Can I get the ExecutablePath from a System.Management.EventArrivedEventArgs object?

I'm using a System.Management.ManagementEventWatcher to get the process ID and executable path for a started process:

private void startWatcher_EventArrived(Object sender, EventArrived开发者_JS百科EventArgs e)
{
    String processID = e.NewEvent.Properties["ProcessID"].Value.ToString();

    var searcher = new ManagementObjectSearcher(new WqlObjectQuery(String.Format("Select ExecutablePath from Win32_Process where ProcessID = {0}", processID)));

    ManagementObject managementObject = null;
    foreach (ManagementObject obj in searcher.Get())
    {
        managementObject = obj;
        break;
    }

    Console.WriteLine(managementObject["ExecutablePath"]);
}

Using this WQL Query:

Select ExecutablePath from Win32_ProcessStartTrace

Is there a way that I can avoid doing the object search, but still get the ExecutionPath, using what is already available in the EventArrivedEventArgs object?

All I really need is the ProcessID and the ExecuatblePath for each new process that starts up. Is this the simplest way to get that?

No, what you got is as good as it gets. The available properties are listed here...

I believe this article can help you: Using WMI to monitor process creation, deletion and modification in .NET