Min versionXPXP SP22003/XP642003/XP64 SP1VistaVista SP1Vista SP2Vista SP27 SP17 SP18 Pre RTM8 Pre RTM88.1 Update 18.18.1 Update 18.1 Update 110 Pre RTM10 Pre RTM1010 TH2
Max versionXP SP1XP SP32003/XP64 SP2Vista SP288.1 Update 1
Architecturex86x86x86x86x64x86x86x64x86x64x86x64x86x86x64x86x64x86x64x86x64x86x64x64x64x86x64x64
x86 offset
offset:bitpos
Field Namex64 offset
offset:bitpos
0x0000struct _KPROCESS
Pcb
struct _KPROCESS
Pcb
struct _KPROCESS
Pcb
struct _KPROCESS
Pcb
struct _KPROCESS
Pcb
struct _KPROCESS
Pcb
struct _KPROCESS
Pcb
struct _KPROCESS
Pcb
struct _KPROCESS
Pcb
struct _KPROCESS
Pcb
struct _KPROCESS
Pcb
struct _KPROCESS
Pcb
struct _KPROCESS
Pcb
struct _KPROCESS
Pcb
struct _KPROCESS
Pcb
struct _KPROCESS
Pcb
struct _KPROCESS
Pcb
struct _KPROCESS
Pcb
struct _KPROCESS
Pcb
struct _KPROCESS
Pcb
0x0000
0x006Cstruct _EX_PUSH_LOCK
ProcessLock
0x0070union _LARGE_INTEGER
CreateTime
0x0078union _LARGE_INTEGER
ExitTime
struct _EX_PUSH_LOCK
ProcessLock
0x00B8
0x0080struct _EX_RUNDOWN_REF
RundownProtect
union _LARGE_INTEGER
CreateTime
struct _EX_PUSH_LOCK
ProcessLock
0x00C0
0x0084void *
UniqueProcessId
0x0088struct _LIST_ENTRY
ActiveProcessLinks
union _LARGE_INTEGER
ExitTime
union _LARGE_INTEGER
CreateTime
0x00C8
0x0090unsigned long[3]
QuotaUsage
struct _EX_RUNDOWN_REF
RundownProtect
union _LARGE_INTEGER
ExitTime
union _LARGE_INTEGER
ExitTime
union _LARGE_INTEGER
ExitTime
union _LARGE_INTEGER
ExitTime
0x00D0
0x0094void *
UniqueProcessId
void *
UniqueProcessId
0x00D8
0x0098struct _EX_RUNDOWN_REF
RundownProtect
struct _EX_RUNDOWN_REF
RundownProtect
struct _EX_RUNDOWN_REF
RundownProtect
struct _EX_RUNDOWN_REF
RundownProtect
0x00D8
0x0098struct _LIST_ENTRY
ActiveProcessLinks
struct _LIST_ENTRY
ActiveProcessLinks
struct _EX_RUNDOWN_REF
RundownProtect
struct _EX_PUSH_LOCK
ProcessLock
0x00E0
0x0098struct _EX_PUSH_LOCK
ProcessLock
0x0160
0x009Cunsigned long[3]
QuotaPeak
void *
UniqueProcessId
0x00E0
0x00A0struct _LIST_ENTRY
ActiveProcessLinks
struct _LIST_ENTRY
ActiveProcessLinks
struct _LIST_ENTRY
ActiveProcessLinks
struct _LIST_ENTRY
ActiveProcessLinks
0x00E8
0x00A0uintptr_t[3]
QuotaUsage
uintptr_t[3]
QuotaUsage
0x00F0
0x00A0struct _LIST_ENTRY
ActiveProcessLinks
union _LARGE_INTEGER
CreateTime
union _LARGE_INTEGER
CreateTime
union _LARGE_INTEGER
CreateTime
0x0168
0x00A0struct _EX_PUSH_LOCK
ProcessLock
struct _EX_PUSH_LOCK
ProcessLock
0x01B8
0x00A0struct _EX_PUSH_LOCK
ProcessLock
0x02C8
0x00A8uintptr_t[3]
QuotaUsage
uintptr_t[3]
QuotaUsage
uintptr_t[3]
QuotaUsage
uintptr_t[3]
QuotaUsage
0x00F8
0x00A8union _LARGE_INTEGER
ExitTime
union _LARGE_INTEGER
ExitTime
0x0170
0x00A8union _LARGE_INTEGER
CreateTime
union _LARGE_INTEGER
CreateTime
0x01C0
0x00A8unsigned long
CommitCharge
unsigned long[3]
QuotaUsage
union _LARGE_INTEGER
ExitTime
union _LARGE_INTEGER
CreateTime
union _LARGE_INTEGER
CreateTime
union _LARGE_INTEGER
CreateTime
union _LARGE_INTEGER
CreateTime
union _LARGE_INTEGER
CreateTime
union _LARGE_INTEGER
CreateTime
union _LARGE_INTEGER
CreateTime
union _LARGE_INTEGER
CreateTime
struct _EX_PUSH_LOCK
ProcessLock
0x02D0
0x00A8struct _EX_PUSH_LOCK
ProcessLock
0x02D8
0x00ACunsigned long
PeakVirtualSize
uintptr_t[3]
QuotaPeak
uintptr_t[3]
QuotaPeak
0x0108
0x00ACstruct _EX_RUNDOWN_REF
RundownProtect
0x02E0
0x00B0struct _EX_RUNDOWN_REF
RundownProtect
struct _EX_RUNDOWN_REF
RundownProtect
0x0178
0x00B0struct _EX_RUNDOWN_REF
RundownProtect
struct _EX_RUNDOWN_REF
RundownProtect
0x01C8
0x00B0unsigned long
VirtualSize
struct _EX_RUNDOWN_REF
RundownProtect
struct _EX_RUNDOWN_REF
RundownProtect
struct _EX_PUSH_LOCK
ProcessLock
void *
VdmObjects
struct _EX_PUSH_LOCK
ProcessLock
0x02D8
0x00B4uintptr_t[3]
QuotaPeak
uintptr_t[3]
QuotaPeak
uintptr_t[3]
QuotaPeak
uintptr_t[3]
QuotaPeak
0x0110
0x00B4struct _LIST_ENTRY
SessionProcessLinks
unsigned long[3]
QuotaPeak
void *
UniqueProcessId
void *
UniqueProcessId
void *
UniqueProcessId
0x0180
0x00B4void *
UniqueProcessId
void *
UniqueProcessId
0x01D0
0x00B4void *
UniqueProcessId
void *
UniqueProcessId
void *
UniqueProcessId
void *
UniqueProcessId
void *
UniqueProcessId
void *
UniqueProcessId
void *
UniqueProcessId
void *
UniqueProcessId
0x02E0
0x00B4void *
UniqueProcessId
0x02E8
0x00B8uintptr_t
CommitCharge
uintptr_t
CommitCharge
struct _LIST_ENTRY
ActiveProcessLinks
0x0120
0x00B8struct _LIST_ENTRY
ActiveProcessLinks
struct _LIST_ENTRY
ActiveProcessLinks
0x0188
0x00B8struct _LIST_ENTRY
ActiveProcessLinks
struct _LIST_ENTRY
ActiveProcessLinks
0x01D8
0x00B8struct _LIST_ENTRY
ActiveProcessLinks
struct _LIST_ENTRY
ActiveProcessLinks
struct _LIST_ENTRY
ActiveProcessLinks
struct _LIST_ENTRY
ActiveProcessLinks
struct _LIST_ENTRY
ActiveProcessLinks
struct _LIST_ENTRY
ActiveProcessLinks
struct _LIST_ENTRY
ActiveProcessLinks
struct _LIST_ENTRY
ActiveProcessLinks
0x02E8
0x00B8struct _LIST_ENTRY
ActiveProcessLinks
struct _LIST_ENTRY
ActiveProcessLinks
struct _LIST_ENTRY
ActiveProcessLinks
0x02F0
0x00BCvoid *
DebugPort
uintptr_t
PeakVirtualSize
uintptr_t
PeakVirtualSize
0x0128
0x00C0volatile unsigned long
CommitCharge
volatile uint64_t
CommitCharge
volatile unsigned long
CommitCharge
volatile uint64_t
CommitCharge
0x0128
0x00C0uintptr_t
VirtualSize
uintptr_t
VirtualSize
0x0130
0x00C0uintptr_t[2]
ProcessQuotaUsage
uintptr_t[2]
ProcessQuotaUsage
0x0198
0x00C0void *
ExceptionPort
volatile unsigned long
CommitCharge
uintptr_t[2]
ProcessQuotaUsage
uintptr_t[2]
ProcessQuotaUsage
0x01E8
0x00C0unsigned long
Flags2
unsigned long
JobNotReallyActive
0x02F8
0x00C0:0x00unsigned long
JobNotReallyActive
unsigned long
JobNotReallyActive
unsigned long
JobNotReallyActive
unsigned long
JobNotReallyActive
unsigned long
JobNotReallyActive
unsigned long
JobNotReallyActive
unsigned long
JobNotReallyActive
unsigned long
JobNotReallyActive
0x02F8:0x00
0x00C0unsigned long
Flags2
0x0300
0x00C0:0x00unsigned long
JobNotReallyActive
0x0300:0x00
0x00C0:0x01unsigned long
AccountingFolded
unsigned long
AccountingFolded
unsigned long
AccountingFolded
unsigned long
AccountingFolded
unsigned long
AccountingFolded
unsigned long
AccountingFolded
unsigned long
AccountingFolded
unsigned long
AccountingFolded
0x02F8:0x01
0x00C0:0x01unsigned long
AccountingFolded
0x0300:0x01
0x00C0:0x02unsigned long
NewProcessReported
unsigned long
NewProcessReported
unsigned long
NewProcessReported
unsigned long
NewProcessReported
unsigned long
NewProcessReported
unsigned long
NewProcessReported
unsigned long
NewProcessReported
unsigned long
NewProcessReported
0x02F8:0x02
0x00C0:0x02unsigned long
NewProcessReported
0x0300:0x02
0x00C0:0x03unsigned long
ExitProcessReported
unsigned long
ExitProcessReported
unsigned long
ExitProcessReported
unsigned long
ExitProcessReported
unsigned long
ExitProcessReported
unsigned long
ExitProcessReported
unsigned long
ExitProcessReported
unsigned long
ExitProcessReported
0x02F8:0x03
0x00C0:0x03unsigned long
ExitProcessReported
0x0300:0x03
0x00C0:0x04unsigned long
ReportCommitChanges
unsigned long
ReportCommitChanges
unsigned long
ReportCommitChanges
unsigned long
ReportCommitChanges
unsigned long
ReportCommitChanges
unsigned long
ReportCommitChanges
unsigned long
ReportCommitChanges
unsigned long
ReportCommitChanges
0x02F8:0x04
0x00C0:0x04unsigned long
ReportCommitChanges
0x0300:0x04
0x00C0:0x05unsigned long
LastReportMemory
unsigned long
LastReportMemory
unsigned long
LastReportMemory
unsigned long
LastReportMemory
unsigned long
LastReportMemory
unsigned long
LastReportMemory
unsigned long
LastReportMemory
unsigned long
LastReportMemory
0x02F8:0x05
0x00C0:0x05unsigned long
LastReportMemory
0x0300:0x05
0x00C0:0x06unsigned long
NoWakeCharge
unsigned long
NoWakeCharge
unsigned long
ForceWakeCharge
unsigned long
ForceWakeCharge
unsigned long
ForceWakeCharge
unsigned long
ForceWakeCharge
unsigned long
ForceWakeCharge
unsigned long
ForceWakeCharge
0x02F8:0x06
0x00C0:0x06unsigned long
ForceWakeCharge
0x0300:0x06
0x00C0:0x07unsigned long
HandleTableRundown
unsigned long
HandleTableRundown
unsigned long
CrossSessionCreate
unsigned long
CrossSessionCreate
unsigned long
CrossSessionCreate
unsigned long
CrossSessionCreate
unsigned long
CrossSessionCreate
unsigned long
CrossSessionCreate
0x02F8:0x07
0x00C0:0x07unsigned long
CrossSessionCreate
0x0300:0x07
0x00C0:0x08unsigned long
NeedsHandleRundown
unsigned long
NeedsHandleRundown
unsigned long
NeedsHandleRundown
unsigned long
NeedsHandleRundown
unsigned long
NeedsHandleRundown
unsigned long
NeedsHandleRundown
unsigned long
NeedsHandleRundown
unsigned long
NeedsHandleRundown
0x02F8:0x08
0x00C0:0x08unsigned long
NeedsHandleRundown
0x0300:0x08
0x00C0:0x09unsigned long
RefTraceEnabled
unsigned long
RefTraceEnabled
unsigned long
RefTraceEnabled
unsigned long
RefTraceEnabled
unsigned long
RefTraceEnabled
unsigned long
RefTraceEnabled
unsigned long
RefTraceEnabled
unsigned long
RefTraceEnabled
0x02F8:0x09
0x00C0:0x09unsigned long
RefTraceEnabled
0x0300:0x09
0x00C0:0x0Aunsigned long
NumaAware
unsigned long
NumaAware
unsigned long
DisableDynamicCode
unsigned long
DisableDynamicCode
unsigned long
DisableDynamicCode
unsigned long
DisableDynamicCode
unsigned long
DisableDynamicCode
unsigned long
DisableDynamicCode
0x02F8:0x0A
0x00C0:0x0Aunsigned long
DisableDynamicCode
0x0300:0x0A
0x00C0:0x0Bunsigned long
EmptyJobEvaluated
unsigned long
EmptyJobEvaluated
unsigned long
EmptyJobEvaluated
unsigned long
EmptyJobEvaluated
unsigned long
EmptyJobEvaluated
unsigned long
EmptyJobEvaluated
unsigned long
EmptyJobEvaluated
unsigned long
EmptyJobEvaluated
0x02F8:0x0B
0x00C0:0x0Bunsigned long
EmptyJobEvaluated
0x0300:0x0B
0x00C0:0x0Cunsigned long
DefaultPagePriority
unsigned long
DefaultPagePriority
unsigned long
DefaultPagePriority
unsigned long
DefaultPagePriority
unsigned long
DefaultPagePriority
unsigned long
DefaultPagePriority
unsigned long
DefaultPagePriority
unsigned long
DefaultPagePriority
0x02F8:0x0C
0x00C0:0x0Cunsigned long
DefaultPagePriority
0x0300:0x0C
0x00C0:0x0Funsigned long
PrimaryTokenFrozen
unsigned long
PrimaryTokenFrozen
unsigned long
PrimaryTokenFrozen
unsigned long
PrimaryTokenFrozen
unsigned long
PrimaryTokenFrozen
unsigned long
PrimaryTokenFrozen
unsigned long
PrimaryTokenFrozen
unsigned long
PrimaryTokenFrozen
0x02F8:0x0F
0x00C0:0x0Funsigned long
PrimaryTokenFrozen
0x0300:0x0F
0x00C0:0x10unsigned long
ProcessVerifierTarget
unsigned long
ProcessVerifierTarget
unsigned long
ProcessVerifierTarget
unsigned long
ProcessVerifierTarget
unsigned long
ProcessVerifierTarget
unsigned long
ProcessVerifierTarget
unsigned long
ProcessVerifierTarget
unsigned long
ProcessVerifierTarget
0x02F8:0x10
0x00C0:0x10unsigned long
ProcessVerifierTarget
0x0300:0x10
0x00C0:0x11unsigned long
StackRandomizationDisabled
unsigned long
StackRandomizationDisabled
unsigned long
StackRandomizationDisabled
unsigned long
StackRandomizationDisabled
unsigned long
StackRandomizationDisabled
unsigned long
StackRandomizationDisabled
unsigned long
StackRandomizationDisabled
unsigned long
StackRandomizationDisabled
0x02F8:0x11
0x00C0:0x11unsigned long
StackRandomizationDisabled
0x0300:0x11
0x00C0:0x12unsigned long
AffinityPermanent
unsigned long
AffinityPermanent
unsigned long
AffinityPermanent
unsigned long
AffinityPermanent
unsigned long
AffinityPermanent
unsigned long
AffinityPermanent
unsigned long
AffinityPermanent
unsigned long
AffinityPermanent
0x02F8:0x12
0x00C0:0x12unsigned long
AffinityPermanent
0x0300:0x12
0x00C0:0x13unsigned long
AffinityUpdateEnable
unsigned long
AffinityUpdateEnable
unsigned long
AffinityUpdateEnable
unsigned long
AffinityUpdateEnable
unsigned long
AffinityUpdateEnable
unsigned long
AffinityUpdateEnable
unsigned long
AffinityUpdateEnable
unsigned long
AffinityUpdateEnable
0x02F8:0x13
0x00C0:0x13unsigned long
AffinityUpdateEnable
0x0300:0x13
0x00C0:0x14unsigned long
PropagateNode
unsigned long
PropagateNode
unsigned long
PropagateNode
unsigned long
PropagateNode
unsigned long
PropagateNode
unsigned long
PropagateNode
unsigned long
PropagateNode
unsigned long
PropagateNode
0x02F8:0x14
0x00C0:0x14unsigned long
PropagateNode
0x0300:0x14
0x00C0:0x15unsigned long
ExplicitAffinity
unsigned long
ExplicitAffinity
unsigned long
ExplicitAffinity
unsigned long
ExplicitAffinity
unsigned long
ExplicitAffinity
unsigned long
ExplicitAffinity
unsigned long
ExplicitAffinity
unsigned long
ExplicitAffinity
0x02F8:0x15
0x00C0:0x15unsigned long
ExplicitAffinity
0x0300:0x15
0x00C0:0x16unsigned long
ProcessExecutionState
unsigned long
ProcessExecutionState
unsigned long
ProcessExecutionState
unsigned long
ProcessExecutionState
unsigned long
ProcessExecutionState
unsigned long
ProcessExecutionState
unsigned long
ProcessExecutionState
unsigned long
ProcessExecutionState
