I'm using a System.Management.ManagementEventWatcher to get the process ID and executable path for a started process:
private void startWatcher_EventArrived(Object sender, EventArrivedEventArgs e)
{
String processID = e.NewEvent.Properties["ProcessID"].Value.ToString();
var searcher = new ManagementObjectSearcher(new WqlObjectQuery(String.Format("Select ExecutablePath from Win32_Process where ProcessID = {0}", processID)));
ManagementObject managementObject = null;
foreach (ManagementObject obj in searcher.Get())
{
managementObject = obj;
break;
}
Console.WriteLine(managementObject["ExecutablePath"]);
}
Using this WQL Query:
Select ExecutablePath from Win32_ProcessStartTrace
Is there a way that I can avoid doing the object search, but still get the ExecutionPath, using what is already available in the EventArrivedEventArgs object?
All I really need is the ProcessID and the ExecuatblePath for each new process that starts up. Is this the simplest way to get that?