using System; using System.Collections.Generic; using System.Linq; using System.Management; using System.Text; using System.Threading.Tasks; namespace _Exe { class Process { _Exe.Form1 Formed; public Process(Form1 Formed) { this.Formed = Formed; } public void Main() { ManagementEventWatcher startWatch = new ManagementEventWatcher( new WqlEventQuery("SELECT * FROM Win32_ProcessStartTrace")); startWatch.EventArrived += new EventArrivedEventHandler(Formed.startWatch_EventArrived); startWatch.Start(); ManagementEventWatcher stopWatch = new ManagementEventWatcher( new WqlEventQuery("SELECT * FROM Win32_ProcessStopTrace")); stopWatch.EventArrived += new EventArrivedEventHandler(Formed.stopWatch_EventArrived); stopWatch.Start(); Console.WriteLine("Press any key to exit"); while (!Console.KeyAvailable) System.Threading.Thread.Sleep(50); startWatch.Stop(); stopWatch.Stop(); } } } ====================================== using System; using System.Collections.Generic; using System.ComponentModel; using System.Data; using System.Drawing; using System.Linq; using System.Management; using System.Text; using System.Threading.Tasks; using System.Windows.Forms; namespace _Exe { public partial class Form1 : Form { public Form1() { InitializeComponent(); } private void Form1_Load(object sender, EventArgs e) { } public void stopWatch_EventArrived(object sender, EventArrivedEventArgs e) { Console.WriteLine("Process stopped: {0}", e.NewEvent.Properties["ProcessName"].Value); } public void startWatch_EventArrived(object sender, EventArrivedEventArgs e) { Console.WriteLine("Process started: {0}", e.NewEvent.Properties["ProcessName"].Value); } } }