Description: API Hook, to achieve the linking of CreateProcess, you can create a monitoring process.
File list (Check if you may need any files):
HookCreateProcess
.................\Bin
.................\HookApp
.................\.......\Debug
.................\.......\HookApp.aps
.................\.......\HookApp.cpp
.................\.......\HookApp.h
.................\.......\HookApp.rc
.................\.......\HookApp.vcproj
.................\.......\HookApp.vcproj.IOBIT-29C9F5678.Kevin.user
.................\.......\HookApp.vcproj.PC-200811291556.Kevin.user
.................\.......\HookAppDlg.cpp
.................\.......\HookAppDlg.h
.................\.......\HookDef.h
.................\.......\ReadMe.txt
.................\.......\Release
.................\.......\res
.................\.......\...\HookApp.manifest
.................\.......\...\HookApp.rc2
.................\.......\Resource.h
.................\.......\stdafx.cpp
.................\.......\stdafx.h
.................\HookCreateProcess
.................\HookCreateProcess.ncb
.................\HookCreateProcess.sln
.................\HookHelp
.................\........\HookHelp.cpp
.................\........\HookHelp.h
.................\SpyDll
.................\......\Debug
.................\......\.....\BuildLog.htm
.................\......\.....\HookHelp.obj
.................\......\.....\mt.dep
.................\......\.....\SpyDll.dll.embed.manifest
.................\......\.....\SpyDll.dll.embed.manifest.res
.................\......\.....\SpyDll.dll.intermediate.manifest
.................\......\.....\SpyDll.exp
.................\......\.....\SpyDll.lib
.................\......\.....\SpyDll.obj
.................\......\.....\SpyDll.pdb
.................\......\.....\vc90.idb
.................\......\.....\vc90.pdb
.................\......\Release
.................\......\.......\BuildLog.htm
.................\......\.......\SpyDll.obj
.................\......\.......\vc90.idb
.................\......\.......\vc90.pdb
.................\......\SpyDll.cpp
.................\......\SpyDll.h
.................\......\SpyDll.vcproj
.................\......\SpyDll.vcproj.IOBIT-29C9F5678.Kevin.user
.................\......\SpyDll.vcproj.PC-200811291556.Kevin.user
.................\UpgradeLog.XML
.................\_UpgradeReport_Files
.................\....................\UpgradeReport.css
.................\....................\UpgradeReport.xslt
.................\....................\UpgradeReport_Minus.gif
.................\....................\UpgradeReport_Plus.gif