Add real parent detection using fake ppid an ID 10 can tell us when a process has a fake parent, using createprocess API https://twitter.com/SBousseaden/status/1241467646526345221 This one is diferent than mine. (ID 8 Thread ID + ID 10 )
Add real parent detection using fake ppid
an ID 10 can tell us when a process has a fake parent, using createprocess API
https://twitter.com/SBousseaden/status/1241467646526345221
This one is diferent than mine. (ID 8 Thread ID + ID 10 )