If getuidx64 is simply reading, it is benign. However, if the IOCTL handler allows operations to the Token field of the current process:
First, a critical clarification: Unlike GetCurrentProcessId() or OpenProcessToken() , you will not find getuidx64 in Microsoft’s official documentation.
A: Not necessarily, but it is suspicious because it is non-standard. Scan the executable with Windows Defender or Malwarebytes. If the software is from an unknown source, treat it as potentially malicious.
If you are following a specific installation guide, ensure you have also enabled on Windows if the software requires unsigned drivers to function. If you’d like, I can help you with: Steps to disable UAC safely. How to manually enable Test Mode via Command Prompt. Troubleshooting why your UID might be showing as invalid .