WMI Indicate

See more:

C++

I am working on one project that was not created by me and I am not comfortable with WMI also :(. I will explain my requirement with example:
Suppose I open first instance of Notepad.exe then the time of that Notepad.exe is saved and whatever be my last instance of Notepad.exe that time is saved in my application.

What I do is:

hRes = m_pWbemServices->ExecNotificationQueryAsync(
        _bstr_t("WQL"),
        _bstr_t("SELECT * "
        "FROM __InstanceDeletionEvent WITHIN 1 "
        "WHERE TargetInstance ISA 'Win32_Process'"),
        WBEM_FLAG_SEND_STATUS,
        NULL,
        m_pStubSink);
    hRes = m_pWbemServices->ExecNotificationQueryAsync(
        _bstr_t("WQL"),
        _bstr_t("SELECT * "
        "FROM __InstanceCreationEvent WITHIN 1 "
        "WHERE TargetInstance ISA 'Win32_Process'"),
        WBEM_FLAG_SEND_STATUS,
        NULL,
        m_pStubSink);

I write query for process creation and deletion. When any process is open or closed then at Indicate function get called but how do I know that this process is started or exited?

Is there another way to do this?

If so please explain.