0x02F8:0x16
0x00C0:0x16unsigned long
ProcessExecutionState
0x0300:0x16
0x00C0:0x18unsigned long
DisallowStrippedImages
unsigned long
DisallowStrippedImages
unsigned long
DisallowStrippedImages
unsigned long
DisallowStrippedImages
unsigned long
DisallowStrippedImages
unsigned long
DisallowStrippedImages
unsigned long
DisallowStrippedImages
unsigned long
DisallowStrippedImages
0x02F8:0x18
0x00C0:0x18unsigned long
DisallowStrippedImages
0x0300:0x18
0x00C0:0x19unsigned long
HighEntropyASLREnabled
unsigned long
HighEntropyASLREnabled
unsigned long
HighEntropyASLREnabled
unsigned long
HighEntropyASLREnabled
unsigned long
HighEntropyASLREnabled
unsigned long
HighEntropyASLREnabled
unsigned long
HighEntropyASLREnabled
unsigned long
HighEntropyASLREnabled
0x02F8:0x19
0x00C0:0x19unsigned long
HighEntropyASLREnabled
0x0300:0x19
0x00C0:0x1Aunsigned long
ExtensionPointDisable
unsigned long
ExtensionPointDisable
unsigned long
ExtensionPointDisable
unsigned long
ExtensionPointDisable
unsigned long
ExtensionPointDisable
unsigned long
ExtensionPointDisable
unsigned long
ExtensionPointDisable
unsigned long
ExtensionPointDisable
0x02F8:0x1A
0x00C0:0x1Aunsigned long
ExtensionPointDisable
0x0300:0x1A
0x00C0:0x1Bunsigned long
ForceRelocateImages
unsigned long
ForceRelocateImages
unsigned long
ForceRelocateImages
unsigned long
ForceRelocateImages
unsigned long
ForceRelocateImages
unsigned long
ForceRelocateImages
unsigned long
ForceRelocateImages
unsigned long
ForceRelocateImages
0x02F8:0x1B
0x00C0:0x1Bunsigned long
ForceRelocateImages
0x0300:0x1B
0x00C0:0x1Cunsigned long
ProcessStateChangeRequest
unsigned long
ProcessStateChangeRequest
unsigned long
ProcessStateChangeRequest
unsigned long
ProcessStateChangeRequest
unsigned long
ProcessStateChangeRequest
unsigned long
ProcessStateChangeRequest
unsigned long
ProcessStateChangeRequest
unsigned long
ProcessStateChangeRequest
0x02F8:0x1C
0x00C0:0x1Cunsigned long
ProcessStateChangeRequest
0x0300:0x1C
0x00C0:0x1Eunsigned long
ProcessStateChangeInProgress
unsigned long
ProcessStateChangeInProgress
unsigned long
ProcessStateChangeInProgress
unsigned long
ProcessStateChangeInProgress
unsigned long
ProcessStateChangeInProgress
unsigned long
ProcessStateChangeInProgress
unsigned long
ProcessStateChangeInProgress
unsigned long
ProcessStateChangeInProgress
0x02F8:0x1E
0x00C0:0x1Eunsigned long
ProcessStateChangeInProgress
0x0300:0x1E
0x00C0:0x1Funsigned long
DisallowWin32kSystemCalls
unsigned long
DisallowWin32kSystemCalls
unsigned long
DisallowWin32kSystemCalls
unsigned long
DisallowWin32kSystemCalls
unsigned long
DisallowWin32kSystemCalls
unsigned long
DisallowWin32kSystemCalls
unsigned long
DisallowWin32kSystemCalls
unsigned long
DisallowWin32kSystemCalls
0x02F8:0x1F
0x00C0:0x1Funsigned long
DisallowWin32kSystemCalls
0x0300:0x1F
0x00C4uintptr_t
PeakVirtualSize
uintptr_t
PeakVirtualSize
uintptr_t
PeakVirtualSize
uintptr_t
PeakVirtualSize
0x0130
0x00C4struct _HANDLE_TABLE *
ObjectTable
struct _LIST_ENTRY
SessionProcessLinks
struct _LIST_ENTRY
SessionProcessLinks
unsigned long
PeakVirtualSize
0x0138
0x00C4unsigned long
Flags
0x02FC
0x00C4:0x00unsigned long
CreateReported
unsigned long
CreateReported
unsigned long
CreateReported
unsigned long
CreateReported
unsigned long
CreateReported
unsigned long
CreateReported
unsigned long
CreateReported
unsigned long
CreateReported
0x02FC:0x00
0x00C4unsigned long
Flags
0x0304
0x00C4:0x00unsigned long
CreateReported
0x0304:0x00
0x00C4:0x01unsigned long
NoDebugInherit
unsigned long
NoDebugInherit
unsigned long
NoDebugInherit
unsigned long
NoDebugInherit
unsigned long
NoDebugInherit
unsigned long
NoDebugInherit
unsigned long
NoDebugInherit
unsigned long
NoDebugInherit
0x02FC:0x01
0x00C4:0x01unsigned long
NoDebugInherit
0x0304:0x01
0x00C4:0x02unsigned long
ProcessExiting
unsigned long
ProcessExiting
unsigned long
ProcessExiting
unsigned long
ProcessExiting
unsigned long
ProcessExiting
unsigned long
ProcessExiting
unsigned long
ProcessExiting
unsigned long
ProcessExiting
0x02FC:0x02
0x00C4:0x02unsigned long
ProcessExiting
0x0304:0x02
0x00C4:0x03unsigned long
ProcessDelete
unsigned long
ProcessDelete
unsigned long
ProcessDelete
unsigned long
ProcessDelete
unsigned long
ProcessDelete
unsigned long
ProcessDelete
unsigned long
ProcessDelete
unsigned long
ProcessDelete
0x02FC:0x03
0x00C4:0x03unsigned long
ProcessDelete
0x0304:0x03
0x00C4:0x04unsigned long
Wow64SplitPages
unsigned long
Wow64SplitPages
unsigned long
ControlFlowGuardEnabled
unsigned long
ControlFlowGuardEnabled
unsigned long
ControlFlowGuardEnabled
unsigned long
ControlFlowGuardEnabled
unsigned long
ControlFlowGuardEnabled
unsigned long
ControlFlowGuardEnabled
0x02FC:0x04
0x00C4:0x04unsigned long
ControlFlowGuardEnabled
0x0304:0x04
0x00C4:0x05unsigned long
VmDeleted
unsigned long
VmDeleted
unsigned long
VmDeleted
unsigned long
VmDeleted
unsigned long
VmDeleted
unsigned long
VmDeleted
unsigned long
VmDeleted
unsigned long
VmDeleted
0x02FC:0x05
0x00C4:0x05unsigned long
VmDeleted
0x0304:0x05
0x00C4:0x06unsigned long
OutswapEnabled
unsigned long
OutswapEnabled
unsigned long
OutswapEnabled
unsigned long
OutswapEnabled
unsigned long
OutswapEnabled
unsigned long
OutswapEnabled
unsigned long
OutswapEnabled
unsigned long
OutswapEnabled
0x02FC:0x06
0x00C4:0x06unsigned long
OutswapEnabled
0x0304:0x06
0x00C4:0x07unsigned long
Outswapped
unsigned long
Outswapped
unsigned long
Outswapped
unsigned long
Outswapped
unsigned long
Outswapped
unsigned long
Outswapped
unsigned long
Outswapped
unsigned long
Outswapped
0x02FC:0x07
0x00C4:0x07unsigned long
Outswapped
0x0304:0x07
0x00C4:0x08unsigned long
ForkFailed
unsigned long
ForkFailed
unsigned long
ForkFailed
unsigned long
ForkFailed
unsigned long
ForkFailed
unsigned long
ForkFailed
unsigned long
ForkFailed
unsigned long
ForkFailed
unsigned long
Spare1
0x02FC:0x08
0x00C4:0x08unsigned long
FailFastOnCommitFail
0x0304:0x08
0x00C4:0x09unsigned long
Wow64VaSpace4Gb
unsigned long
Wow64VaSpace4Gb
unsigned long
Wow64VaSpace4Gb
unsigned long
Wow64VaSpace4Gb
unsigned long
Wow64VaSpace4Gb
unsigned long
Wow64VaSpace4Gb
unsigned long
Wow64VaSpace4Gb
unsigned long
Wow64VaSpace4Gb
0x02FC:0x09
0x00C4:0x09unsigned long
Wow64VaSpace4Gb
0x0304:0x09
0x00C4:0x0Aunsigned long
AddressSpaceInitialized
unsigned long
AddressSpaceInitialized
unsigned long
AddressSpaceInitialized
unsigned long
AddressSpaceInitialized
unsigned long
AddressSpaceInitialized
unsigned long
AddressSpaceInitialized
unsigned long
AddressSpaceInitialized
unsigned long
AddressSpaceInitialized
0x02FC:0x0A
0x00C4:0x0Aunsigned long
AddressSpaceInitialized
0x0304:0x0A
0x00C4:0x0Cunsigned long
SetTimerResolution
unsigned long
SetTimerResolution
unsigned long
SetTimerResolution
unsigned long
SetTimerResolution
unsigned long
SetTimerResolution
unsigned long
SetTimerResolution
unsigned long
SetTimerResolution
unsigned long
SetTimerResolution
0x02FC:0x0C
0x00C4:0x0Cunsigned long
SetTimerResolution
0x0304:0x0C
0x00C4:0x0Dunsigned long
BreakOnTermination
unsigned long
BreakOnTermination
unsigned long
BreakOnTermination
unsigned long
BreakOnTermination
unsigned long
BreakOnTermination
unsigned long
BreakOnTermination
unsigned long
BreakOnTermination
unsigned long
BreakOnTermination
0x02FC:0x0D
0x00C4:0x0Dunsigned long
BreakOnTermination
0x0304:0x0D
0x00C4:0x0Eunsigned long
DeprioritizeViews
unsigned long
DeprioritizeViews
unsigned long
DeprioritizeViews
unsigned long
DeprioritizeViews
unsigned long
DeprioritizeViews
unsigned long
DeprioritizeViews
unsigned long
DeprioritizeViews
unsigned long
DeprioritizeViews
0x02FC:0x0E
0x00C4:0x0Eunsigned long
DeprioritizeViews
0x0304:0x0E
0x00C4:0x0Funsigned long
WriteWatch
unsigned long
WriteWatch
unsigned long
WriteWatch
unsigned long
WriteWatch
unsigned long
WriteWatch
unsigned long
WriteWatch
unsigned long
WriteWatch
unsigned long
WriteWatch
0x02FC:0x0F
0x00C4:0x0Funsigned long
WriteWatch
0x0304:0x0F
0x00C4:0x10unsigned long
ProcessInSession
unsigned long
ProcessInSession
unsigned long
ProcessInSession
unsigned long
ProcessInSession
unsigned long
ProcessInSession
unsigned long
ProcessInSession
unsigned long
ProcessInSession
unsigned long
ProcessInSession
0x02FC:0x10
0x00C4:0x10unsigned long
ProcessInSession
0x0304:0x10
0x00C4:0x11unsigned long
OverrideAddressSpace
unsigned long
OverrideAddressSpace
unsigned long
OverrideAddressSpace
unsigned long
OverrideAddressSpace
unsigned long
OverrideAddressSpace
unsigned long
OverrideAddressSpace
unsigned long
OverrideAddressSpace
unsigned long
OverrideAddressSpace
0x02FC:0x11
0x00C4:0x11unsigned long
OverrideAddressSpace
0x0304:0x11
0x00C4:0x12unsigned long
HasAddressSpace
unsigned long
HasAddressSpace
unsigned long
HasAddressSpace
unsigned long
HasAddressSpace
unsigned long
HasAddressSpace
unsigned long
HasAddressSpace
unsigned long
HasAddressSpace
unsigned long
HasAddressSpace
0x02FC:0x12
0x00C4:0x12unsigned long
HasAddressSpace
0x0304:0x12
0x00C4:0x13unsigned long
LaunchPrefetched
unsigned long
LaunchPrefetched
unsigned long
LaunchPrefetched
unsigned long
LaunchPrefetched
unsigned long
LaunchPrefetched
unsigned long
LaunchPrefetched
unsigned long
LaunchPrefetched
unsigned long
LaunchPrefetched
0x02FC:0x13
0x00C4:0x13unsigned long
LaunchPrefetched
0x0304:0x13
0x00C4:0x14unsigned long
Background
unsigned long
Background
unsigned long
Background
unsigned long
Background
unsigned long
Background
unsigned long
Background
unsigned long
Background
unsigned long
Background
0x02FC:0x14
0x00C4:0x14unsigned long
Background
0x0304:0x14
0x00C4:0x15unsigned long
VmTopDown
unsigned long
VmTopDown
unsigned long
VmTopDown
unsigned long
VmTopDown
unsigned long
VmTopDown
unsigned long
VmTopDown
unsigned long
VmTopDown
unsigned long
VmTopDown
0x02FC:0x15
0x00C4:0x15unsigned long
VmTopDown
0x0304:0x15
0x00C4:0x16unsigned long
ImageNotifyDone
unsigned long
ImageNotifyDone
unsigned long
ImageNotifyDone
unsigned long
ImageNotifyDone
unsigned long
ImageNotifyDone
unsigned long
ImageNotifyDone
unsigned long
ImageNotifyDone
unsigned long
ImageNotifyDone
0x02FC:0x16
0x00C4:0x16unsigned long
ImageNotifyDone
0x0304:0x16
0x00C4:0x17unsigned long
PdeUpdateNeeded
unsigned long
PdeUpdateNeeded
unsigned long
PdeUpdateNeeded
unsigned long
PdeUpdateNeeded
unsigned long
PdeUpdateNeeded
unsigned long
PdeUpdateNeeded
unsigned long
PdeUpdateNeeded
unsigned long
PdeUpdateNeeded
0x02FC:0x17
0x00C4:0x17unsigned long
PdeUpdateNeeded
0x0304:0x17
0x00C4:0x18unsigned long
VdmAllowed
unsigned long
VdmAllowed
unsigned long
VdmAllowed
unsigned long
VdmAllowed
unsigned long
VdmAllowed
unsigned long
VdmAllowed
unsigned long
VdmAllowed
unsigned long
VdmAllowed
0x02FC:0x18
0x00C4:0x18unsigned long
VdmAllowed
0x0304:0x18
0x00C4:0x19unsigned long
CrossSessionCreate
unsigned long
CrossSessionCreate
unsigned long
ProcessRundown
unsigned long
ProcessRundown
unsigned long
ProcessRundown
unsigned long
ProcessRundown
unsigned long
ProcessRundown
unsigned long
ProcessRundown
0x02FC:0x19
0x00C4:0x19unsigned long
ProcessRundown
0x0304:0x19
0x00C4:0x1Aunsigned long
ProcessInserted
unsigned long
ProcessInserted
unsigned long
ProcessInserted
unsigned long
ProcessInserted
unsigned long
ProcessInserted
unsigned long
ProcessInserted
unsigned long
ProcessInserted
unsigned long
ProcessInserted
0x02FC:0x1A
0x00C4:0x1Aunsigned long
ProcessInserted
0x0304:0x1A
0x00C4:0x1Bunsigned long
DefaultIoPriority
unsigned long
DefaultIoPriority
unsigned long
DefaultIoPriority
unsigned long
DefaultIoPriority
unsigned long
DefaultIoPriority
unsigned long
DefaultIoPriority
unsigned long
DefaultIoPriority
unsigned long
DefaultIoPriority
0x02FC:0x1B
0x00C4:0x1Bunsigned long
DefaultIoPriority
0x0304:0x1B
0x00C4:0x1Eunsigned long
ProcessSelfDelete
unsigned long
ProcessSelfDelete
unsigned long
ProcessSelfDelete
unsigned long
ProcessSelfDelete
unsigned long
ProcessSelfDelete
unsigned long
ProcessSelfDelete
unsigned long
ProcessSelfDelete
unsigned long
ProcessSelfDelete
0x02FC:0x1E
0x00C4:0x1Eunsigned long
ProcessSelfDelete
0x0304:0x1E
0x00C4:0x1Funsigned long
SetTimerResolutionLink
unsigned long
SetTimerResolutionLink
unsigned long
SetTimerResolutionLink
unsigned long
SetTimerResolutionLink
unsigned long
SetTimerResolutionLink
unsigned long
SetTimerResolutionLink
unsigned long
SetTimerResolutionLink
unsigned long
SetTimerResolutionLink
0x02FC:0x1F
0x00C4:0x1Funsigned long
SetTimerResolutionLink
0x0304:0x1F
0x00C8struct _EX_FAST_REF
Token
uintptr_t
VirtualSize
uintptr_t
VirtualSize
uintptr_t
VirtualSize
uintptr_t
VirtualSize
unsigned long[2]
ProcessQuotaPeak
0x0138
0x00C8uintptr_t[2]
ProcessQuotaPeak
uintptr_t[2]
ProcessQuotaPeak
0x01A8
0x00C8uintptr_t[2]
ProcessQuotaPeak
