We read every piece of feedback, and take your input very seriously.
To see all available qualifiers, see our documentation.
1 parent daca893 commit 34c439cCopy full SHA for 34c439c
1 file changed
main.cpp
@@ -1551,6 +1551,7 @@ UPDATE: This is done now!!
1551
1552
parentPid = entry.th32ParentProcessID; // this gets the pid of the PARENT pid (if there hopefully is one)
1553
parentPids.emplace_back(entry.th32ParentProcessID); // adds above to list
1554
+ ULONGLONG parentTime = GetProcessCreationTime(entry.th32ParentProcessID);
1555
1556
if (parentPid == 0 || parentPid == 4 || parentTime == 0 || parentTime >= creationTime) {
1557
// we can't be sure if the parent actually exists and windows isn't lying to us,
0 commit comments