if you use PsSetCreateProcessNotifyRoutineEx be aware that on the callback CreateProcessNotifyEx MSDN says: Process notifications are not sent for processes that are cloned