uintptr_t[2]
ProcessQuotaPeak
0x01F8
0x00C8uintptr_t[2]
ProcessQuotaUsage
uintptr_t[2]
ProcessQuotaUsage
uintptr_t[2]
ProcessQuotaUsage
uintptr_t[2]
ProcessQuotaUsage
uintptr_t[2]
ProcessQuotaUsage
uintptr_t[2]
ProcessQuotaUsage
uintptr_t[2]
ProcessQuotaUsage
uintptr_t[2]
ProcessQuotaUsage
unsigned long
JobNotReallyActive
unsigned long
JobNotReallyActive
0x0300
0x00C8uint64_t[2]
ProcessQuotaUsage
union _LARGE_INTEGER
CreateTime
union _LARGE_INTEGER
CreateTime
union _LARGE_INTEGER
CreateTime
0x0308
0x00CCstruct _LIST_ENTRY
SessionProcessLinks
struct _LIST_ENTRY
SessionProcessLinks
struct _LIST_ENTRY
SessionProcessLinks
struct _LIST_ENTRY
SessionProcessLinks
0x0140
0x00CCstruct _FAST_MUTEX
WorkingSetLock
unsigned long
WorkingSetPage
void *
DebugPort
struct _LIST_ENTRY
SessionProcessLinks
0x0148
0x00D0void *
ExceptionPort
void *
ExceptionPort
0x0150
0x00D0struct _KGUARDED_MUTEX
AddressCreationLock
volatile unsigned long
CommitCharge
volatile uint64_t
CommitCharge
volatile unsigned long
CommitCharge
0x01B8
0x00D0uintptr_t
PeakVirtualSize
uintptr_t
PeakVirtualSize
0x0208
0x00D0uintptr_t[2]
ProcessQuotaPeak
uintptr_t[2]
ProcessQuotaPeak
uintptr_t[2]
ProcessQuotaPeak
uintptr_t[2]
ProcessQuotaPeak
uintptr_t[2]
ProcessQuotaPeak
uintptr_t[2]
ProcessQuotaPeak
uintptr_t[2]
ProcessQuotaPeak
uintptr_t[2]
ProcessQuotaPeak
uintptr_t[2]
ProcessQuotaUsage
uintptr_t[2]
ProcessQuotaUsage
uintptr_t[2]
ProcessQuotaUsage
0x0310
0x00D4void *
DebugPort
void *
DebugPort
void *
DebugPort
void *
DebugPort
0x0150
0x00D4struct _HANDLE_TABLE *
ObjectTable
struct _HANDLE_TABLE *
ObjectTable
0x0158
0x00D4struct _EPROCESS_QUOTA_BLOCK *
QuotaBlock
struct _EPROCESS_QUOTA_BLOCK *
QuotaBlock
0x01C0
0x00D4void *
DebugPort
struct _EPROCESS_QUOTA_BLOCK *
QuotaBlock
uintptr_t
VirtualSize
0x0210
0x00D8unsigned long
ExceptionPortState
void *
ExceptionPortData
0x0158
0x00D8uintptr_t
ExceptionPortValue
0x0158
0x00D8:0x00uintptr_t
ExceptionPortState
uintptr_t
ExceptionPortState
uintptr_t
ExceptionPortState
uintptr_t
ExceptionPortState
0x0158:0x00
0x00D8struct _EX_FAST_REF
Token
struct _EX_FAST_REF
Token
void *
ExceptionPortData
struct _PS_CPU_QUOTA_BLOCK *
CpuQuotaBlock
0x0160
0x00D8struct _PS_CPU_QUOTA_BLOCK *
CpuQuotaBlock
struct _PS_CPU_QUOTA_BLOCK *
CpuQuotaBlock
0x01C8
0x00D8struct _LIST_ENTRY
SessionProcessLinks
struct _LIST_ENTRY
SessionProcessLinks
0x0218
0x00D8unsigned long
ExceptionPortValue
uintptr_t
PeakVirtualSize
uintptr_t[2]
ProcessQuotaPeak
uintptr_t[2]
ProcessQuotaPeak
uintptr_t[2]
ProcessQuotaPeak
0x0320
0x00DCstruct _HANDLE_TABLE *
ObjectTable
struct _HANDLE_TABLE *
ObjectTable
struct _HANDLE_TABLE *
ObjectTable
struct _HANDLE_TABLE *
ObjectTable
0x0160
0x00DCuintptr_t
WorkingSetPage
uintptr_t
WorkingSetPage
0x0168
0x00DCstruct _HANDLE_TABLE *
ObjectTable
uintptr_t
PeakVirtualSize
uintptr_t
PeakVirtualSize
uintptr_t
PeakVirtualSize
0x01D0
0x00DCuintptr_t
VirtualSize
0x0328
0x00E0struct _EX_FAST_REF
Token
struct _EX_FAST_REF
Token
struct _EX_FAST_REF
Token
struct _EX_FAST_REF
Token
unsigned long
VirtualSize
0x0168
0x00E0struct _KGUARDED_MUTEX
AddressCreationLock
struct _KGUARDED_MUTEX
AddressCreationLock
0x0170
0x00E0uintptr_t
VirtualSize
uintptr_t
VirtualSize
0x01D8
0x00E0void *
ExceptionPortData
0x0228
0x00E0uintptr_t
ExceptionPortValue
0x0228
0x00E0:0x00uintptr_t
ExceptionPortState
uintptr_t
ExceptionPortState
0x0228:0x00
0x00E0struct _LIST_ENTRY
SessionProcessLinks
struct _LIST_ENTRY
SessionProcessLinks
struct _LIST_ENTRY
SessionProcessLinks
struct _LIST_ENTRY
SessionProcessLinks
struct _LIST_ENTRY
SessionProcessLinks
struct _LIST_ENTRY
SessionProcessLinks
struct _LIST_ENTRY
SessionProcessLinks
struct _LIST_ENTRY
SessionProcessLinks
uintptr_t
PeakVirtualSize
0x0330
0x00E4uintptr_t
WorkingSetPage
uintptr_t
WorkingSetPage
uintptr_t
WorkingSetPage
uintptr_t
WorkingSetPage
struct _LIST_ENTRY
SessionProcessLinks
0x0170
0x00E4struct _LIST_ENTRY
SessionProcessLinks
struct _LIST_ENTRY
SessionProcessLinks
0x01E0
0x00E4struct _EX_FAST_REF
Token
struct _EX_FAST_REF
Token
0x0230
0x00E4uintptr_t
VirtualSize
0x0338
0x00E8struct _EX_PUSH_LOCK
AddressCreationLock
struct _EX_PUSH_LOCK
AddressCreationLock
struct _EX_PUSH_LOCK
AddressCreationLock
struct _EX_PUSH_LOCK
AddressCreationLock
0x0178
0x00E8struct _EX_PUSH_LOCK
AddressCreationLock
uintptr_t
WorkingSetPage
uintptr_t
WorkingSetPage
0x0238
0x00E8void *
ExceptionPortData
struct _LIST_ENTRY
SessionProcessLinks
struct _LIST_ENTRY
SessionProcessLinks
0x0340
0x00E8uintptr_t
ExceptionPortValue
0x0340
0x00E8:0x00uintptr_t
ExceptionPortState
0x0340:0x00
0x00ECunsigned long
WorkingSetPage
struct _ETHREAD *
RotateInProgress
struct _ETHREAD *
RotateInProgress
struct _ETHREAD *
RotateInProgress
struct _ETHREAD *
RotateInProgress
void *
DebugPort
0x0180
0x00ECvoid *
DebugPort
void *
DebugPort
0x01F0
0x00ECstruct _EX_PUSH_LOCK
AddressCreationLock
struct _EX_PUSH_LOCK
AddressCreationLock
0x0240
0x00ECstruct _EX_FAST_REF
Token
uint64_t
ExceptionPortState
0x0348
0x00F0struct _ETHREAD *
ForkInProgress
struct _ETHREAD *
ForkInProgress
struct _ETHREAD *
ForkInProgress
struct _ETHREAD *
ForkInProgress
0x0188
0x00F0void *
ExceptionPortData
0x01F8
0x00F0uintptr_t
ExceptionPortValue
0x01F8
0x00F0:0x00uintptr_t
ExceptionPortState
uintptr_t
ExceptionPortState
0x01F8:0x00
0x00F0struct _FAST_MUTEX
AddressCreationLock
unsigned long
HyperSpaceLock
struct _ETHREAD *
ForkInProgress
void *
ExceptionPortData
struct _ETHREAD *
RotateInProgress
struct _ETHREAD *
RotateInProgress
0x0248
0x00F0uintptr_t
ExceptionPortValue
uintptr_t
WorkingSetPage
uintptr_t
ExceptionPortValue
void *
ExceptionPortData
uintptr_t
ExceptionPortValue
0x0350
0x00F0:0x00uintptr_t
ExceptionPortState
uintptr_t
ExceptionPortState
uintptr_t
ExceptionPortValue
uintptr_t
ExceptionPortState
0x0350:0x00
0x00F0:0x00uintptr_t
ExceptionPortState
0x0350:0x00
0x00F4uintptr_t
HardwareTrigger
uintptr_t
HardwareTrigger
uintptr_t
HardwareTrigger
uintptr_t
HardwareTrigger
0x0190
0x00F4struct _ETHREAD *
ForkInProgress
unsigned long
HardwareTrigger
struct _HANDLE_TABLE *
ObjectTable
struct _HANDLE_TABLE *
ObjectTable
struct _HANDLE_TABLE *
ObjectTable
0x0200
0x00F4struct _ETHREAD *
ForkInProgress
struct _ETHREAD *
ForkInProgress
0x0250
0x00F4struct _EX_PUSH_LOCK
AddressCreationLock
struct _EX_FAST_REF
Token
0x0358
0x00F8struct _MM_AVL_TABLE *
PhysicalVadRoot
struct _MM_AVL_TABLE *
PhysicalVadRoot
struct _MM_AVL_TABLE *
PhysicalVadRoot
struct _MM_AVL_TABLE *
PhysicalVadRoot
0x0198
0x00F8unsigned long
HardwareTrigger
struct _MM_AVL_TABLE *
PhysicalVadRoot
struct _EX_FAST_REF
Token
struct _EX_FAST_REF
Token
struct _EX_FAST_REF
Token
0x0208
0x00F8uintptr_t
HardwareTrigger
uintptr_t
HardwareTrigger
0x0258
0x00F8struct _ETHREAD *
RotateInProgress
struct _EX_PUSH_LOCK
PageTableCommitmentLock
uintptr_t
WorkingSetPage
0x0360
0x00FCvoid *
CloneRoot
void *
CloneRoot
void *
CloneRoot
void *
CloneRoot
0x01A0
0x00FCstruct _MM_AVL_TABLE *
PhysicalVadRoot
void *
CloneRoot
uintptr_t
WorkingSetPage
uintptr_t
WorkingSetPage
uintptr_t
WorkingSetPage
0x0210
0x00FCstruct _EJOB * volatile
CommitChargeJob
struct _EJOB * volatile
CommitChargeJob
0x0260
0x00FCstruct _ETHREAD *
ForkInProgress
struct _ETHREAD *
RotateInProgress
struct _EX_PUSH_LOCK
AddressCreationLock
0x0368
0x0100uintptr_t
HyperSpaceLock
uintptr_t
HyperSpaceLock
volatile unsigned long
NumberOfPrivatePages
volatile uint64_t
NumberOfPrivatePages
volatile unsigned long
NumberOfPrivatePages
volatile uint64_t
NumberOfPrivatePages
0x01A8
0x0100void *
CloneRoot
volatile unsigned long
NumberOfPrivatePages
struct _EX_PUSH_LOCK
AddressCreationLock
struct _EX_PUSH_LOCK
AddressCreationLock
struct _EX_PUSH_LOCK
AddressCreationLock
0x0218
0x0100struct _MM_AVL_TABLE *
CloneRoot
struct _MM_AVL_TABLE *
CloneRoot
0x0268
0x0100uintptr_t
HardwareTrigger
struct _ETHREAD *
ForkInProgress
struct _EX_PUSH_LOCK
PageTableCommitmentLock
0x0370
0x0104struct _ETHREAD *
ForkInProgress
struct _ETHREAD *
ForkInProgress
volatile unsigned long
NumberOfLockedPages
volatile uint64_t
NumberOfLockedPages
volatile unsigned long
NumberOfLockedPages
volatile uint64_t
NumberOfLockedPages
0x01B0
0x0104struct _ETHREAD *
RotateInProgress
struct _ETHREAD *
RotateInProgress
0x0220
0x0104unsigned long
NumberOfPrivatePages
volatile unsigned long
NumberOfLockedPages
struct _ETHREAD *
RotateInProgress
volatile unsigned long
NumberOfPrivatePages
volatile uint64_t
NumberOfPrivatePages
0x0270
0x0104struct _EJOB * volatile
CommitChargeJob
struct _ETHREAD *
RotateInProgress
0x0378
0x0108unsigned long
NumberOfLockedPages
uintptr_t
HardwareTrigger
uintptr_t
HardwareTrigger
void *
Win32Process
void *
Win32Process
void *
Win32Process
void *
Win32Process
struct _ETHREAD *
ForkInProgress
0x01B8
0x0108struct _ETHREAD *
ForkInProgress
struct _ETHREAD *
ForkInProgress
0x0228
0x0108volatile unsigned long
NumberOfLockedPages
volatile uint64_t
NumberOfLockedPages
0x0278
0x0108struct _MM_AVL_TABLE *
CloneRoot
struct _RTL_AVL_TREE
CloneRoot
struct _ETHREAD *
ForkInProgress
0x0380
0x010Cstruct _MM_AVL_TABLE *
PhysicalVadRoot
struct _MM_AVL_TABLE *
PhysicalVadRoot
struct _EJOB *
Job
struct _EJOB *
Job
struct _EJOB *
Job
struct _EJOB *
Job
0x01C0
0x010Cuintptr_t
HardwareTrigger
uintptr_t
HardwareTrigger
0x0230
0x010Cvoid *
Win32Process
struct _EJOB *
Job
unsigned long
HardwareTrigger
void *
Win32Process
void *
Win32Process
0x0280
0x010Cvolatile unsigned long
NumberOfPrivatePages
volatile uint64_t
NumberOfPrivatePages
volatile unsigned long
NumberOfPrivatePages
volatile uint64_t
NumberOfPrivatePages
volatile unsigned long
NumberOfPrivatePages
volatile uint64_t
NumberOfPrivatePages
volatile unsigned long
NumberOfPrivatePages
volatile uint64_t
NumberOfPrivatePages
struct _EJOB * volatile
CommitChargeJob
0x0388
0x0110void *
CloneRoot
void *
CloneRoot
void *
SectionObject
void *
SectionObject
void *
SectionObject
void *
SectionObject
0x01C8
0x0110struct _MM_AVL_TABLE *
PhysicalVadRoot
struct _MM_AVL_TABLE *
PhysicalVadRoot
0x0238
0x0110struct _EJOB * volatile
Job
struct _EJOB * volatile
Job
0x0288
0x0110unsigned long
HyperSpaceLock
struct _EJOB *
Job
void *
SectionObject
struct _MM_AVL_TABLE *
PhysicalVadRoot
volatile unsigned long
NumberOfLockedPages
volatile uint64_t
NumberOfLockedPages
volatile unsigned long
NumberOfLockedPages
volatile uint64_t
NumberOfLockedPages
volatile unsigned long
NumberOfLockedPages
volatile uint64_t
NumberOfLockedPages
volatile unsigned long
NumberOfLockedPages
volatile uint64_t
NumberOfLockedPages
struct _RTL_AVL_TREE
CloneRoot
0x0390
0x0114uintptr_t
NumberOfPrivatePages
uintptr_t
NumberOfPrivatePages
void *
SectionBaseAddress
void *
SectionBaseAddress
void *
SectionBaseAddress
void *
SectionBaseAddress
0x01D0
0x0114void *
CloneRoot
void *
CloneRoot
0x0240
0x0114void *
SectionObject
void *
SectionObject
0x0290
0x0114struct _ETHREAD *
ForkInProgress
void *
SectionObject
void *
SectionBaseAddress
void *
CloneRoot
void *
Win32Process
volatile unsigned long
NumberOfPrivatePages
volatile uint64_t
NumberOfPrivatePages
0x0398
0x0118uintptr_t
NumberOfLockedPages
uintptr_t
NumberOfLockedPages
struct _EPROCESS_QUOTA_BLOCK *
QuotaBlock
struct _EPROCESS_QUOTA_BLOCK *
QuotaBlock
struct _EPROCESS_QUOTA_BLOCK *
QuotaBlock
struct _EPROCESS_QUOTA_BLOCK *
QuotaBlock
0x01D8
0x0118volatile unsigned long
NumberOfPrivatePages
volatile uint64_t
NumberOfPrivatePages
0x0248
0x0118unsigned long
HardwareTrigger
void *
SectionBaseAddress
struct _EPROCESS_QUOTA_BLOCK *
QuotaBlock
volatile unsigned long
NumberOfPrivatePages
void *
SectionBaseAddress
void *
SectionBaseAddress
0x0298
0x0118struct _EJOB * volatile
Job
volatile unsigned long
NumberOfLockedPages
volatile uint64_t
NumberOfLockedPages
0x03A0
0x011Cvoid *
Win32Process
void *
Win32Process
struct _PAGEFAULT_HISTORY *
WorkingSetWatch
struct _PAGEFAULT_HISTORY *
WorkingSetWatch
struct _PAGEFAULT_HISTORY *
WorkingSetWatch
struct _PAGEFAULT_HISTORY *
WorkingSetWatch
0x01E0
0x011Cvolatile unsigned long
NumberOfLockedPages
volatile uint64_t
NumberOfLockedPages
0x0250
0x011Cvoid *
Spare
unsigned long
Cookie
unsigned long
Cookie
0x02A0
0x011Cvoid *
VadRoot
struct _EPROCESS_QUOTA_BLOCK *
QuotaBlock
struct _PAGEFAULT_HISTORY *
WorkingSetWatch
volatile unsigned long
NumberOfLockedPages
void *
SectionObject
struct _EJOB * volatile
Job
void *
Win32Process
0x03A8
0x0120struct _EJOB *
Job
struct _EJOB *
Job
void *
Win32WindowStation
void *
Win32WindowStation
void *
Win32WindowStation
void *
Win32WindowStation
0x01E8
0x0120void *
VadHint
struct _PAGEFAULT_HISTORY *
WorkingSetWatch
void *
Win32WindowStation
void *
Win32Process
void *
Win32Process
void *
Win32Process
void *
VdmObjects
0x0258
0x0120void *
SectionBaseAddress
