$FilterList = '\windows\','iexplore.exe'
$objWMIService = GetObject("winmgmts:{impersonationLevel=impersonate}!\\.\root\cimv2")
$colMonitored = $objWMIService.ExecNotificationQuery("select * from __instancecreationevent within 1 where TargetInstance isa 'Win32_Process'")
While 1
$NextProcess = $colMonitored.NextEvent
$Filtered = 0
$Name = $NextProcess.TargetInstance.Name
$Path = $NextProcess.TargetInstance.executablepath
$User = $NextProcess.TargetInstance.ExecMethod_("GetOwner").User
If not $user = 'SYSTEM' and not instr($user,'SERVICE')
For each $Filter in $filterList
if instr($Path,$filter)
$Filtered = 1
EndIf
Next
If not $Filtered
$OldDate1 = ReadProfileString('%windir%\ProcList.ini',$Path,'Date')
if not @oldDate1 = @date ; Only log once per day and keep the last 3 usages
$oldTime1 = ReadProfileString('%windir%\ProcList.ini',$Path,'Time')
$oldDate2 = ReadProfileString('%windir%\ProcList.ini',$Path,'oldDate1')
$oldTime2 = ReadProfileString('%windir%\ProcList.ini',$Path,'oldTime1')
$nul = WriteProfileString('%windir%\ProcList.ini',$Path,'Name',$Name)
$nul = WriteProfileString('%windir%\ProcList.ini',$Path,'User',$User)
$nul = WriteProfileString('%windir%\ProcList.ini',$Path,'Date',@date)
$nul = WriteProfileString('%windir%\ProcList.ini',$Path,'Time',@time)
$nul = WriteProfileString('%windir%\ProcList.ini',$Path,'oldDate1',$OldDate1)
$nul = WriteProfileString('%windir%\ProcList.ini',$Path,'oldTime1',$oldTime1)
$nul = WriteProfileString('%windir%\ProcList.ini',$Path,'oldDate2',$OldDate2)
$nul = WriteProfileString('%windir%\ProcList.ini',$Path,'oldTime2',$oldTime2)
endif
EndIf
EndIf
Loop