Yarden Shafir@yarden_shafir·Oct 4, 2022Fun fact: this process creation was not actually done by explorer.exe (no, this is not a bug)9867
namazso@namazso·Oct 4, 2022I assume this was done with the thing where you can pass the parent process in process creation parameters?36
namazso@namazso*PsAttributeParentProcessgithub.comphnt/ntpsapi.h at 0f32b6e51337b0527344e9c280a6bc6e2b333db0 · winsiderss/phntNative API header files for the System Informer project. - phnt/ntpsapi.h at 0f32b6e51337b0527344e9c280a6bc6e2b333db0 · winsiderss/phnt2:58 PM · Oct 4, 20224 Likes2 Bookmarks