struct _EJOB * volatile
Job
0x03B0
0x0124void *
CloneRoot
void *
Win32WindowStation
void *
SectionObject
void *
SectionObject
void *
InheritedFromUniqueProcessId
void *
InheritedFromUniqueProcessId
void *
InheritedFromUniqueProcessId
void *
InheritedFromUniqueProcessId
struct _EJOB * volatile
Job
0x01F0
0x0124struct _EJOB * volatile
Job
struct _EJOB * volatile
Job
0x0260
0x0124struct _PAGEFAULT_HISTORY *
WorkingSetWatch
struct _PAGEFAULT_HISTORY *
WorkingSetWatch
0x02A8
0x0124unsigned long
Cookie
void *
SectionObject
0x03B8
0x0128void *
SectionBaseAddress
void *
SectionBaseAddress
void *
LdtInformation
void *
LdtInformation
void *
LdtInformation
void *
LdtInformation
0x01F8
0x0128void *
SectionObject
void *
SectionObject
0x0268
0x0128unsigned long
NumberOfPrivatePages
void *
InheritedFromUniqueProcessId
void *
LdtInformation
void *
SectionObject
void *
Win32WindowStation
void *
Win32WindowStation
void *
VdmObjects
void *
VdmObjects
void *
VdmObjects
void *
VdmObjects
0x02B0
0x0128void *
SectionBaseAddress
0x03C0
0x012Cstruct _EPROCESS_QUOTA_BLOCK *
QuotaBlock
struct _EPROCESS_QUOTA_BLOCK *
QuotaBlock
void *
Spare
void *
Spare
void *
Spare
void *
Spare
0x0200
0x012Cunsigned long
NumberOfLockedPages
void *
LdtInformation
void *
VadFreeHint
void *
SectionBaseAddress
void *
SectionBaseAddress
void *
SectionBaseAddress
0x0270
0x012Cvoid *
InheritedFromUniqueProcessId
void *
InheritedFromUniqueProcessId
0x02B8
0x012Cstruct _PAGEFAULT_HISTORY *
WorkingSetWatch
struct _PAGEFAULT_HISTORY *
WorkingSetWatch
struct _PAGEFAULT_HISTORY *
WorkingSetWatch
struct _PAGEFAULT_HISTORY *
WorkingSetWatch
struct _PAGEFAULT_HISTORY *
WorkingSetWatch
struct _PAGEFAULT_HISTORY *
WorkingSetWatch
struct _PAGEFAULT_HISTORY *
WorkingSetWatch
struct _PAGEFAULT_HISTORY *
WorkingSetWatch
0x03C0
0x012Cunsigned long
Cookie
0x03C8
0x0130struct _PAGEFAULT_HISTORY *
WorkingSetWatch
struct _PAGEFAULT_HISTORY *
WorkingSetWatch
void *
VdmObjects
void *
VdmObjects
void *
VdmObjects
void *
VdmObjects
0x0208
0x0130void *
Win32Process
void *
VadFreeHint
void *
VdmObjects
void *
Wow64Process
void *
Wow64Process
unsigned long
Cookie
unsigned long
Cookie
unsigned long
Cookie
void *
LdtInformation
0x0278
0x0130void *
Win32WindowStation
void *
Win32WindowStation
void *
Win32WindowStation
void *
Win32WindowStation
void *
Win32WindowStation
void *
Win32WindowStation
void *
Win32WindowStation
void *
Win32WindowStation
struct _PAGEFAULT_HISTORY *
WorkingSetWatch
unsigned long
Cookie
unsigned long
Cookie
0x03C8
0x0130struct _PAGEFAULT_HISTORY *
WorkingSetWatch
0x03D0
0x0134struct _EJOB *
Job
void *
VdmObjects
void *
Win32WindowStation
void *
Win32WindowStation
void *
DeviceMap
void *
DeviceMap
void *
DeviceMap
void *
DeviceMap
unsigned long
Spare8
0x0210
0x0134unsigned long
Spare8
unsigned long
Spare8
0x027C
0x0134struct _EPROCESS *
CreatorProcess
0x02C0
0x0134uintptr_t
ConsoleHostProcess
uintptr_t
ConsoleHostProcess
0x02C0
0x0134void *
InheritedFromUniqueProcessId
void *
InheritedFromUniqueProcessId
void *
InheritedFromUniqueProcessId
void *
InheritedFromUniqueProcessId
void *
InheritedFromUniqueProcessId
void *
InheritedFromUniqueProcessId
void *
InheritedFromUniqueProcessId
void *
InheritedFromUniqueProcessId
void *
Win32WindowStation
struct _PAGEFAULT_HISTORY *
WorkingSetWatch
struct _PAGEFAULT_HISTORY *
WorkingSetWatch
0x03D0
0x0134void *
Win32WindowStation
0x03D8
0x0138void *
SectionObject
void *
DeviceMap
void *
InheritedFromUniqueProcessId
void *
InheritedFromUniqueProcessId
void *
EtwDataSource
void *
EtwDataSource
void *
EtwDataSource
void *
EtwDataSource
struct _PAGEFAULT_HISTORY *
WorkingSetWatch
0x0218
0x0138struct _PAGEFAULT_HISTORY *
WorkingSetWatch
struct _PAGEFAULT_HISTORY *
WorkingSetWatch
0x0280
0x0138struct _PEB *
Peb
struct _PEB *
Peb
0x02C8
0x0138void *
LdtInformation
void *
LdtInformation
void *
LdtInformation
void *
LdtInformation
void *
LdtInformation
void *
LdtInformation
void *
LdtInformation
void *
LdtInformation
0x03D8
0x0138void *
LdtInformation
void *
InheritedFromUniqueProcessId
0x03E0
0x013Cvoid *
LdtInformation
void *
LdtInformation
void *
FreeTebHint
void *
FreeTebHint
void *
FreeTebHint
void *
FreeTebHint
0x0220
0x013Cvoid *
Win32WindowStation
void *
Win32WindowStation
0x0288
0x013Cvoid *
SectionBaseAddress
void *[3]
Spare0
void *
FreeTebHint
void *
Win32WindowStation
void *
Session
void *
Session
0x02D0
0x013Cstruct _EPROCESS *
CreatorProcess
volatile unsigned long
OwnerProcessId
volatile uint64_t
OwnerProcessId
volatile unsigned long
OwnerProcessId
volatile uint64_t
OwnerProcessId
volatile unsigned long
OwnerProcessId
volatile uint64_t
OwnerProcessId
0x03E0
0x013Cuintptr_t
ConsoleHostProcess
uintptr_t
ConsoleHostProcess
0x03E0
0x013Cvoid *
LdtInformation
0x03E8
0x0140struct _EPROCESS_QUOTA_BLOCK *
QuotaBlock
void *
VadFreeHint
void *
VadFreeHint
struct _HARDWARE_PTE_X86
PageDirectoryPte
struct _HARDWARE_PTE
PageDirectoryPte
struct _HARDWARE_PTE_X86
PageDirectoryPte
struct _HARDWARE_PTE
PageDirectoryPte
void *
InheritedFromUniqueProcessId
0x0228
0x0140uint64_t
Filler
uint64_t
Filler
uint64_t
Filler
uint64_t
Filler
0x0228
0x0140void *
InheritedFromUniqueProcessId
void *
InheritedFromUniqueProcessId
0x0290
0x0140void *
AweInfo
void *
AweInfo
0x02D8
0x0140struct _PEB *
Peb
struct _PEB *
Peb
struct _PEB *
Peb
struct _PEB *
Peb
struct _PEB *
Peb
struct _PEB *
Peb
struct _PEB *
Peb
struct _PEB *
Peb
volatile uint64_t
OwnerProcessId
void *
LdtInformation
void *
LdtInformation
0x03E8
0x0140volatile unsigned long
OwnerProcessId
volatile uint64_t
OwnerProcessId
0x03F0
0x0144void *
VdmObjects
void *
VdmObjects
0x0230
0x0144void *
LdtInformation
void *
LdtInformation
0x0298
0x0144struct _EPROCESS_QUOTA_BLOCK *
QuotaBlock
struct _EPROCESS_QUOTA_BLOCK *
QuotaBlock
0x02E0
0x0144struct _PAGEFAULT_HISTORY *
WorkingSetWatch
void *
LdtInformation
void *
Session
void *
Session
void *
Session
void *
Session
void *
Session
void *
Session
void *
Session
void *
Session
struct _PEB *
Peb
volatile uint64_t
OwnerProcessId
volatile uint64_t
OwnerProcessId
0x03F0
0x0144struct _PEB *
Peb
0x03F8
0x0148void *
Session
void *
Session
void *
Session
void *
Session
0x0230
0x0148uint64_t
Filler
void *
DeviceMap
void *
DeviceMap
0x0238
0x0148void *
Win32WindowStation
struct _HARDWARE_PTE_X86
PageDirectoryPte
void *
Session
void *
VdmObjects
void *
VdmObjects
struct _HANDLE_TABLE *
ObjectTable
struct _HANDLE_TABLE *
ObjectTable
struct _LIST_ENTRY
ActiveProcessLinks
void *
UniqueProcessId
void *
UniqueProcessId
0x02E8
0x0148void *
AweInfo
void *
AweInfo
void *
AweInfo
void *
AweInfo
void *
AweInfo
void *
AweInfo
void *
AweInfo
void *
AweInfo
void *
Session
struct _PEB *
Peb
struct _PEB *
Peb
0x03F8
0x0148void *
Session
0x0400
0x014Cvoid *
InheritedFromUniqueProcessId
uint8_t[16]
ImageFileName
uint8_t[16]
ImageFileName
uint8_t[16]
ImageFileName
uint8_t[16]
ImageFileName
unsigned long
ConsoleHostProcess
0x0238
0x014Cvoid *[3]
Spare0
void *[3]
Spare0
0x0240
0x014Cstruct _WOW64_PROCESS *
Wow64Process
uintptr_t
ConsoleHostProcess
uintptr_t
ConsoleHostProcess
0x02A8
0x014Cvoid *
DebugPort
void *
DebugPort
0x02F0
0x014Cstruct _EPROCESS_QUOTA_BLOCK *
QuotaBlock
struct _EPROCESS_QUOTA_BLOCK *
QuotaBlock
struct _EPROCESS_QUOTA_BLOCK *
QuotaBlock
struct _EPROCESS_QUOTA_BLOCK *
QuotaBlock
struct _EPROCESS_QUOTA_BLOCK *
QuotaBlock
struct _EPROCESS_QUOTA_BLOCK *
QuotaBlock
struct _EPROCESS_QUOTA_BLOCK *
QuotaBlock
struct _EPROCESS_QUOTA_BLOCK *
QuotaBlock
void *
AweInfo
void *
Session
void *
Session
0x0400
0x014Cstruct _EPROCESS_QUOTA_BLOCK *
QuotaBlock
void *
AweInfo
0x0408
0x0150void *
LdtInformation
void *
Session
void *
DeviceMap
void *
DeviceMap
void *
DeviceMap
void *
PaeTop
0x02B0
0x0150struct _HANDLE_TABLE *
ObjectTable
struct _HANDLE_TABLE *
ObjectTable
struct _HANDLE_TABLE *
ObjectTable
struct _HANDLE_TABLE *
ObjectTable
struct _HANDLE_TABLE *
ObjectTable
struct _HANDLE_TABLE *
ObjectTable
struct _HANDLE_TABLE *
ObjectTable
struct _HANDLE_TABLE *
ObjectTable
0x0408
0x0150struct _HANDLE_TABLE *
ObjectTable
struct _EPROCESS_QUOTA_BLOCK *
QuotaBlock
0x0410
0x0154void *
EtwDataSource
void *
EtwDataSource
0x02B8
0x0154void *
DeviceMap
void *
DeviceMap
union _LARGE_INTEGER
CreateTime
unsigned long
Flags2
unsigned long
Flags2
0x0300
0x0154void *
DebugPort
void *
DebugPort
void *
DebugPort
void *
DebugPort
void *
DebugPort
void *
DebugPort
void *
DebugPort
void *
DebugPort
0x0410
0x0154void *
VadFreeHint
uint8_t[16]
ImageFileName
void *
EtwDataSource
void *
Wow64Process
void *
Wow64Process
void *
Wow64Process
void *
Wow64Process
void *
DebugPort
struct _HANDLE_TABLE *
ObjectTable
0x0418
0x0158struct _HARDWARE_PTE_X86
PageDirectoryPte
struct _HARDWARE_PTE
PageDirectoryPte
0x0258
0x0158uint64_t
Filler
uint64_t
Filler
0x0258
0x0158void *
FreeTebHint
void *
FreeTebHint
0x02C0
0x0158void *
EtwDataSource
void *
EtwDataSource
0x0308
0x0158void *
VdmObjects
void *
FreeTebHint
void *
PaeTop
void *
PaeTop
void *
PaeTop
void *
PaeTop
void *
DebugPort
0x0420
0x015Cvoid *
DeviceMap
struct _LIST_ENTRY
JobLinks
struct _LIST_ENTRY
JobLinks
struct _LIST_ENTRY
JobLinks
struct _LIST_ENTRY
JobLinks
void *
PaeTop
0x0248
0x015Cvoid *
DeviceMap
void *
Wow64Process
void *
DebugPort
void *
DebugPort
0x0420
0x0160void *
Session
void *
Session
0x0260
0x0160struct _HARDWARE_PTE_X86
PageDirectoryPte
struct _HARDWARE_PTE
PageDirectoryPte
uint64_t
Filler
0x02C8
0x0160uint64_t
Filler
uint64_t
Filler
0x02C8
0x0160struct _HARDWARE_PTE_X86
PageDirectoryPte
struct _HARDWARE_PTE
PageDirectoryPte
0x0310
0x0160uint64_t
Filler
uint64_t
Filler
0x0310
0x0160struct _LIST_ENTRY
PhysicalVadList
struct _HARDWARE_PTE_X86
PageDirectoryPte
void *
EtwDataSource
void *
EtwDataSource
void *
EtwDataSource
void *
EtwDataSource
void *
EtwDataSource
void *
EtwDataSource
void *
EtwDataSource
void *
EtwDataSource
void *
DeviceMap
void *
Wow64Process
void *
Wow64Process
struct _EWOW64PROCESS *
WoW64Process
0x0428
0x0160void *
DeviceMap
0x0430
0x0164void *
LockedPagesList
void *
LockedPagesList
void *
LockedPagesList
void *
LockedPagesList
0x0258
0x0164uint8_t[16]
ImageFileName
uint8_t[16]
ImageFileName
0x0268
0x0164struct _LIST_ENTRY
JobLinks
void *
LockedPagesList
void *
EtwDataSource
0x0438
0x0168struct _HARDWARE_PTE_X86
PageDirectoryPte
struct _LIST_ENTRY
ThreadListHead
struct _LIST_ENTRY
ThreadListHead
struct _LIST_ENTRY
ThreadListHead
struct _LIST_ENTRY
ThreadListHead
void *
Session
0x0260
0x0168void *
Session
void *
Session
0x02D0
0x0168uint8_t[15]
ImageFileName
uint8_t[15]
ImageFileName
0x0318
0x0168uint64_t
PageDirectoryPte
uint64_t
PageDirectoryPte
uint64_t
PageDirectoryPte
uint64_t
PageDirectoryPte
uint64_t
PageDirectoryPte
uint64_t
PageDirectoryPte
uint64_t
PageDirectoryPte
uint64_t
PageDirectoryPte
void *
EtwDataSource
void *
DeviceMap
void *
DeviceMap
0x0430
0x0168uint64_t
Filler
uint8_t[15]
ImageFileName
uint64_t
PageDirectoryPte
uint64_t
PageDirectoryPte
uint64_t
PageDirectoryPte
0x0440
0x016Cvoid *
LockedPagesList
uint8_t[15]
ImageFileName
uint8_t[15]
ImageFileName
uint8_t[15]
ImageFileName
0x02D8
0x0170void *
SecurityPort
void *
SecurityPort
void *
SecurityPort
void *
SecurityPort
0x0270
0x0170void *
Session
struct _LIST_ENTRY
ThreadListHead
void *
SecurityPort
uint8_t[15]
ImageFileName
uint8_t[15]
ImageFileName
uint8_t[15]
ImageFileName
uint8_t[15]
ImageFileName
uint8_t[15]
ImageFileName
uint8_t[15]
ImageFileName
uint8_t[15]
ImageFileName
uint8_t[15]
ImageFileName
uint64_t
PageDirectoryPte
void *
EtwDataSource
void *
EtwDataSource
0x0438
0x0170uint8_t[15]
ImageFileName
uint8_t[15]
ImageFileName
0x0448
0x0174uint8_t[16]
ImageFileName
struct _LIST_ENTRY
JobLinks
struct _LIST_ENTRY
JobLinks
void *
PaeTop
void *
PaeTop
0x0278
0x0177uint8_t
PriorityClass
0x0327
0x0178volatile unsigned long
ActiveThreads
volatile unsigned long
ActiveThreads
volatile unsigned long
ActiveThreads
volatile unsigned long
ActiveThreads
0x0280
0x0178void *
SecurityPort
volatile unsigned long
ActiveThreads
void *
SecurityPort
void *
SecurityPort
0x0328
0x017Buint8_t
PriorityClass
0x02E7
0x017Cunsigned long
ImagePathHash
unsigned long
ImagePathHash
unsigned long
ImagePathHash
unsigned long
ImagePathHash
0x0284
0x017Cvoid *
PaeTop
void *
LockedPagesList
void *
LockedPagesList
unsigned long
ImagePathHash
struct _LIST_ENTRY
JobLinks
0x0288
0x017Cstruct _LIST_ENTRY
JobLinks
struct _LIST_ENTRY
JobLinks
0x02E8
0x017Cstruct _SE_AUDIT_PROCESS_CREATION_INFO
SeAuditProcessCreationInfo
struct _SE_AUDIT_PROCESS_CREATION_INFO
SeAuditProcessCreationInfo
0x0330
0x017Fuint8_t
PriorityClass
0x0447
uint8_t
PriorityClass
0x044F
0x017Fuint8_t
PriorityClass
0x0457
0x0180unsigned long
DefaultHardErrorProcessing
