Traps process deletion events and calculates time processes ran. It runs on all versions of Windows that support WMI. Press Ctrl+C to end script.

Visual Basic
Edit|Remove
strComputer = "."
Set objWMIService = GetObject("winmgmts:\\" & strComputer & "\root\cimv2")
Set colMonitorProcess = objWMIService.ExecNotificationQuery _
 ("SELECT * FROM __InstanceDeletionEvent " _ 
 & " WITHIN 1 WHERE TargetInstance ISA 'Win32_Process'")
WScript.Echo "Waiting for process to stop ..."
Do
  Set objLatestEvent = colMonitorProcess.NextEvent
  Wscript.Echo vbCrLf & "Process Name: " & objLatestEvent.TargetInstance.Name
  Wscript.Echo "Process ID: " & objLatestEvent.TargetInstance.ProcessId
  strDateTime = WMIDateToString(objLatestEvent.TargetInstance.CreationDate)
  Wscript.Echo "Time created: " & strDateTime
  WScript.Echo "Time deleted: " & Now
  intSeconds = DateDiff("s", strDateTime, Now)
  WScript.Echo "Duration: " & intSeconds & " seconds"
Loop

Function WMIDateToString(dtmDate)

WMIDateToString = CDate(Mid(dtmDate, 5, 2) & "/" & _
                  Mid(dtmDate, 7, 2) & "/" & _
                  Left(dtmDate, 4) & " " & _
                  Mid(dtmDate, 9, 2) & ":" & _
                  Mid(dtmDate, 11, 2) & ":" & _
                  Mid(dtmDate, 13, 2))

End Function