diff --git a/src/detection/swap/swap_windows.c b/src/detection/swap/swap_windows.c
index ad4965836..1bbb8098c 100644
--- a/src/detection/swap/swap_windows.c
+++ b/src/detection/swap/swap_windows.c
@@ -5,8 +5,9 @@
 #include <winternl.h>
 #include <ntstatus.h>
 #include <windows.h>
+#include <psapi.h>
 
-const char* ffDetectSwap(FFlist* result)
+const char* detectByNqsi(FFlist* result)
 {
     uint8_t buffer[4096];
     ULONG size = sizeof(buffer);
@@ -26,6 +27,27 @@ const char* ffDetectSwap(FFlist* result)
         if (current->NextEntryOffset == 0)
             break;
     }
+    return NULL;
+}
+
+const char* detectByKgpi(FFlist* result)
+{
+    PERFORMANCE_INFORMATION pi = {};
+    if (!K32GetPerformanceInfo(&pi, sizeof(pi)))
+        return "K32GetPerformanceInfo(&pi, sizeof(pi)) failed";
+    FFSwapResult* swap = ffListAdd(result);
+    ffStrbufInitS(&swap->name, "Page File");
+    swap->bytesTotal = (uint64_t) (pi.CommitLimit > pi.PhysicalTotal ? pi.CommitLimit - pi.PhysicalTotal : 0) * pi.PageSize;
+    swap->bytesUsed = (uint64_t) (pi.CommitTotal > pi.PhysicalTotal ? pi.CommitTotal - pi.PhysicalTotal : 0) * pi.PageSize;
 
     return NULL;
 }
+
+const char* ffDetectSwap(FFlist* result)
+{
+    const char* err = detectByNqsi(result);
+    if (err == NULL)
+        return NULL;
+
+    return detectByKgpi(result);
+}