unsigned long
DefaultHardErrorProcessing
unsigned long
DefaultHardErrorProcessing
unsigned long
DefaultHardErrorProcessing
0x0288
0x0180struct _LIST_ENTRY
ThreadListHead
struct _LIST_ENTRY
ThreadListHead
0x0290
0x0180struct _LIST_ENTRY
JobLinks
struct _LIST_ENTRY
JobLinks
0x0338
0x0180unsigned long
ActiveThreads
unsigned long
DefaultHardErrorProcessing
void *
SecurityPort
void *
SecurityPort
void *
SecurityPort
void *
SecurityPort
void *
SecurityPort
void *
SecurityPort
void *
SecurityPort
void *
SecurityPort
uint8_t[15]
ImageFileName
struct _FILE_OBJECT *
ImageFilePointer
0x0448
0x0180struct _SE_AUDIT_PROCESS_CREATION_INFO
SeAuditProcessCreationInfo
void *
SecurityPort
0x0458
0x0184long
LastThreadExitStatus
long
LastThreadExitStatus
long
LastThreadExitStatus
long
LastThreadExitStatus
0x028C
0x0184struct _LIST_ENTRY
JobLinks
unsigned long
GrantedAccess
long
LastThreadExitStatus
void *
LockedPagesList
void *
LockedPagesList
void *
LockedPagesList
void *
Wow64Process
unsigned long
Flags2
0x02F8
0x0184struct _SE_AUDIT_PROCESS_CREATION_INFO
SeAuditProcessCreationInfo
0x0450
uint8_t
PriorityClass
0x045F
0x0184struct _SE_AUDIT_PROCESS_CREATION_INFO
SeAuditProcessCreationInfo
0x0460
0x0188struct _PEB *
Peb
struct _PEB *
Peb
struct _PEB *
Peb
struct _PEB *
Peb
0x0290
0x0188void *
SecurityPort
void *
SecurityPort
0x02A0
0x0188struct _LIST_ENTRY
ThreadListHead
struct _LIST_ENTRY
ThreadListHead
0x0300
0x0188unsigned long
DefaultHardErrorProcessing
struct _PEB *
Peb
struct _LIST_ENTRY
ThreadListHead
void *
HighestUserAddress
void *
HighestUserAddress
void *
ExceptionPortData
0x0348
0x0188struct _LIST_ENTRY
JobLinks
struct _LIST_ENTRY
JobLinks
struct _LIST_ENTRY
JobLinks
struct _LIST_ENTRY
JobLinks
struct _LIST_ENTRY
JobLinks
struct _LIST_ENTRY
JobLinks
struct _LIST_ENTRY
JobLinks
struct _LIST_ENTRY
JobLinks
0x0458
0x0188struct _LIST_ENTRY
JobLinks
struct _LIST_ENTRY
JobLinks
0x0468
0x018Cvoid *
LockedPagesList
long
LastThreadExitStatus
void *
PaeTop
struct _EX_FAST_REF
PrefetchTrace
struct _EX_FAST_REF
PrefetchTrace
struct _EX_FAST_REF
PrefetchTrace
struct _EX_FAST_REF
PrefetchTrace
0x0298
0x018Cstruct _LIST_ENTRY
ThreadListHead
struct _LIST_ENTRY
ThreadListHead
0x0350
0x0190union _LARGE_INTEGER
ReadOperationCount
union _LARGE_INTEGER
ReadOperationCount
union _LARGE_INTEGER
ReadOperationCount
union _LARGE_INTEGER
ReadOperationCount
0x02A0
0x0190struct _LIST_ENTRY
ThreadListHead
struct _PEB *
Peb
unsigned long
ActiveThreads
unsigned long
ActiveThreads
union _LARGE_INTEGER
ReadOperationCount
void *
SecurityPort
0x02B0
0x0190void *
SecurityPort
void *
SecurityPort
0x0310
0x0190void *
HighestUserAddress
void *
HighestUserAddress
void *
HighestUserAddress
void *
HighestUserAddress
void *
HighestUserAddress
void *
HighestUserAddress
void *
HighestUserAddress
void *
HighestUserAddress
0x0468
0x0190struct _LIST_ENTRY
ThreadListHead
void *
HighestUserAddress
0x0478
0x0194unsigned long
GrantedAccess
unsigned long
GrantedAccess
0x02B4
0x0194volatile unsigned long
ActiveThreads
volatile unsigned long
ActiveThreads
0x0360
0x0194struct _LIST_ENTRY
ThreadListHead
struct _LIST_ENTRY
ThreadListHead
struct _LIST_ENTRY
ThreadListHead
struct _LIST_ENTRY
ThreadListHead
struct _LIST_ENTRY
ThreadListHead
struct _LIST_ENTRY
ThreadListHead
struct _LIST_ENTRY
ThreadListHead
struct _LIST_ENTRY
ThreadListHead
0x0470
0x0194struct _EX_FAST_REF
PrefetchTrace
void *
PaeTop
void *
PaeTop
struct _LIST_ENTRY
ThreadListHead
struct _LIST_ENTRY
ThreadListHead
0x0480
0x0198union _LARGE_INTEGER
WriteOperationCount
union _LARGE_INTEGER
WriteOperationCount
union _LARGE_INTEGER
WriteOperationCount
union _LARGE_INTEGER
WriteOperationCount
0x02A8
0x0198void *
SecurityPort
union _LARGE_INTEGER
ReadOperationCount
unsigned long
DefaultHardErrorProcessing
unsigned long
DefaultHardErrorProcessing
union _LARGE_INTEGER
WriteOperationCount
volatile unsigned long
ActiveThreads
0x02B8
0x0198volatile unsigned long
ActiveThreads
volatile unsigned long
ActiveThreads
0x0320
0x0198unsigned long
ImagePathHash
0x0364
0x019Clong
LastThreadExitStatus
long
LastThreadExitStatus
0x02BC
0x019Cunsigned long
ImagePathHash
unsigned long
ImagePathHash
0x0324
0x019Cvoid *
PaeTop
unsigned long
ImagePathHash
unsigned long
DefaultHardErrorProcessing
unsigned long
DefaultHardErrorProcessing
0x0368
0x019Cvolatile unsigned long
ActiveThreads
volatile unsigned long
ActiveThreads
volatile unsigned long
ActiveThreads
volatile unsigned long
ActiveThreads
volatile unsigned long
ActiveThreads
volatile unsigned long
ActiveThreads
volatile unsigned long
ActiveThreads
volatile unsigned long
ActiveThreads
0x0480
0x019Cvolatile unsigned long
ActiveThreads
0x0490
0x01A0union _LARGE_INTEGER
OtherOperationCount
union _LARGE_INTEGER
OtherOperationCount
union _LARGE_INTEGER
OtherOperationCount
union _LARGE_INTEGER
OtherOperationCount
0x02B0
0x01A0struct _PEB *
Peb
struct _PEB *
Peb
0x02C0
0x01A0unsigned long
ActiveThreads
union _LARGE_INTEGER
WriteOperationCount
union _LARGE_INTEGER
OtherOperationCount
unsigned long
DefaultHardErrorProcessing
unsigned long
DefaultHardErrorProcessing
unsigned long
DefaultHardErrorProcessing
uint64_t
PeakVirtualSize
0x0328
0x01A0long
LastThreadExitStatus
long
LastThreadExitStatus
0x036C
0x01A0unsigned long
ImagePathHash
unsigned long
ImagePathHash
unsigned long
ImagePathHash
unsigned long
ImagePathHash
unsigned long
ImagePathHash
unsigned long
ImagePathHash
unsigned long
ImagePathHash
unsigned long
ImagePathHash
0x0484
0x01A0long
LastThreadExitStatus
unsigned long
ImagePathHash
0x0494
0x01A4struct _EX_FAST_REF
PrefetchTrace
struct _EX_FAST_REF
PrefetchTrace
0x02C8
0x01A4long
LastThreadExitStatus
long
LastThreadExitStatus
0x032C
0x01A4unsigned long
GrantedAccess
long
LastThreadExitStatus
struct _EX_FAST_REF
PrefetchTrace
struct _EX_FAST_REF
PrefetchTrace
struct _ETHREAD *
RotateInProgress
struct _EX_PUSH_LOCK
PageTableCommitmentLock
struct _EX_PUSH_LOCK
PageTableCommitmentLock
0x0370
0x01A4unsigned long
DefaultHardErrorProcessing
unsigned long
DefaultHardErrorProcessing
unsigned long
DefaultHardErrorProcessing
unsigned long
DefaultHardErrorProcessing
unsigned long
DefaultHardErrorProcessing
unsigned long
DefaultHardErrorProcessing
unsigned long
DefaultHardErrorProcessing
unsigned long
DefaultHardErrorProcessing
volatile unsigned long
ActiveThreads
struct _LIST_ENTRY
ThreadListHead
0x0488
0x01A4unsigned long
DefaultHardErrorProcessing
0x0498
0x01A8union _LARGE_INTEGER
ReadTransferCount
union _LARGE_INTEGER
ReadTransferCount
union _LARGE_INTEGER
ReadTransferCount
union _LARGE_INTEGER
ReadTransferCount
0x02B8
0x01A8union _LARGE_INTEGER
ReadOperationCount
union _LARGE_INTEGER
ReadOperationCount
0x02D0
0x01A8unsigned long
DefaultHardErrorProcessing
union _LARGE_INTEGER
OtherOperationCount
union _LARGE_INTEGER
ReadTransferCount
struct _PEB *
Peb
struct _PEB *
Peb
struct _PEB *
Peb
uint64_t
VirtualSize
uint64_t
PeakVirtualSize
uint64_t
PeakVirtualSize
0x0330
0x01A8struct _MM_AVL_TABLE *
LockedPagesList
struct _MM_AVL_TABLE *
LockedPagesList
0x0378
0x01A8long
LastThreadExitStatus
long
LastThreadExitStatus
long
LastThreadExitStatus
long
LastThreadExitStatus
long
LastThreadExitStatus
long
LastThreadExitStatus
long
LastThreadExitStatus
long
LastThreadExitStatus
unsigned long
ImagePathHash
0x048C
0x01A8long
LastThreadExitStatus
unsigned long
ImagePathHash
0x049C
0x01ACstruct _EX_FAST_REF
PrefetchTrace
struct _EX_FAST_REF
PrefetchTrace
struct _LIST_ENTRY
SessionProcessLinks
uint64_t
VirtualSize
uint64_t
VirtualSize
0x0338
0x01AClong
LastThreadExitStatus
struct _EX_FAST_REF
PrefetchTrace
struct _EX_FAST_REF
PrefetchTrace
struct _EX_FAST_REF
PrefetchTrace
struct _EX_FAST_REF
PrefetchTrace
struct _EX_FAST_REF
PrefetchTrace
struct _EX_FAST_REF
PrefetchTrace
struct _EX_FAST_REF
PrefetchTrace
struct _EX_FAST_REF
PrefetchTrace
struct _EX_FAST_REF
PrefetchTrace
unsigned long
DefaultHardErrorProcessing
volatile unsigned long
ActiveThreads
0x0490
0x01ACstruct _EX_FAST_REF
PrefetchTrace
0x04A0
0x01B0union _LARGE_INTEGER
WriteTransferCount
union _LARGE_INTEGER
WriteTransferCount
union _LARGE_INTEGER
WriteTransferCount
union _LARGE_INTEGER
WriteTransferCount
0x02C0
0x01B0union _LARGE_INTEGER
WriteOperationCount
union _LARGE_INTEGER
WriteOperationCount
0x02D8
0x01B0union _LARGE_INTEGER
ReadOperationCount
union _LARGE_INTEGER
ReadOperationCount
struct _LIST_ENTRY
SessionProcessLinks
struct _LIST_ENTRY
SessionProcessLinks
0x0340
0x01B0union _LARGE_INTEGER
ReadOperationCount
union _LARGE_INTEGER
ReadOperationCount
0x0380
0x01B0struct _PEB *
Peb
union _LARGE_INTEGER
ReadTransferCount
union _LARGE_INTEGER
WriteTransferCount
union _LARGE_INTEGER
ReadOperationCount
struct _MM_AVL_TABLE *
LockedPagesList
void *
LockedPagesList
struct _EX_FAST_REF
PrefetchTrace
unsigned long
DefaultHardErrorProcessing
volatile unsigned long
ActiveThreads
0x0498
long
LastThreadExitStatus
0x04A4
0x01B0void *
LockedPagesList
0x04A8
0x01B4struct _EX_FAST_REF
PrefetchTrace
0x01B8union _LARGE_INTEGER
OtherTransferCount
union _LARGE_INTEGER
OtherTransferCount
union _LARGE_INTEGER
OtherTransferCount
union _LARGE_INTEGER
OtherTransferCount
0x02C8
0x01B8union _LARGE_INTEGER
OtherOperationCount
union _LARGE_INTEGER
OtherOperationCount
0x02E0
0x01B8union _LARGE_INTEGER
ReadOperationCount
union _LARGE_INTEGER
WriteTransferCount
union _LARGE_INTEGER
OtherTransferCount
union _LARGE_INTEGER
WriteOperationCount
union _LARGE_INTEGER
WriteOperationCount
union _LARGE_INTEGER
WriteOperationCount
uint64_t
ExceptionPortValue
0x0348
0x01B8union _LARGE_INTEGER
WriteOperationCount
union _LARGE_INTEGER
WriteOperationCount
0x0388
0x01B8union _LARGE_INTEGER
ReadOperationCount
union _LARGE_INTEGER
ReadOperationCount
union _LARGE_INTEGER
ReadOperationCount
union _LARGE_INTEGER
ReadOperationCount
union _LARGE_INTEGER
ReadOperationCount
union _LARGE_INTEGER
ReadOperationCount
union _LARGE_INTEGER
ReadOperationCount
union _LARGE_INTEGER
ReadOperationCount
0x04A0
0x01B8union _LARGE_INTEGER
ReadOperationCount
0x04B0
0x01C0uintptr_t
CommitChargeLimit
uintptr_t
CommitChargeLimit
uintptr_t
CommitChargeLimit
uintptr_t
CommitChargeLimit
0x02D0
0x01C0union _LARGE_INTEGER
ReadTransferCount
union _LARGE_INTEGER
ReadTransferCount
0x02E8
0x01C0union _LARGE_INTEGER
WriteOperationCount
union _LARGE_INTEGER
OtherTransferCount
unsigned long
CommitChargeLimit
union _LARGE_INTEGER
OtherOperationCount
union _LARGE_INTEGER
OtherOperationCount
union _LARGE_INTEGER
OtherOperationCount
struct _EX_FAST_REF
Token
void *
ExceptionPortData
void *
ExceptionPortData
0x0350
0x01C0union _LARGE_INTEGER
OtherOperationCount
union _LARGE_INTEGER
OtherOperationCount
0x0390
0x01C0union _LARGE_INTEGER
WriteOperationCount
union _LARGE_INTEGER
WriteOperationCount
union _LARGE_INTEGER
WriteOperationCount
union _LARGE_INTEGER
WriteOperationCount
union _LARGE_INTEGER
WriteOperationCount
union _LARGE_INTEGER
WriteOperationCount
union _LARGE_INTEGER
WriteOperationCount
union _LARGE_INTEGER
WriteOperationCount
union _LARGE_INTEGER
ReadOperationCount
void *
LockedPagesList
struct _EX_FAST_REF
PrefetchTrace
0x04A8
0x01C0union _LARGE_INTEGER
OtherOperationCount
union _LARGE_INTEGER
WriteOperationCount
union _LARGE_INTEGER
WriteOperationCount
union _LARGE_INTEGER
WriteOperationCount
union _LARGE_INTEGER
ReadOperationCount
0x04B8
0x01C4volatile unsigned long
CommitChargePeak
volatile uint64_t
CommitChargePeak
volatile unsigned long
CommitChargePeak
volatile uint64_t
CommitChargePeak
0x02D8
0x01C8void *
AweInfo
void *
AweInfo
void *
AweInfo
void *
AweInfo
void *
UniqueProcessId
struct _EX_RUNDOWN_REF
RundownProtect
struct _EX_RUNDOWN_REF
RundownProtect
0x02E0
0x01C8union _LARGE_INTEGER
WriteTransferCount
union _LARGE_INTEGER
WriteTransferCount
0x02F0
0x01C8union _LARGE_INTEGER
OtherOperationCount
unsigned long
CommitChargeLimit
void *
AweInfo
union _LARGE_INTEGER
ReadTransferCount
union _LARGE_INTEGER
ReadTransferCount
union _LARGE_INTEGER
ReadTransferCount
uint64_t
WorkingSetPage
struct _EX_FAST_REF
Token
struct _EX_FAST_REF
Token
0x0358
0x01C8union _LARGE_INTEGER
ReadTransferCount
union _LARGE_INTEGER
ReadTransferCount
0x0398
0x01C8union _LARGE_INTEGER
OtherOperationCount
union _LARGE_INTEGER
OtherOperationCount
union _LARGE_INTEGER
OtherOperationCount
union _LARGE_INTEGER
OtherOperationCount
union _LARGE_INTEGER
OtherOperationCount
union _LARGE_INTEGER
OtherOperationCount
union _LARGE_INTEGER
OtherOperationCount
union _LARGE_INTEGER
OtherOperationCount
0x04B0
0x01C8union _LARGE_INTEGER
ReadTransferCount
union _LARGE_INTEGER
OtherOperationCount
union _LARGE_INTEGER
OtherOperationCount
union _LARGE_INTEGER
OtherOperationCount
union _LARGE_INTEGER
