Hi,

I am trying to capture system events and based on process Id , I need to know which file for e.g notepad or ms-word was opened.

If for example i open a notepad file , I need to know the absolute path for the notepad file opened.

Is this possible in Win32_Process ??