Remove duplicate IsSubsystemProcess query
@@ -132,6 +132,7 @@ PPH_MODULE_PROVIDER PhCreateModuleProvider(
{
PhSetReference(&moduleProvider->ProcessFileName, processItem->FileName);
PhSetReference(&moduleProvider->PackageFullName, processItem->PackageFullName);
+ moduleProvider->IsSubsystemProcess = !!processItem->IsSubsystemProcess;
PhDereferenceObject(processItem);
}
@@ -145,16 +146,7 @@ PPH_MODULE_PROVIDER PhCreateModuleProvider(
}
}
- if (WindowsVersion >= WINDOWS_10 && moduleProvider->ProcessHandle)
- {
- PROCESS_EXTENDED_BASIC_INFORMATION basicInfo;
-
- if (NT_SUCCESS(PhGetProcessExtendedBasicInformation(moduleProvider->ProcessHandle, &basicInfo)))
- {
- moduleProvider->IsSubsystemProcess = !!basicInfo.IsSubsystemProcess;
- }
-
- if (WindowsVersion >= WINDOWS_10_20H1)
+ if (WindowsVersion >= WINDOWS_10_20H1 && moduleProvider->ProcessHandle)
{
if (moduleProvider->ProcessId == SYSTEM_PROCESS_ID)
{
@@ -178,7 +170,6 @@ PPH_MODULE_PROVIDER PhCreateModuleProvider(
}
}
}
- }
switch (PhCsImageCoherencyScanLevel)
{