WriteOperationCount
0x04C0
0x01CCunsigned long
CommitChargePeak
struct _SE_AUDIT_PROCESS_CREATION_INFO
SeAuditProcessCreationInfo
0x02E8
0x01D0struct _MMSUPPORT
Vm
struct _MMSUPPORT
Vm
struct _MMSUPPORT
Vm
struct _MMSUPPORT
Vm
0x02F0
0x01D0union _LARGE_INTEGER
OtherTransferCount
union _LARGE_INTEGER
OtherTransferCount
0x02F8
0x01D0union _LARGE_INTEGER
WriteTransferCount
union _LARGE_INTEGER
WriteTransferCount
struct _EX_PUSH_LOCK
AddressCreationLock
uint64_t
WorkingSetPage
uint64_t
WorkingSetPage
0x0360
0x01D0union _LARGE_INTEGER
ReadTransferCount
void *
AweInfo
struct _MMSUPPORT
Vm
union _LARGE_INTEGER
WriteTransferCount
union _LARGE_INTEGER
WriteTransferCount
void *
Win32Process
volatile uint64_t
NumberOfLockedPages
volatile uint64_t
NumberOfLockedPages
0x03A0
0x01D0union _LARGE_INTEGER
ReadTransferCount
union _LARGE_INTEGER
ReadTransferCount
union _LARGE_INTEGER
ReadTransferCount
union _LARGE_INTEGER
ReadTransferCount
union _LARGE_INTEGER
ReadTransferCount
union _LARGE_INTEGER
ReadTransferCount
union _LARGE_INTEGER
ReadTransferCount
union _LARGE_INTEGER
ReadTransferCount
0x04B8
0x01D0union _LARGE_INTEGER
ReadTransferCount
0x04C8
0x01D4struct _SE_AUDIT_PROCESS_CREATION_INFO
SeAuditProcessCreationInfo
0x01D8uintptr_t
CommitChargeLimit
uintptr_t
CommitChargeLimit
0x0300
0x01D8union _LARGE_INTEGER
WriteTransferCount
struct _MMSUPPORT
Vm
union _LARGE_INTEGER
OtherTransferCount
union _LARGE_INTEGER
OtherTransferCount
union _LARGE_INTEGER
OtherTransferCount
struct _EX_PUSH_LOCK
PageTableCommitmentLock
struct _EX_PUSH_LOCK
AddressCreationLock
struct _EX_PUSH_LOCK
AddressCreationLock
0x0368
0x01D8union _LARGE_INTEGER
OtherTransferCount
union _LARGE_INTEGER
OtherTransferCount
0x03A8
0x01D8union _LARGE_INTEGER
WriteTransferCount
union _LARGE_INTEGER
WriteTransferCount
union _LARGE_INTEGER
WriteTransferCount
union _LARGE_INTEGER
WriteTransferCount
union _LARGE_INTEGER
WriteTransferCount
union _LARGE_INTEGER
WriteTransferCount
union _LARGE_INTEGER
WriteTransferCount
union _LARGE_INTEGER
WriteTransferCount
0x04C0
0x01D8union _LARGE_INTEGER
WriteTransferCount
union _LARGE_INTEGER
WriteTransferCount
0x04D0
0x01DCuintptr_t
CommitChargePeak
0x0308
0x01E0void *
AweInfo
void *
AweInfo
0x0310
0x01E0uintptr_t
CommitChargeLimit
uintptr_t
CommitChargeLimit
0x0370
0x01E0uintptr_t
CommitChargeLimit
uintptr_t
CommitChargeLimit
void *
SectionObject
struct _EJOB * volatile
Job
struct _EJOB * volatile
Job
0x03B0
0x01E0union _LARGE_INTEGER
OtherTransferCount
unsigned long
CommitChargeLimit
union _LARGE_INTEGER
OtherTransferCount
union _LARGE_INTEGER
OtherTransferCount
union _LARGE_INTEGER
OtherTransferCount
union _LARGE_INTEGER
OtherTransferCount
union _LARGE_INTEGER
OtherTransferCount
union _LARGE_INTEGER
OtherTransferCount
union _LARGE_INTEGER
OtherTransferCount
union _LARGE_INTEGER
OtherTransferCount
union _LARGE_INTEGER
WriteTransferCount
union _LARGE_INTEGER
ReadTransferCount
union _LARGE_INTEGER
OtherOperationCount
0x04C8
0x01E0uint64_t
CommitChargeLimit
union _LARGE_INTEGER
OtherTransferCount
union _LARGE_INTEGER
OtherTransferCount
union _LARGE_INTEGER
OtherTransferCount
union _LARGE_INTEGER
WriteTransferCount
0x04D8
0x01E4struct _SE_AUDIT_PROCESS_CREATION_INFO
SeAuditProcessCreationInfo
struct _SE_AUDIT_PROCESS_CREATION_INFO
SeAuditProcessCreationInfo
void *
Wow64Process
volatile unsigned long
CommitChargePeak
uint64_t[2]
ProcessQuotaPeak
0x0318
0x01E4unsigned long[2]
Spares
volatile unsigned long
CommitChargePeak
volatile uint64_t
CommitChargePeak
struct _ETHREAD *
ForkInProgress
struct _ETHREAD *
RotateInProgress
struct _ETHREAD *
RotateInProgress
0x0378
0x01E4volatile unsigned long
CommitCharge
volatile uint64_t
CommitCharge
void *
SectionBaseAddress
void *
SectionObject
void *
SectionObject
0x03B8
0x01E8struct _MMSUPPORT
Vm
struct _MMSUPPORT
Vm
0x0320
0x01E8void *
AweInfo
void *
AweInfo
struct _EJOB * volatile
CommitChargeJob
struct _ETHREAD *
ForkInProgress
struct _ETHREAD *
ForkInProgress
0x0380
0x01E8volatile unsigned long
CommitChargePeak
volatile uint64_t
CommitChargePeak
unsigned long
Cookie
void *
SectionBaseAddress
void *
SectionBaseAddress
0x03C0
0x01E8uintptr_t
CommitChargeLimit
uintptr_t
CommitChargeLimit
uintptr_t
CommitChargeLimit
uintptr_t
CommitChargeLimit
volatile unsigned long
CommitCharge
volatile uint64_t
CommitCharge
volatile unsigned long
CommitCharge
volatile uint64_t
CommitCharge
0x04D0
0x01E8uintptr_t
CommitChargeLimit
void *
AweInfo
volatile uint64_t
CommitCharge
uintptr_t
CommitChargeLimit
union _LARGE_INTEGER
OtherTransferCount
0x04E0
0x01ECstruct _SE_AUDIT_PROCESS_CREATION_INFO
SeAuditProcessCreationInfo
struct _SE_AUDIT_PROCESS_CREATION_INFO
SeAuditProcessCreationInfo
0x0388
0x01ECstruct _MMSUPPORT
Vm
struct _MMSUPPORT
Vm
0x03C8
0x01ECvolatile unsigned long
CommitCharge
volatile uint64_t
CommitCharge
volatile unsigned long
CommitCharge
volatile uint64_t
CommitCharge
struct _MMSUPPORT
Vm
struct _MMSUPPORT
Vm
struct _MMSUPPORT
Vm
struct _MMSUPPORT
Vm
0x04D8
0x01ECunsigned long
CommitChargePeak
struct _SE_AUDIT_PROCESS_CREATION_INFO
SeAuditProcessCreationInfo
volatile uint64_t
CommitChargePeak
volatile uint64_t
CommitCharge
volatile unsigned long
CommitCharge
volatile uint64_t
CommitCharge
uint64_t
CommitChargeLimit
0x04E8
0x01F0struct _MMSUPPORT
Vm
struct _MMSUPPORT
Vm
volatile uint64_t
NumberOfPrivatePages
struct _RTL_AVL_TREE
CloneRoot
struct _RTL_AVL_TREE
CloneRoot
0x0390
0x01F0volatile unsigned long
CommitChargePeak
volatile uint64_t
CommitChargePeak
volatile unsigned long
CommitChargePeak
volatile uint64_t
CommitChargePeak
0x04E0
0x01F0void *
AweInfo
struct _MMSUPPORT
Vm
struct _MMSUPPORT
Vm
volatile uint64_t
CommitChargePeak
volatile unsigned long
CommitChargePeak
volatile uint64_t
CommitChargePeak
volatile uint64_t
CommitCharge
0x04F0
0x01F4struct _MMSUPPORT
Vm
struct _MMSUPPORT
Vm
struct _MMSUPPORT
Vm
struct _MMSUPPORT
Vm
0x04E8
0x01F4struct _SE_AUDIT_PROCESS_CREATION_INFO
SeAuditProcessCreationInfo
struct _INVERTED_FUNCTION_TABLE *
InvertedFunctionTable
struct _MMSUPPORT
Vm
struct _MMSUPPORT
Vm
struct _MMSUPPORT
Vm
volatile uint64_t
CommitChargePeak
0x04F8
0x01F8struct _MMSUPPORT
Vm
0x0218struct _LIST_ENTRY
MmProcessLinks
0x0358
0x0220unsigned long
ModifiedPageCount
0x0368
0x0224unsigned long
Flags2
0x036C
0x0224:0x00unsigned long
JobNotReallyActive
0x036C:0x00
0x0224:0x01unsigned long
AccountingFolded
0x036C:0x01
0x0224:0x02unsigned long
NewProcessReported
0x036C:0x02
0x0224:0x03unsigned long
ExitProcessReported
0x036C:0x03
0x0224:0x04unsigned long
ReportCommitChanges
0x036C:0x04
0x0224:0x05unsigned long
LastReportMemory
0x036C:0x05
0x0224:0x06unsigned long
ReportPhysicalPageChanges
0x036C:0x06
0x0224:0x07unsigned long
HandleTableRundown
0x036C:0x07
0x0224:0x08unsigned long
NeedsHandleRundown
0x036C:0x08
0x0224:0x09unsigned long
RefTraceEnabled
0x036C:0x09
0x0224:0x0Aunsigned long
NumaAware
0x036C:0x0A
0x0224:0x0Bunsigned long
ProtectedProcess
0x036C:0x0B
0x0224:0x0Cunsigned long
DefaultPagePriority
0x036C:0x0C
0x0224:0x0Funsigned long
PrimaryTokenFrozen
0x036C:0x0F
0x0224:0x10unsigned long
ProcessVerifierTarget
0x036C:0x10
0x0224:0x11unsigned long
StackRandomizationDisabled
0x036C:0x11
0x0224:0x12unsigned long
AffinityPermanent
0x036C:0x12
0x0224:0x13unsigned long
AffinityUpdateEnable
0x036C:0x13
0x0224:0x14unsigned long
CrossSessionCreate
0x036C:0x14
0x0224:0x15unsigned long
LowVaAccessible
0x036C:0x15
0x0228unsigned long
Flags
0x0370
0x0228:0x00unsigned long
CreateReported
0x0370:0x00
0x0228:0x01unsigned long
NoDebugInherit
0x0370:0x01
0x0228:0x02unsigned long
ProcessExiting
0x0370:0x02
0x0228:0x03unsigned long
ProcessDelete
0x0370:0x03
0x0228:0x04unsigned long
Wow64SplitPages
0x0370:0x04
0x0228:0x05unsigned long
VmDeleted
0x0370:0x05
0x0228:0x06unsigned long
OutswapEnabled
0x0370:0x06
0x0228:0x07unsigned long
Outswapped
0x0370:0x07
0x0228:0x08unsigned long
ForkFailed
0x0370:0x08
0x0228:0x09unsigned long
Wow64VaSpace4Gb
0x0370:0x09
0x0228:0x0Aunsigned long
AddressSpaceInitialized
0x0370:0x0A
0x0228:0x0Cunsigned long
SetTimerResolution
0x0370:0x0C
0x0228:0x0Dunsigned long
BreakOnTermination
0x0370:0x0D
0x0228:0x0Eunsigned long
DeprioritizeViews
0x0370:0x0E
0x0228:0x0Funsigned long
WriteWatch
0x0370:0x0F
0x0228:0x10unsigned long
ProcessInSession
0x0370:0x10
0x0228:0x11unsigned long
OverrideAddressSpace
0x0370:0x11
0x0228:0x12unsigned long
HasAddressSpace
0x0370:0x12
0x0228:0x13unsigned long
LaunchPrefetched
0x0370:0x13
0x0228:0x14unsigned long
InjectInpageErrors
0x0370:0x14
0x0228:0x15unsigned long
VmTopDown
0x0370:0x15
0x0228:0x16unsigned long
ImageNotifyDone
0x0370:0x16
0x0228:0x17unsigned long
PdeUpdateNeeded
0x0370:0x17
0x0228:0x18unsigned long
VdmAllowed
0x0370:0x18
0x0228:0x19unsigned long
SmapAllowed
0x0370:0x19
0x0228:0x1Aunsigned long
ProcessInserted
0x0370:0x1A
0x0228:0x1Bunsigned long
DefaultIoPriority
0x0370:0x1B
0x0228:0x1Eunsigned long
SparePsFlags1
unsigned long
ProcessSelfDelete
0x0370:0x1E
0x0228:0x1Funsigned long
SpareProcessFlags
0x0370:0x1F
0x022Clong
ExitStatus
0x0374
0x0230struct _LIST_ENTRY
MmProcessLinks
uint16_t
Spare7
0x0378
0x0232uint8_t
SubSystemMinorVersion
0x037A
0x0232uint16_t
SubSystemVersion
0x037A
0x0233uint8_t
SubSystemMajorVersion
0x037B
0x0234uint8_t
PriorityClass
0x037C
0x0238unsigned long
LastFaultCount
struct _LIST_ENTRY
MmProcessLinks
unsigned long
ModifiedPageCount
struct _MM_AVL_TABLE
VadRoot
0x0380
0x023Cunsigned long
ModifiedPageCount
unsigned long
JobStatus
0x0384
0x0240unsigned long
NumberOfVads
unsigned long
ModifiedPageCount
unsigned long
Flags
struct _RTL_AVL_TREE
CloneRoot
struct _EJOB * volatile
CommitChargeJob
struct _EJOB * volatile
CommitChargeJob
0x0388
0x0240:0x00unsigned long
CreateReported
0x0388:0x00
0x0240:0x01unsigned long
NoDebugInherit
0x0388:0x01
0x0240:0x02unsigned long
ProcessExiting
0x0388:0x02
0x0240:0x03unsigned long
ProcessDelete
0x0388:0x03
0x0240:0x04unsigned long
Wow64SplitPages
0x0388:0x04
0x0240:0x05unsigned long
VmDeleted
0x0388:0x05
0x0240:0x06unsigned long
OutswapEnabled
0x0388:0x06
0x0240:0x07unsigned long
Outswapped
0x0388:0x07
0x0240:0x08unsigned long
ForkFailed
0x0388:0x08
0x0240:0x09unsigned long
Wow64VaSpace4Gb
0x0388:0x09
0x0240:0x0Aunsigned long
AddressSpaceInitialized
0x0388:0x0A
0x0240:0x0Cunsigned long
SetTimerResolution
0x0388:0x0C
0x0240:0x0Dunsigned long
BreakOnTermination
0x0388:0x0D
0x0240:0x0Eunsigned long
SessionCreationUnderway
0x0388:0x0E
0x0240:0x0Funsigned long
WriteWatch
0x0388:0x0F
0x0240:0x10unsigned long
ProcessInSession
0x0388:0x10
0x0240:0x11unsigned long
OverrideAddressSpace
0x0388:0x11
0x0240:0x12unsigned long
HasAddressSpace
0x0388:0x12
0x0240:0x13unsigned long
LaunchPrefetched
0x0388:0x13
0x0240:0x14unsigned long
InjectInpageErrors
0x0388:0x14
0x0240:0x15unsigned long
VmTopDown
0x0388:0x15
0x0240:0x16unsigned long
ImageNotifyDone
0x0388:0x16
0x0240:0x17unsigned long
PdeUpdateNeeded
0x0388:0x17
0x0240:0x18unsigned long
VdmAllowed
0x0388:0x18
0x0240:0x19unsigned long
SmapAllowed
0x0388:0x19
0x0240:0x1Aunsigned long
CreateFailed
0x0388:0x1A
0x0240:0x1Bunsigned long
DefaultIoPriority
0x0388:0x1B
0x0240:0x1Eunsigned long
Spare1
0x0388:0x1E
0x0240:0x1Funsigned long
Spare2
0x0388:0x1F
0x0244unsigned long
JobStatus
long
ExitStatus
0x038C
0x0248unsigned long
Flags
uint16_t
NextPageColor
0x0390
0x0248:0x00unsigned long
CreateReported
0x0248:0x01unsigned long
NoDebugInherit
0x0248:0x02unsigned long
ProcessExiting
0x0248:0x03unsigned long
ProcessDelete
0x0248:0x04unsigned long
Wow64SplitPages
0x0248:0x05unsigned long
VmDeleted
0x0248:0x06unsigned long
OutswapEnabled
0x0248:0x07unsigned long
Outswapped
0x0248:0x08unsigned long
ForkFailed
0x0248:0x09unsigned long
HasPhysicalVad
unsigned long
Wow64VaSpace4Gb
0x0248:0x0Aunsigned long
AddressSpaceInitialized
0x0248:0x0Cunsigned long
SetTimerResolution
0x0248:0x0Dunsigned long
BreakOnTermination
0x0248:0x0Eunsigned long
SessionCreationUnderway
0x0248:0x0Funsigned long
WriteWatch
0x024Aunsigned long
ProcessInSession
uint8_t
SubSystemMinorVersion
0x0392
0x024Auint16_t
SubSystemVersion
0x0392
0x0248:0x11unsigned long
OverrideAddressSpace
0x0248:0x12unsigned long
HasAddressSpace
0x0248:0x13unsigned long
LaunchPrefetched
0x0248:0x14unsigned long
InjectInpageErrors
0x0248:0x15unsigned long
Unused
unsigned long
VmTopDown
0x0248:0x16unsigned long
Unused3
unsigned long
ImageNotifyDone
0x0248:0x17unsigned long
Unused4
unsigned long
PdeUpdateNeeded
0x024Bunsigned long
VdmAllowed
uint8_t
SubSystemMajorVersion
0x0393
0x0248:0x19unsigned long
Unused
unsigned long
Unused
0x0248:0x1Eunsigned long
Unused1
0x0248:0x1Funsigned long
Unused2
0x024Clong
ExitStatus
uint8_t
PriorityClass
0x0394
0x0250uint16_t
