Hi,
Is there a proper way to distinguish between object creation to object open on **ObRegisterCallback **(pre operation)?
What I’m actually trying to achieve here is to skip process/threads creations on my pre operation registered callback
Thanks,
Jack