عمل مراقبة للPROCESS او HOOK

using System.Management;

ManagementEventWatcher watch = new ManagementEventWatcher(new WqlEventQuery("SELECT * FROM Win32_ProcessStartTrace"));

private void Form1_Load(object sender, EventArgs e)
{
CheckForIllegalCrossThreadCalls = false;
watch.EventArrived += new EventArrivedEventHandler(start);
watch.Start();
}

void stop(object sender, EventArrivedEventArgs e)
{
Console.WriteLine("Process stopped: {0}", e.NewEvent.Properties["ProcessName"].Value);
}

void start(object sender, EventArrivedEventArgs e)
{
textBox1.Text= e.NewEvent.Properties["ProcessName"].Value.ToString();
}

private void Form1_FormClosing(object sender, FormClosingEventArgs e)
{
watch.Stop();
}