NextPageColor
struct _MM_AVL_TABLE
VadRoot
struct _MM_AVL_TABLE
VadRoot
volatile uint64_t
NumberOfLockedPages
volatile uint64_t
NumberOfPrivatePages
volatile uint64_t
NumberOfPrivatePages
0x0398
0x0252uint8_t
SubSystemMinorVersion
0x0252uint16_t
SubSystemVersion
0x0253uint8_t
SubSystemMajorVersion
0x0254uint8_t
PriorityClass
0x0255uint8_t
WorkingSetAcquiredUnsafe
0x0258unsigned long
Cookie
unsigned long
Cookie
unsigned long
Cookie
unsigned long
Cookie
0x03C0
0x0258unsigned long
Cookie
struct _MM_AVL_TABLE
VadRoot
unsigned long
Cookie
struct _LIST_ENTRY
MmProcessLinks
struct _LIST_ENTRY
MmProcessLinks
void *
SecurityPort
uint8_t[15]
ImageFileName
0x0450
0x025Cstruct _ALPC_PROCESS_CONTEXT
AlpcContext
struct _ALPC_PROCESS_CONTEXT
AlpcContext
struct _ALPC_PROCESS_CONTEXT
AlpcContext
struct _ALPC_PROCESS_CONTEXT
AlpcContext
0x03C8
0x025Cstruct _ALPC_PROCESS_CONTEXT
AlpcContext
struct _LIST_ENTRY
MmProcessLinks
struct _LIST_ENTRY
MmProcessLinks
struct _LIST_ENTRY
MmProcessLinks
0x0418
0x0260unsigned long
ModifiedPageCount
struct _LIST_ENTRY
JobLinks
struct _SE_AUDIT_PROCESS_CREATION_INFO
SeAuditProcessCreationInfo
void *
SecurityPort
0x0460
0x0264void *
HighestUserAddress
void *
HighestUserAddress
0x0428
0x0264void *
HighestUserAddress
unsigned long
Flags2
0x0464
0x0264:0x00unsigned long
JobNotReallyActive
0x0464:0x00
struct _EX_PUSH_LOCK
InvertedFunctionTableLock
struct _MMSUPPORT
Vm
0x0500
0x0264struct _LIST_ENTRY
MmProcessLinks
struct _LIST_ENTRY
MmProcessLinks
0x0578
0x0264struct _LIST_ENTRY
MmProcessLinks
struct _LIST_ENTRY
MmProcessLinks
struct _LIST_ENTRY
MmProcessLinks
struct _LIST_ENTRY
MmProcessLinks
struct _LIST_ENTRY
MmProcessLinks
struct _LIST_ENTRY
MmProcessLinks
0x05C0
0x0264:0x01unsigned long
AccountingFolded
0x0464:0x01
0x0264:0x02unsigned long
NewProcessReported
0x0464:0x02
0x0264:0x03unsigned long
ExitProcessReported
0x0464:0x03
0x0264:0x04unsigned long
ReportCommitChanges
0x0464:0x04
0x0264:0x05unsigned long
LastReportMemory
0x0464:0x05
0x0264:0x06unsigned long
Spare1
0x0464:0x06
0x0264:0x07unsigned long
HandleTableRundown
0x0464:0x07
0x0264:0x08unsigned long
NeedsHandleRundown
0x0464:0x08
0x0264:0x09unsigned long
RefTraceEnabled
0x0464:0x09
0x0264:0x0Aunsigned long
NumaAware
0x0464:0x0A
0x0264:0x0Bunsigned long
Spare2
0x0464:0x0B
0x0264:0x0Cunsigned long
DefaultPagePriority
0x0464:0x0C
0x0264:0x0Funsigned long
PrimaryTokenFrozen
0x0464:0x0F
0x0264:0x10unsigned long
ProcessVerifierTarget
0x0464:0x10
0x0264:0x11unsigned long
StackRandomizationDisabled
0x0464:0x11
0x0264:0x12unsigned long
AffinityPermanent
0x0464:0x12
0x0264:0x13unsigned long
AffinityUpdateEnable
0x0464:0x13
0x0264:0x14unsigned long
PropagateNode
0x0464:0x14
0x0264:0x15unsigned long
ExplicitAffinity
0x0464:0x15
0x0264:0x16unsigned long
LowVaAccessible
0x0464:0x16
0x0264:0x17unsigned long
ForceRelocateImages
0x0464:0x17
0x0264:0x18unsigned long
DisallowStrippedImages
0x0464:0x18
0x0264:0x19unsigned long
HighEntropyASLREnabled
0x0464:0x19
0x0264:0x1Aunsigned long
ForceStackCheck
0x0464:0x1A
0x0264:0x1Bunsigned long
ProcessDeepFrozen
0x0464:0x1B
0x0264:0x1Cunsigned long
ProcessDeepFreezeRequest
0x0464:0x1C
0x0264:0x1Dunsigned long
ProcessDeepFreezeInProgress
0x0464:0x1D
0x0264:0x1Eunsigned long
DisallowWin32kSystemCalls
0x0464:0x1E
0x0264:0x1Funsigned long
SpareBits
0x0464:0x1F
0x0268unsigned long
ModifiedPageCount
unsigned long
ModifiedPageCount
0x0430
0x0268unsigned long
ModifiedPageCount
unsigned long
Flags
struct _LIST_ENTRY
JobLinks
struct _SE_AUDIT_PROCESS_CREATION_INFO
SeAuditProcessCreationInfo
0x0468
0x0268:0x00unsigned long
CreateReported
0x0468:0x00
0x0268:0x01unsigned long
NoDebugInherit
0x0468:0x01
0x0268:0x02unsigned long
ProcessExiting
0x0468:0x02
0x0268:0x03unsigned long
ProcessDelete
0x0468:0x03
0x0268:0x04unsigned long
Wow64SplitPages
0x0468:0x04
0x0268:0x05unsigned long
VmDeleted
0x0468:0x05
0x0268:0x06unsigned long
OutswapEnabled
0x0468:0x06
0x0268:0x07unsigned long
Outswapped
0x0468:0x07
0x0268:0x08unsigned long
ForkFailed
0x0468:0x08
0x0268:0x09unsigned long
Wow64VaSpace4Gb
0x0468:0x09
0x0268:0x0Aunsigned long
AddressSpaceInitialized
0x0468:0x0A
0x0268:0x0Cunsigned long
SetTimerResolution
0x0468:0x0C
0x0268:0x0Dunsigned long
BreakOnTermination
0x0468:0x0D
0x0268:0x0Eunsigned long
DeprioritizeViews
0x0468:0x0E
0x0268:0x0Funsigned long
WriteWatch
0x0468:0x0F
0x0268:0x10unsigned long
ProcessInSession
0x0468:0x10
0x0268:0x11unsigned long
OverrideAddressSpace
0x0468:0x11
0x0268:0x12unsigned long
HasAddressSpace
0x0468:0x12
0x0268:0x13unsigned long
LaunchPrefetched
0x0468:0x13
0x0268:0x14unsigned long
InjectInpageErrors
0x0468:0x14
0x0268:0x15unsigned long
VmTopDown
0x0468:0x15
0x0268:0x16unsigned long
ImageNotifyDone
0x0468:0x16
0x0268:0x17unsigned long
PdeUpdateNeeded
0x0468:0x17
0x0268:0x18unsigned long
VdmAllowed
0x0468:0x18
0x0268:0x19unsigned long
CrossSessionCreate
0x0468:0x19
0x0268:0x1Aunsigned long
ProcessInserted
0x0468:0x1A
0x0268:0x1Bunsigned long
DefaultIoPriority
0x0468:0x1B
0x0268:0x1Eunsigned long
ProcessSelfDelete
0x0468:0x1E
0x0268:0x1Funsigned long
SetTimerResolutionLink
0x0468:0x1F
0x026Cunsigned long
Flags2
unsigned long
JobNotReallyActive
0x0434
0x026C:0x00unsigned long
JobNotReallyActive
unsigned long
JobNotReallyActive
0x0434:0x00
0x026Cunsigned long
Flags2
long
ExitStatus
long
ExitStatus
0x046C
0x026Cunsigned long
ModifiedPageCount
unsigned long
ModifiedPageCount
0x0588
0x026Cunsigned long
ModifiedPageCount
unsigned long
ModifiedPageCount
unsigned long
ModifiedPageCount
unsigned long
ModifiedPageCount
unsigned long
ModifiedPageCount
unsigned long
ModifiedPageCount
0x05D0
0x026C:0x01unsigned long
AccountingFolded
0x0434:0x01
0x026C:0x02unsigned long
NewProcessReported
0x0434:0x02
0x026C:0x03unsigned long
ExitProcessReported
0x0434:0x03
0x026C:0x04unsigned long
ReportCommitChanges
0x0434:0x04
0x026C:0x05unsigned long
LastReportMemory
0x0434:0x05
0x026C:0x06unsigned long
ReportPhysicalPageChanges
0x0434:0x06
0x026C:0x07unsigned long
HandleTableRundown
0x0434:0x07
0x026C:0x08unsigned long
NeedsHandleRundown
0x0434:0x08
0x026C:0x09unsigned long
RefTraceEnabled
0x0434:0x09
0x026C:0x0Aunsigned long
NumaAware
0x0434:0x0A
0x026C:0x0Bunsigned long
ProtectedProcess
0x0434:0x0B
0x026C:0x0Cunsigned long
DefaultPagePriority
0x0434:0x0C
0x026C:0x0Funsigned long
PrimaryTokenFrozen
0x0434:0x0F
0x026C:0x10unsigned long
ProcessVerifierTarget
0x0434:0x10
0x026C:0x11unsigned long
StackRandomizationDisabled
0x0434:0x11
0x026C:0x12unsigned long
AffinityPermanent
0x0434:0x12
0x026C:0x13unsigned long
AffinityUpdateEnable
0x0434:0x13
0x026C:0x14unsigned long
PropagateNode
0x0434:0x14
0x026C:0x15unsigned long
ExplicitAffinity
0x0434:0x15
0x026C:0x16unsigned long
Spare1
0x0434:0x16
0x026C:0x17unsigned long
ForceRelocateImages
0x0434:0x17
0x026C:0x18unsigned long
DisallowStrippedImages
0x0434:0x18
0x026C:0x19unsigned long
LowVaAccessible
0x0270unsigned long
Cookie
unsigned long
Cookie
unsigned long
Flags
void *
InheritedFromUniqueProcessId
void *
Win32WindowStation
void *
Win32WindowStation
0x03D8
0x0270unsigned long
Flags
unsigned long
CreateReported
0x0438
0x0270:0x00unsigned long
CreateReported
unsigned long
CreateReported
0x0438:0x00
0x0270struct _MM_AVL_TABLE
VadRoot
struct _MM_AVL_TABLE
VadRoot
void *
HighestUserAddress
struct _LIST_ENTRY
JobLinks
0x0470
0x0270long
ExitStatus
long
ExitStatus
0x058C
0x0270long
ExitStatus
long
ExitStatus
long
ExitStatus
long
ExitStatus
long
ExitStatus
long
ExitStatus
0x05D4
0x0270:0x01unsigned long
NoDebugInherit
0x0438:0x01
0x0270:0x02unsigned long
ProcessExiting
0x0438:0x02
0x0270:0x03unsigned long
ProcessDelete
0x0438:0x03
0x0270:0x04unsigned long
Wow64SplitPages
0x0438:0x04
0x0270:0x05unsigned long
VmDeleted
0x0438:0x05
0x0270:0x06unsigned long
OutswapEnabled
0x0438:0x06
0x0270:0x07unsigned long
Outswapped
0x0438:0x07
0x0270:0x08unsigned long
ForkFailed
0x0438:0x08
0x0270:0x09unsigned long
Wow64VaSpace4Gb
0x0438:0x09
0x0270:0x0Aunsigned long
AddressSpaceInitialized
0x0438:0x0A
0x0270:0x0Cunsigned long
SetTimerResolution
0x0438:0x0C
0x0270:0x0Dunsigned long
BreakOnTermination
0x0438:0x0D
0x0270:0x0Eunsigned long
DeprioritizeViews
0x0438:0x0E
0x0270:0x0Funsigned long
WriteWatch
0x0438:0x0F
0x0270:0x10unsigned long
ProcessInSession
0x0438:0x10
0x0270:0x11unsigned long
OverrideAddressSpace
0x0438:0x11
0x0270:0x12unsigned long
HasAddressSpace
0x0438:0x12
0x0270:0x13unsigned long
LaunchPrefetched
0x0438:0x13
0x0270:0x14unsigned long
InjectInpageErrors
0x0438:0x14
0x0270:0x15unsigned long
VmTopDown
0x0438:0x15
0x0270:0x16unsigned long
ImageNotifyDone
0x0438:0x16
0x0270:0x17unsigned long
PdeUpdateNeeded
0x0438:0x17
0x0270:0x18unsigned long
VdmAllowed
0x0438:0x18
0x0270:0x19unsigned long
CrossSessionCreate
0x0438:0x19
0x0270:0x1Aunsigned long
ProcessInserted
0x0438:0x1A
0x0270:0x1Bunsigned long
DefaultIoPriority
0x0438:0x1B
0x0270:0x1Eunsigned long
ProcessSelfDelete
0x0438:0x1E
0x0270:0x1Funsigned long
SetTimerResolutionLink
0x0438:0x1F
0x0274long
ExitStatus
long
ExitStatus
0x043C
0x0274long
ExitStatus
struct _MM_AVL_TABLE
VadRoot
struct _MM_AVL_TABLE
VadRoot
0x0590
0x0274struct _RTL_AVL_TREE
VadRoot
struct _LIST_ENTRY
MmProcessLinks
0x05D8
long
ExitStatus
0x05EC
0x0274struct _LIST_ENTRY
MmProcessLinks
struct _LIST_ENTRY
MmProcessLinks
0x05F0
0x0278struct _MM_AVL_TABLE
VadRoot
struct _MM_AVL_TABLE
VadRoot
0x0440
0x0278struct _MM_AVL_TABLE
VadRoot
void *
VadHint
0x05E0
0x027Cuintptr_t
VadCount
uintptr_t
VadCount
uintptr_t
VadCount
uintptr_t
VadCount
uintptr_t
VadCount
uintptr_t
VadCount
unsigned long
ModifiedPageCount
0x05E8
0x027Cuint64_t
VadCount
unsigned long
ModifiedPageCount
0x0600
0x0280volatile unsigned long
VadPhysicalPages
volatile uint64_t
VadPhysicalPages
volatile unsigned long
VadPhysicalPages
volatile uint64_t
VadPhysicalPages
volatile unsigned long
VadPhysicalPages
volatile uint64_t
VadPhysicalPages
struct _RTL_AVL_TREE
VadRoot
struct _LIST_ENTRY
MmProcessLinks
0x05F0
0x0280long
ExitStatus
0x0604
0x0284uintptr_t
VadPhysicalPagesLimit
uintptr_t
VadPhysicalPagesLimit
uintptr_t
VadPhysicalPagesLimit
uintptr_t
VadPhysicalPagesLimit
uintptr_t
VadPhysicalPagesLimit
uintptr_t
VadPhysicalPagesLimit
void *
VadHint
struct _LIST_ENTRY
MmProcessLinks
0x05F8
0x0284struct _RTL_AVL_TREE
VadRoot
0x0608
0x0288volatile unsigned long
VadPhysicalPages
volatile uint64_t
VadPhysicalPages
0x04A0
0x0288struct _ALPC_PROCESS_CONTEXT
AlpcContext
struct _ALPC_PROCESS_CONTEXT
AlpcContext
struct _ALPC_PROCESS_CONTEXT
AlpcContext
struct _ALPC_PROCESS_CONTEXT
AlpcContext
struct _ALPC_PROCESS_CONTEXT
AlpcContext
struct _ALPC_PROCESS_CONTEXT
AlpcContext
0x0600
0x0288void *
VadHint
0x0610
0x028Cuintptr_t
VadPhysicalPagesLimit
uintptr_t
VadPhysicalPagesLimit
0x04A8
0x028Cvolatile unsigned long
VadPhysicalPages
volatile uint64_t
VadPhysicalPages
0x05C0
0x028Cstruct _INVERTED_FUNCTION_TABLE *
InvertedFunctionTable
struct _ALPC_PROCESS_CONTEXT
AlpcContext
uintptr_t
VadCount
void *
VadHint
0x0618
0x0290struct _ALPC_PROCESS_CONTEXT
AlpcContext
struct _ALPC_PROCESS_CONTEXT
AlpcContext
union _LARGE_INTEGER
WriteOperationCount
union _LARGE_INTEGER
ReadOperationCount
void *
LockedPagesList
0x04B0
0x0290uintptr_t
VadPhysicalPagesLimit
uintptr_t
VadPhysicalPagesLimit
0x05C8
0x0290volatile unsigned long
VadPhysicalPages
volatile uint64_t
VadPhysicalPages
0x0620
0x0294struct _ALPC_PROCESS_CONTEXT
AlpcContext
struct _ALPC_PROCESS_CONTEXT
AlpcContext
0x05D0
0x0294uintptr_t
VadPhysicalPagesLimit
volatile uint64_t
VadPhysicalPages
0x0628
0x0298struct _ALPC_PROCESS_CONTEXT
AlpcContext
struct _ALPC_PROCESS_CONTEXT
AlpcContext
struct _ALPC_PROCESS_CONTEXT
AlpcContext
struct _LIST_ENTRY
ThreadListHead
void *
HighestUserAddress
0x0480
0x0298struct _EX_PUSH_LOCK
InvertedFunctionTableLock
struct _LIST_ENTRY
TimerResolutionLink
struct _LIST_ENTRY
TimerResolutionLink
struct _LIST_ENTRY
TimerResolutionLink
struct _LIST_ENTRY
TimerResolutionLink
struct _LIST_ENTRY
TimerResolutionLink
struct _LIST_ENTRY
TimerResolutionLink
volatile uint64_t
VadPhysicalPages
uint64_t
VadCount
0x0620
0x0298struct _ALPC_PROCESS_CONTEXT
AlpcContext
struct _ALPC_PROCESS_CONTEXT
AlpcContext
0x0630
0x02A0struct _LIST_ENTRY
TimerResolutionLink
struct _LIST_ENTRY
TimerResolutionLink
union _LARGE_INTEGER
OtherTransferCount
union _LARGE_INTEGER
WriteTransferCount
union _LARGE_INTEGER
ReadTransferCount
0x04D0
0x02A0struct _PO_DIAG_STACK_RECORD *
TimerResolutionStackRecord
0x0630
0x02A4struct _LIST_ENTRY
TimerResolutionLink
struct _LIST_ENTRY
TimerResolutionLink
0x05F0
0x02A4unsigned long
RequestedTimerResolution
struct _LIST_ENTRY
TimerResolutionLink
struct _ALPC_PROCESS_CONTEXT
AlpcContext
0x0638
