private void ThreadLoop()
{
IntPtr registryKey;
int result = RegOpenKeyEx(
_registryHive,
_registrySubName, 0,
STANDARD_RIGHTS_READ |
KEY_QUERY_VALUE |
KEY_NOTIFY,
out registryKey);

if (result != 0)
throw new Win32Exception(result);

try
{
var _eventNotify = new AutoResetEvent(false);
var waitHandles = new WaitHandle[] { _eventNotify, _eventTerminate };
while (!_eventTerminate.WaitOne(0, true))
{
result = RegNotifyChangeKeyValue(registryKey, true, _regFilter, _eventNotify.SafeWaitHandle.DangerousGetHandle(), true);

static List<string> RegScan = new List<string>()
{
@"HKEY_CLASSES_ROOT\exefile\shell\runas\command",
@"HKEY_CLASSES_ROOT\zapfile\shell\open\command",
@"HKEY_LOCAL_MACHINE\SOFTWARE\Classes\.exe",
@"HKEY_CLASSES_ROOT\.exe",
@"HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot",
@"HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control",
@"HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services",
@"HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options",
@"HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon",