I don't think ANY file is modifed when an app is executed (else how would you run apps from read-only media or LiveCDs?). You need to install a filter like Antiviruses do. Don't remember if the opensource ClamAntivirus has such a filter (online/realtime/on-demand scanning), can check it out and if so see its sourcecode. The easiest way could be to plug into Windows Shell to get such notifications, but that won't cover all scenarios (execute from batch file etc.). Anyway to monitor the FileSystem, checkout FileMon from SysInternals (http://www.sysinternals.com), now a part of Microsoft. Also RegMon from them to monitor the registry (you have more chance to see some registry access there to keys MS uses to accelerate application startup - similar goes to some special folders MS uses for that)
