Regedit Query kısmında hata

 private void BackgroundWorker_DoWork(object? sender, DoWorkEventArgs e)
        {
            string scopePath = @"\\.\root\\Microsoft\\Windows\\Registry";
            string queryText = "SELECT * FROM RegistryValueChangeEvent WHERE Hive = 'HKEY_LOCAL_MACHINE' AND KeyPath = '\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Policies\\System'";
            WqlEventQuery query = new WqlEventQuery(queryText);

            using (ManagementEventWatcher watcher = new ManagementEventWatcher(new ManagementScope(scopePath), query))
            {
                watcher.EventArrived += RegistryValueChangedEventArrived;
                watcher.Start();

            }
        }

        private void BackgroundWorker_DoWork(object? sender, DoWorkEventArgs e)
        {
            string scopePath = @"\\.\root\\\\Microsoft\\\\Windows\\\\Registry";
            string queryText = "SELECT * FROM RegistryValueChangeEvent WHERE Hive = 'HKEY_LOCAL_MACHINE' AND KeyPath = '\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Policies\\System'";
            WqlEventQuery query = new WqlEventQuery(queryText);

            using (ManagementEventWatcher watcher = new ManagementEventWatcher(new ManagementScope(scopePath), query))
            {
                watcher.EventArrived += RegistryValueChangedEventArrived;
                watcher.Start();

            }
        }

   private void BackgroundWorker_DoWork(object? sender, DoWorkEventArgs e)
        {
            try
            {
                string scopePath = @"\\.\root\\\\Microsoft\\\\Windows\\\\Registry";
                string queryText = "SELECT * FROM RegistryValueChangeEvent WHERE Hive = 'HKEY_LOCAL_MACHINE' AND KeyPath = '\\\\SOFTWARE\\\\Microsoft\\\\Windows\\\\CurrentVersion\\\\Policies\\\\System'\r\n";
                WqlEventQuery query = new WqlEventQuery(queryText);

                using (ManagementEventWatcher watcher = new ManagementEventWatcher(new ManagementScope(scopePath), query))
                {
                    watcher.EventArrived += RegistryValueChangedEventArrived;
                    watcher.Start();

                }
            }
            catch (ManagementException ex)
            {
                // Log or display the exception message for troubleshooting
                Console.WriteLine("ManagementException: " + ex.Message);
            }
        }

 private void BackgroundWorker_DoWork(object? sender, DoWorkEventArgs e)
        {
            try
            {
                string scopePath = @"\\.\root\\\\Microsoft\\\\Windows\\\\Registry";
                string queryText = "SELECT * FROM RegistryValueChangeEvent WHERE Hive = 'HKEY_LOCAL_MACHINE' AND KeyPath = '\\\\SOFTWARE\\\\Microsoft\\\\Windows\\\\CurrentVersion\\\\Policies\\\\System'\r\n";
                WqlEventQuery query = new WqlEventQuery(queryText);

                using (ManagementEventWatcher watcher = new ManagementEventWatcher(new ManagementScope(scopePath), query))
                {
                    watcher.EventArrived += RegistryValueChangedEventArrived;
                    watcher.Start();

                }
            }
            catch (ManagementException ex)
            {
                // Log or display the exception message for troubleshooting
                Console.WriteLine("ManagementException: " + ex.Message);
            }
        }

        private void RegistryValueChangedEventArrived(object sender, EventArrivedEventArgs e)
        {
            // Get the name of the process that made the registry value change
            var processNameProperty = e.NewEvent.Properties["ProcessName"];
            string processName = processNameProperty?.Value?.ToString() ?? string.Empty;

            // Check if the process executed the "reg add" command
            if (string.Equals(processName, "reg", StringComparison.OrdinalIgnoreCase))
            {
                // Show a message indicating the process that made the registry value change
                MessageBox.Show($"The process '{processName}' made changes to the registry value: DisableTaskMgr");
                // Perform any desired actions here
            }
        }

 private void button20_Click(object sender, EventArgs e)
        {
            BackgroundWorker worker = new BackgroundWorker();
            worker.DoWork += BackgroundWorker_DoWork;

            worker.RunWorkerAsync();
        }

using System;
using System.ComponentModel;
using System.Diagnostics;
using System.Linq;
using System.Threading;
using System.Windows.Forms;
using Microsoft.Win32;

namespace Heuristics
{
    public partial class Form1 : Form
    {
        private bool previousValue;
        private string modifyingProcessName = string.Empty; // modifyingProcessName için varsayılan değer ataması

        public Form1()
        {
            InitializeComponent();
        }

        private void button1_Click(object sender, EventArgs e)
        {
            // Başlat düğmesine tıklandığında izlemeyi başlat
            previousValue = IsTaskManagerDisabled();
            System.Windows.Forms.Timer timer = new System.Windows.Forms.Timer();
            timer.Interval = 0001;
            timer.Tick += CheckTaskManagerStatus;
            timer.Start();
        }

        private void CheckTaskManagerStatus(object sender, EventArgs e)
        {
            bool currentValue = IsTaskManagerDisabled();

            if (currentValue != previousValue)
            {
                previousValue = currentValue;

                if (currentValue)
                {
                    // DisableTaskMgr değeri değişti ve etkilenen uygulamanın adını bul
                    FindModifyingProcess();
                    MessageBox.Show($"DisableTaskMgr değeri değişti! Değiştiren uygulama: {modifyingProcessName}");
                }
            }
        }

        private bool IsTaskManagerDisabled()
        {
            using (RegistryKey key = Registry.CurrentUser.OpenSubKey(@"Software\Microsoft\Windows\CurrentVersion\Policies\System"))
            {
                if (key != null)
                {
                    int value = (int)key.GetValue("DisableTaskMgr", 0);
                    return value == 1;
                }
            }

            return false;
        }

        private void FindModifyingProcess()
        {
            Process[] processes = Process.GetProcesses();

            foreach (Process process in processes)
            {
                try
                {
                    string processPath = string.Empty;
                    try
                    {
                        processPath = process.MainModule?.FileName;
                    }
                    catch (Win32Exception)
                    {
                        // Erişim reddedildiğinde veya işlem sonlandırıldığında hata alınabilir
                        // Hatanın gösterilmesini engellemek için devam et
                        continue;
                    }
                    catch (InvalidOperationException)
                    {
                        // İşlem sonlandırıldığında hata alınabilir
                        // Hatanın gösterilmesini engellemek için devam et
                        continue;
                    }

                    if (processPath != null && processPath.EndsWith("regedit.exe"))
                    {
                        // regedit.exe'yi çalıştıran uygulamanın adını bul
                        modifyingProcessName = process.ProcessName;
                        break;
                    }
                }
                catch (Win32Exception)
                {
                    // Erişim reddedildiğinde veya işlem sonlandırıldığında hata alınabilir
                    // Hatanın gösterilmesini engellemek için devam et
                    continue;
                }
                catch (InvalidOperationException)
                {
                    // İşlem sonlandırıldığında hata alınabilir
                    // Hatanın gösterilmesini engellemek için devam et
                    continue;
                }
            }
        }
    }
}