Private Class PROCESSINFO
        Public Caption As String
        Public CommandLine As String
        Public CreationDate As String
        Public Description As String
        Public ExecutablePath As String
        Public Handle As String
        Public Name As String
        Public ParentProcessId As String
        Public ProcessId As String
    End Class
 
    Private Class ProcessWatcher
 
        Private ProcessCreateWatcher As ManagementEventWatcher = Nothing
        Public Event ProcessCreated(ByVal e As PROCESSINFO)
 
        Public Sub New()
            ' DoSomething
        End Sub
 
        Public Sub StartStop(ByVal start As Boolean)
            If start Then
                If Nothing Is ProcessCreateWatcher Then
                    Try
                        Dim q As WqlEventQuery
                        q = New WqlEventQuery("__InstanceCreationEvent", New _
                          TimeSpan(0, 0, 1), "TargetInstance ISA" & _
                          "'Win32_Process'")
                        ProcessCreateWatcher = New ManagementEventWatcher(q)
                        AddHandler ProcessCreateWatcher.EventArrived, AddressOf _
                          onProcessCreation
                        ProcessCreateWatcher.Start()
                        q = Nothing
                    Catch ex As Exception
                        Debug.WriteLine(ex.Message & ControlChars.CrLf & _
                          ex.StackTrace)
                    End Try
                End If
            Else
                If Not Nothing Is ProcessCreateWatcher Then
                    RemoveHandler ProcessCreateWatcher.EventArrived, AddressOf _
                      onProcessCreation
                    ProcessCreateWatcher.Stop()
                    ProcessCreateWatcher = Nothing
                End If
            End If
        End Sub
 
        Private Sub onProcessCreation(ByVal sender As Object, ByVal e As _
          EventArrivedEventArgs)
            Dim info As PROCESSINFO
            Try
                For Each p As PropertyData In e.NewEvent.Properties
                    If Not Nothing Is p.Value Then
                        If p.Value.GetType.ToString = _
                          "System.Management.ManagementBaseObject" Then
                            info = fillProcessInfo(CType(p.Value, _
                            ManagementBaseObject))
                        End If
                    End If
                Next
            Catch ex As Exception
                Debug.WriteLine(ex.Message & ControlChars.CrLf & ex.StackTrace)
            End Try
            If Not Nothing Is info.ProcessId Then
                RaiseEvent ProcessCreated(info)
            End If
        End Sub
 
        Private Function fillProcessInfo(ByVal mbo As ManagementBaseObject) As _
          PROCESSINFO
            Try
                Dim info As New PROCESSINFO
                If Not Nothing Is mbo Then
                    info.Caption = mbo("Caption").ToString
                    info.CommandLine = mbo("CommandLine").ToString
                    info.CreationDate = mbo("CreationDate").ToString
                    info.Description = mbo("Description").ToString
                    info.ExecutablePath = mbo("ExecutablePath").ToString
                    info.Handle = mbo("Handle").ToString
                    info.Name = mbo("Name").ToString
                    info.ParentProcessId = mbo("ParentProcessId").ToString
                    info.ExecutablePath = mbo("ExecutablePath").ToString
                    info.ProcessId = mbo("ProcessId").ToString
                    Return info
                End If
            Catch ex As Exception
                Debug.WriteLine(ex.Message & ex.StackTrace)
                Throw ex
            End Try
        End Function
 
    End Class
 
    Dim WithEvents p As ProcessWatcher
 
    Private Sub Form1_Load(ByVal sender As System.Object, ByVal e As _
      System.EventArgs) Handles MyBase.Load
        p = New ProcessWatcher
        p.StartStop(True)
    End Sub
 
    Private Sub p_ProcessCreated(ByVal e As PROCESSINFO) Handles _
      p.ProcessCreated
        MsgBox(e.ParentProcessId)
    End Sub