Oops, sorry, I didnt notice you posted. The trick is quite simple. You must attach Process Explorer to TaskMgr as Debugger, so when taskmgr is launched, instead of running procexp will be launch with taskmgr parameter. How to do it? HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\taskmgr.exe Create REG_SZ value Debugger with data, that will point to process explorer exe file. So for example c:\ExePath\process-monitor.exe in my case. This is the most complex method for replacing programs, you can do the same with notepad or iexplore...