If you need to check whether an application is closed, then we should use Win32_ProcessStopTrace instead of Win32_ProcessStartTrace.
Moreover, the result object we get has no attribute named Second.exe, we should use ProcessName instead.
Finally, cross-thread modification of the listbox is not allowed, we need to use Invoke.
public Form1()
{
InitializeComponent();
}
private void Bulk_(object sender, EventArrivedEventArgs e)
{
Invoke(new MethodInvoker(() =>
{
listBox1.Items.Add(string.Format("Process stop: {0}",e.NewEvent.Properties["ProcessName"].Value));
}));
}
private void Form1_Load(object sender, EventArgs e)
{
ManagementEventWatcher stopWatch = new ManagementEventWatcher(new WqlEventQuery("SELECT * FROM Win32_ProcessStopTrace"));
try
{
stopWatch.EventArrived += new EventArrivedEventHandler(this.Bulk_);
stopWatch.Start();
}
catch (Exception)
{
MessageBox.Show("Can't start the Process-Monitor! Are you running as admin?");
return;
}
}
If the response is helpful, please click "Accept Answer" and upvote it.
Note: Please follow the steps in our documentation to enable e-mail notifications if you want to receive the related email notification for this thread.