监视是否有新程序运行

@echo off &setlocal EnableDelayedExpansion
::测试方法:
::当窗口显示  开始延时20秒............  的时候,运行一个新的程序...
::cmd结束后,查看运行纪录.txt可以看到新程序的路径.

set "var=wmic process get Caption^,ExecutablePath"
echo %date%>运行纪录.txt
echo %time%>>运行纪录.txt
echo.>>运行纪录.txt
cd.>样本.txt
for /f "skip=3 tokens=2* delims= " %%i in ('%var%') do (
  call :lis %%i %%j
  echo !num!>>样本.txt
  )
  echo 开始延时20秒............
  ping 127.1 -n 20 >nul 2>nul
  for /f "delims=" %%a in ('type 样本.txt') do (
  set num=%%a
  set num=!num: =!
  set !num!=a
  )
::检测，比对
  for /f "skip=3 tokens=2* delims= " %%a in ('%var%') do (
  call :lis %%a %%b
  set num=!num: =!
  if not defined !num! echo %%a %%b>>运行纪录.txt
  )
exit
:lis
set num=%1 %2
:loop
if "!num:~-1!"==" " set num=!num:~0,-1!&goto loop
goto :eof