcome with any app I tested.
P.S. Glad to see Jason corrected that spelling though it will be hard to forget his original typo.
Why would anyone wish to stay anonymous?
Anyway....
Some apps will not work if trying to identify them via PID and this is why hence my original code suggesting an approach for some fall-back alternatives. AI suggest this is why……
1. They’re Not Running as Independent Processes
• Some files are launchers, helpers, or stubs that immediately hand off execution to another process and exit.
• Example: A bootstrapper might start a service or spawn a child process, then terminate — leaving no persistent PID tied to the original file.
2. They’re Hosted Inside Another Process
• Certain files are injected or hosted inside a parent process (e.g., via , COM hosting, or DLL injection).
• In these cases, the code runs inside another process’s memory space, so the PID you’re looking for belongs to the host — not the itself.
3. They’re Run as Services or Scheduled Tasks
• If an is launched by the Service Control Manager or Task Scheduler, its PID might be harder to associate directly unless you query those subsystems.
• Services often run under, and scheduled tasks may spawn briefly and disappear, making PID tracking tricky.
4. They’re Hidden by Anti-Debugging or Security Techniques
• Malware, DRM-protected apps, or hardened enterprise software may use process hollowing, PID spoofing, or handle obfuscation to hide their true identity.
• These techniques can make the appear invisible or mislead tools like Task Manager or.
5. They’re Already Terminated
• If you're scanning for a PID after the has launched and exited, it simply won’t be present.
• Some apps launch, do their job in milliseconds, and vanish — especially CLI utilities or background updaters.
6. They’re Run in a Virtualized or Containerized Environment
• Tools like App-V, Citrix, or sandboxing platforms may abstract the process away from the host OS.
• You might see a generic container PID, not the actual PID.
Hope this helps..
