$dir = "D:\temp"
if (-not (Test-Path $dir)) {
New-Item -ItemType Directory -Path $dir -Force | Out-Null
}
$file = Join-Path $dir ("Process_Audit_" + (Get-Date -Format "yyyyMMdd_HHmmss") + ".csv")
$properties = @(
"ProcessId",
"ParentProcessId",
"Name",
@{Name="ExecutablePath"; Expression={$_.ExecutablePath}},
@{Name="CommandLine"; Expression={$_.CommandLine}},
@{Name="Company"; Expression={if ($_.ExecutablePath -and (Test-Path $_.ExecutablePath)) { (Get-Item $_.ExecutablePath).VersionInfo.CompanyName } else { "N/A" }}},
@{Name="WorkingSet_MB"; Expression={[math]::Round($_.WorkingSetSize / 1MB, 2)}},
@{Name="CreationDate"; Expression={$_.ConvertToDateTime($_.CreationDate)}}
)
Get-CimInstance Win32_Process | Select-Object -Property $properties | Export-Csv -Path $file -NoTypeInformation -Encoding UTF8
Write-Host "Exported to: $file" -ForegroundColor Green
