content: I didn't read their blog but I did read the post.   "The thing is, after registering a notification routine for loaded PE images with the kernel, the callback may receive invalid image names. After digging into the matter, what started as a seemingly random issue proved to originate from a coding error in the Windows kernel itself."  And   Essentially, malware can use the above API to trick the OS into giving malware scanners other files – such as benign executables – to inspect rather than their own malicious code.  But this callback, without reading the documentation and just using the article, is only returning executables running in memory. Antivirus can scan files not running in memory. It seems reading this short article that at best it can prevent an antivirus from identifying the process by name in memory. If it can even properly spoof the name. I swear I had seen this somewhere else and the article just said that they were sometimes getting back garbage so it wouldn't even necessarily be a valid target for scanning.  Maybe the blog has more information but this sounds pretty benign from this article.