using System.Linq;
using System.Text;
using System.Threading.Tasks;
using System.Management;

namespace ConsoleApp1
{
internal class Program
{
private static void Main(string[] args)
{
System.IO.File.Delete("D:\\1.txt");
System.IO.File.AppendAllText("D:\\1.txt", "1\n");
var query = new WqlEventQuery("SELECT * FROM Win32_ProcessStartTrace");

var watcher = new ManagementEventWatcher() { Query = query };

watcher.EventArrived += WatcherOnEventArrived;
watcher.Start();

Console.WriteLine("Watching...");
Console.ReadLine();

watcher.EventArrived -= WatcherOnEventArrived;
watcher.Stop();
}

private static void WatcherOnEventArrived(object sender, EventArrivedEventArgs e)
{
var processName = e.NewEvent.Properties["ProcessName"].Value.ToString();
Console.WriteLine($"This is {processName}.");
string str = $"{processName}";
System.IO.File.AppendAllText("D:\\1.txt", str.ToLower());

}
}
}