3 ms·It's not even bad. It's neglecting any kind of "has this process ever touched win32k.sys" test.by quotemstr 9y agoIt's not even bad. It's neglecting any kind of "has this process ever touched win32k.sys" test.