0x02A8struct _LIST_ENTRY
TimerResolutionLink
struct _LIST_ENTRY
TimerResolutionLink
void *
LockedPagesList
struct _EX_FAST_REF
PrefetchTrace
unsigned long
DefaultHardErrorProcessing
0x04A0
0x02A8struct _PO_DIAG_STACK_RECORD *
TimerResolutionStackRecord
struct _PO_DIAG_STACK_RECORD *
TimerResolutionStackRecord
0x04E0
0x02A8unsigned long
SmallestTimerResolution
unsigned long
SmallestTimerResolution
unsigned long
SmallestTimerResolution
unsigned long
SmallestTimerResolution
unsigned long
SmallestTimerResolution
unsigned long
SmallestTimerResolution
0x063C
0x02A8struct _LIST_ENTRY
TimerResolutionLink
struct _EX_PUSH_LOCK
InvertedFunctionTableLock
struct _EX_PUSH_LOCK
InvertedFunctionTableLock
struct _EX_PUSH_LOCK
InvertedFunctionTableLock
unsigned long
RequestedTimerResolution
struct _LIST_ENTRY
TimerResolutionLink
struct _LIST_ENTRY
TimerResolutionLink
struct _LIST_ENTRY
TimerResolutionLink
0x0650
0x02ACunsigned long
RequestedTimerResolution
unsigned long
RequestedTimerResolution
0x04E8
0x02ACstruct _PO_DIAG_STACK_RECORD *
TimerResolutionStackRecord
0x0600
0x02B0unsigned long
RequestedTimerResolution
unsigned long
RequestedTimerResolution
0x04B0
0x02B0unsigned long
SmallestTimerResolution
unsigned long
SmallestTimerResolution
0x04EC
0x02B0unsigned long
RequestedTimerResolution
unsigned long
RequestedTimerResolution
unsigned long
RequestedTimerResolution
volatile uint64_t
VadPhysicalPages
struct _RTL_AVL_TREE
VadRoot
unsigned long
ModifiedPageCount
0x0608
0x02B0union _LARGE_INTEGER
ExitTime
0x0640
unsigned long
SmallestTimerResolution
0x0654
0x02B0struct _PO_DIAG_STACK_RECORD *
TimerResolutionStackRecord
0x0660
0x02B4unsigned long
ActiveThreadsHighWatermark
unsigned long
ActiveThreadsHighWatermark
0x04B4
0x02B4unsigned long
SmallestTimerResolution
unsigned long
SmallestTimerResolution
long
ExitStatus
0x060C
0x02B4unsigned long
ActiveThreadsHighWatermark
struct _EX_PUSH_LOCK
InvertedFunctionTableLock
unsigned long
RequestedTimerResolution
struct _PO_DIAG_STACK_RECORD *
TimerResolutionStackRecord
0x0668
0x02B8unsigned long
SmallestTimerResolution
unsigned long
SmallestTimerResolution
0x04B8
0x02B8union _LARGE_INTEGER
ExitTime
union _LARGE_INTEGER
ExitTime
0x04F0
0x02B8union _LARGE_INTEGER
ExitTime
union _LARGE_INTEGER
ExitTime
uint64_t
VadPhysicalPagesLimit
void *
VadHint
struct _RTL_AVL_TREE
VadRoot
0x0610
0x02B8unsigned long
ActiveThreadsHighWatermark
unsigned long
ActiveThreadsHighWatermark
unsigned long
ActiveThreadsHighWatermark
unsigned long
ActiveThreadsHighWatermark
unsigned long
ActiveThreadsHighWatermark
unsigned long
ActiveThreadsHighWatermark
0x0658
0x02B8unsigned long
SmallestTimerResolution
unsigned long
SmallestTimerResolution
0x066C
0x02BCstruct _PO_DIAG_STACK_RECORD *
TimerResolutionStackRecord
struct _PO_DIAG_STACK_RECORD *
TimerResolutionStackRecord
0x04C0
0x02BCstruct _PO_DIAG_STACK_RECORD *
TimerResolutionStackRecord
unsigned long
LargePrivateVadCount
0x065C
0x02C0unsigned long
ActiveThreadsHighWatermark
unsigned long
ActiveThreadsHighWatermark
0x0508
0x02C0unsigned long
ActiveThreadsHighWatermark
unsigned long
ActiveThreadsHighWatermark
0x0628
0x02C0uint64_t
SequenceNumber
struct _EX_PUSH_LOCK
ThreadListLock
struct _EX_PUSH_LOCK
ThreadListLock
struct _EX_PUSH_LOCK
ThreadListLock
struct _EX_PUSH_LOCK
ThreadListLock
struct _EX_PUSH_LOCK
ThreadListLock
struct _EX_PUSH_LOCK
ThreadListLock
struct _INVERTED_FUNCTION_TABLE *
InvertedFunctionTable
struct _PO_DIAG_STACK_RECORD *
TimerResolutionStackRecord
0x0660
0x02C0union _LARGE_INTEGER
ExitTime
union _LARGE_INTEGER
ExitTime
0x0670
0x02C4unsigned long
LargePrivateVadCount
unsigned long
LargePrivateVadCount
0x050C
0x02C4unsigned long
LargePrivateVadCount
unsigned long
LargePrivateVadCount
0x062C
0x02C4void *
WnfContext
0x0668
0x02C8void *
WnfContext
void *
WnfContext
0x0510
0x02C8struct _EX_PUSH_LOCK
ThreadListLock
struct _EX_PUSH_LOCK
ThreadListLock
struct _ALPC_PROCESS_CONTEXT
AlpcContext
uint64_t
VadPhysicalPagesLimit
0x0630
0x02C8uint64_t
CreateInterruptTime
uintptr_t
Spare0
uintptr_t
Spare0
uintptr_t
Spare0
uintptr_t
Spare0
uintptr_t
Spare0
uintptr_t
Spare0
unsigned long
ActiveThreadsHighWatermark
union _LARGE_INTEGER
ExitTime
unsigned long
RequestedTimerResolution
0x0670
unsigned long
LargePrivateVadCount
unsigned long
SmallestTimerResolution
0x0674
0x02C8uint64_t
Spare0
unsigned long
ActiveThreadsHighWatermark
struct _EX_PUSH_LOCK
InvertedFunctionTableLock
0x0688
0x02CCenum _SE_SIGNING_LEVEL
SignatureLevel
enum _SE_SIGNING_LEVEL
SignatureLevel
0x0518
0x02CCvoid *
WnfContext
void *
WnfContext
0x0638
0x02CCuint8_t
SignatureLevel
uint8_t
SignatureLevel
uint8_t
SignatureLevel
uint8_t
SignatureLevel
uint8_t
SignatureLevel
uint8_t
SignatureLevel
struct _EX_PUSH_LOCK
ThreadListLock
struct _INVERTED_FUNCTION_TABLE *
InvertedFunctionTable
struct _INVERTED_FUNCTION_TABLE *
InvertedFunctionTable
union _LARGE_INTEGER
ExitTime
0x0678
0x02CCunsigned long
LargePrivateVadCount
unsigned long
LargePrivateVadCount
unsigned long
LargePrivateVadCount
0x068C
0x02CDuint8_t
SectionSignatureLevel
0x0679
0x02CEstruct _PS_PROTECTION
Protection
0x067A
0x02CFuint8_t[1]
SpareByte20
0x067B
0x02D0unsigned long
KeepAliveCounter
unsigned long
KeepAliveCounter
0x051C
0x02D0uint64_t
CreateUnbiasedInterruptTime
uintptr_t
SectionMappingSize
uintptr_t
SectionMappingSize
0x0640
0x02D0unsigned long
Flags3
0x067C
0x02D0:0x00unsigned long
Minimal
unsigned long
Minimal
unsigned long
Minimal
unsigned long
Minimal
unsigned long
Minimal
unsigned long
Minimal
0x067C:0x00
0x02D0uint8_t
SignatureLevel
struct _EX_PUSH_LOCK
ThreadListLock
unsigned long
ActiveThreadsHighWatermark
0x0690
0x02D4struct _PROCESS_DISK_COUNTERS *
DiskCounters
struct _PROCESS_DISK_COUNTERS *
DiskCounters
0x0520
0x02D4uint8_t
SignatureLevel
uint8_t
SignatureLevel
struct _INVERTED_FUNCTION_TABLE *
InvertedFunctionTable
struct _INVERTED_FUNCTION_TABLE *
InvertedFunctionTable
struct _INVERTED_FUNCTION_TABLE *
InvertedFunctionTable
struct _PO_DIAG_STACK_RECORD *
TimerResolutionStackRecord
0x0648
0x02D4long
SvmReserved
void *
WnfContext
struct _EX_PUSH_LOCK
InvertedFunctionTableLock
struct _EX_PUSH_LOCK
InvertedFunctionTableLock
struct _INVERTED_FUNCTION_TABLE *
InvertedFunctionTable
0x0680
uint8_t
SectionSignatureLevel
0x0691
struct _PS_PROTECTION
Protection
0x0692
uint8_t[1]
SpareByte20
0x0693
unsigned long
Flags3
unsigned long
LargePrivateVadCount
0x0694
unsigned long
Minimal
0x0694:0x00
unsigned long
ReplacingPageRoot
0x0694:0x01
0x02D4long
SvmReserved
void *
WnfContext
void *
WnfContext
void *
WnfContext
struct _EX_PUSH_LOCK
ThreadListLock
0x0698
0x02D5uint8_t
SectionSignatureLevel
0x0649
0x02D6uint8_t[2]
SpareByte20
0x064A
0x02D8unsigned long
KeepAliveCounter
unsigned long
KeepAliveCounter
0x064C
0x02D8void *
SvmReserved1
void *
SvmReserved1
void *
SvmReserved1
void *
SvmReserved1
void *
SvmReserved1
void *
SvmReserved1
0x0688
0x02D8uintptr_t
Spare0
0x06A0
0x02DCstruct _PROCESS_DISK_COUNTERS *
DiskCounters
struct _PROCESS_DISK_COUNTERS *
DiskCounters
0x0650
0x02DCuintptr_t
SvmReserved2
uintptr_t
SvmReserved2
uintptr_t
SvmReserved2
uintptr_t
SvmReserved2
uintptr_t
SvmReserved2
uintptr_t
SvmReserved2
0x0690
0x02DCvoid *
PicoContext
void *
PicoContext
void *
PicoContext
uint64_t
SvmReserved2
uint8_t
SignatureLevel
uint64_t
Spare0
0x06A8
0x02DDuint8_t
SectionSignatureLevel
0x06A9
0x02DEstruct _PS_PROTECTION
Protection
0x06AA
0x02DFuint8_t
HangCount
0x06AB
0x02E0uint64_t
LastFreezeInterruptTime
uint64_t
LastFreezeInterruptTime
union _LARGE_INTEGER
ExitTime
struct _LIST_ENTRY
TimerResolutionLink
0x0658
0x02E0uint64_t
LastFreezeInterruptTime
uint64_t
LastFreezeInterruptTime
uint64_t
LastFreezeInterruptTime
uint64_t
LastFreezeInterruptTime
uint64_t
LastFreezeInterruptTime
uint64_t
LastFreezeInterruptTime
0x0698
0x02E0unsigned long
Flags3
0x06AC
0x02E0:0x00unsigned long
Minimal
0x06AC:0x00
0x02E0:0x01unsigned long
ReplacingPageRoot
0x06AC:0x01
0x02E0:0x02unsigned long
DisableNonSystemFonts
0x06AC:0x02
0x02E0:0x03unsigned long
AuditNonSystemFontLoading
0x06AC:0x03
0x02E0:0x04unsigned long
Crashed
0x06AC:0x04
0x02E0:0x05unsigned long
JobVadsAreTracked
0x06AC:0x05
0x02E0:0x06unsigned long
VadTrackingDisabled
0x06AC:0x06
0x02E0:0x07unsigned long
AuxiliaryProcess
0x06AC:0x07
0x02E0:0x08unsigned long
SubsystemProcess
0x06AC:0x08
0x02E0:0x09unsigned long
IndirectCpuSets
0x06AC:0x09
0x02E0:0x0Aunsigned long
InPrivate
0x06AC:0x0A
0x02E4uint64_t
LastFreezeInterruptTime
long
DeviceAsid
uint8_t
SignatureLevel
0x06B0
0x02E8struct _PROCESS_DISK_COUNTERS *
DiskCounters
void *
SvmReserved1
uint64_t
Spare0
void *
WnfContext
0x06A0
uint8_t
SectionSignatureLevel
0x06B1
struct _PS_PROTECTION
Protection
0x06B2
uint8_t
HangCount
0x06B3
unsigned long
Minimal
0x06B4:0x00
unsigned long
ReplacingPageRoot
0x06B4:0x01
unsigned long
DisableNonSystemFonts
0x06B4:0x02
unsigned long
AuditNonSystemFontLoading
0x06B4:0x03
unsigned long
Crashed
0x06B4:0x04
unsigned long
JobVadsAreTracked
0x06B4:0x05
unsigned long
VadTrackingDisabled
0x06B4:0x06
unsigned long
AuxiliaryProcess
0x06B4:0x07
unsigned long
SubsystemProcess
0x06B4:0x08
unsigned long
IndirectCpuSets
0x06B4:0x09
unsigned long
InPrivate
0x06B4:0x0A
unsigned long
ProhibitRemoteImageMap
0x06B4:0x0B
unsigned long
ProhibitLowILImageMap
0x06B4:0x0C
unsigned long
SignatureMitigationOptIn
0x06B4:0x0D
0x02E8void *
SvmData
0x06B8
0x02ECunsigned long
KeepAliveCounter
unsigned long
KeepAliveCounter
unsigned long
KeepAliveCounter
unsigned long
KeepAliveCounter
unsigned long
KeepAliveCounter
unsigned long
KeepAliveCounter
0x06B0
0x02ECvoid *
PicoContext
struct _EX_PUSH_LOCK
SvmProcessLock
void *
SvmData
0x06C0
0x02F0unsigned long
NoWakeKeepAliveCounter
unsigned long
NoWakeKeepAliveCounter
unsigned long
NoWakeKeepAliveCounter
unsigned long
NoWakeKeepAliveCounter
unsigned long
NoWakeKeepAliveCounter
unsigned long
NoWakeKeepAliveCounter
unsigned long
Flags3
0x06B4
0x02F0uintptr_t
SvmLock
0x06C8
0x02F4uint64_t
SecurePid
struct _LIST_ENTRY
SvmProcessDeviceListHead
struct _LIST_ENTRY
SvmProcessDeviceListHead
struct _LIST_ENTRY
SvmProcessDeviceListHead
uint64_t
SvmLock
0x06D0
0x02F8uint64_t
DeepFreezeStartTime
struct _PROCESS_DISK_COUNTERS *
DiskCounters
void *
SvmData
long
DeviceAsid
0x06B8
0x0300uintptr_t
CommitChargeLimit
uintptr_t
CommitChargeLimit
uintptr_t
CommitChargeLimit
uintptr_t
CommitChargeLimit
0x06C0
0x0300uint64_t
LastFreezeInterruptTime
uint64_t
LastFreezeInterruptTime
0x06E0
0x0304volatile unsigned long
CommitChargePeak
volatile uint64_t
CommitChargePeak
volatile unsigned long
CommitChargePeak
volatile uint64_t
CommitChargePeak
uint64_t
SecretIdentity
uint64_t
SvmLock
struct _EX_PUSH_LOCK
SvmProcessLock
0x06C8
0x0308unsigned long
HighPriorityFaultsAllowed
0x06D0
unsigned long
NoWakeKeepAliveCounter
0x06E4
0x0308unsigned long
HighPriorityFaultsAllowed
struct _PROCESS_DISK_COUNTERS *
DiskCounters
uint64_t
LastFreezeInterruptTime
0x06E8
0x030Cstruct _PROCESS_ENERGY_VALUES *
EnergyValues
void *
PicoContext
struct _PROCESS_DISK_COUNTERS *
DiskCounters
0x06F0
0x0310uint64_t
SequenceNumber
void *
ContextBuffer
struct _LIST_ENTRY
SvmProcessDeviceListHead
0x06D8
void *
VmContext
uint64_t
TrustletIdentity
uint64_t
TrustletIdentity
void *
PicoContext
0x06F8
0x0310unsigned long
KeepAliveCounter
uint64_t
TrustletIdentity
0x0700
0x0314unsigned long
NoWakeKeepAliveCounter
0x0704
0x0318uint64_t
CreateInterruptTime
uint64_t
CreateInterruptTime
unsigned long
KeepAliveCounter
uint64_t
LastFreezeInterruptTime
0x06E0
0x0318unsigned long
HighPriorityFaultsAllowed
unsigned long
HighPriorityFaultsAllowed
unsigned long
KeepAliveCounter
0x0708
0x031Cvoid *
InstrumentationCallback
0x0320uint64_t
CreateUnbiasedInterruptTime
0x06E8
unsigned long
NoWakeKeepAliveCounter
0x070C
0x0320struct _PROCESS_ENERGY_VALUES *
EnergyValues
unsigned long
HighPriorityFaultsAllowed
0x0710
0x0324void *
VmContext
struct _PROCESS_ENERGY_VALUES *
EnergyValues
0x0718
0x0328uint64_t
SequenceNumber
struct _ESILO *
Silo
void *
VmContext
0x0720
0x032Cuint64_t
CreateInterruptTime
struct _LIST_ENTRY
SiloEntry
struct _LIST_ENTRY
SiloEntry
uint64_t
SequenceNumber
0x0728
uint64_t
CreateUnbiasedInterruptTime
uint64_t
CreateInterruptTime
0x0730
0x0338uint64_t
TotalUnbiasedFrozenTime
uint64_t
SequenceNumber
uint64_t
CreateUnbiasedInterruptTime
0x0738
0x0340uint64_t
LastAppStateUpdateTime
uint64_t
CreateInterruptTime
uint64_t
TotalUnbiasedFrozenTime
0x0740
0x0348uint64_t
LastAppStateUptime
uint64_t
CreateUnbiasedInterruptTime
uint64_t
CreateUnbiasedInterruptTime
uint64_t
LastAppStateUpdateTime
0x0748:0x00
uint64_t
LastAppState
0x0748:0x3D
0x0350volatile uint64_t
SharedCommitCharge
uint64_t
TotalUnbiasedFrozenTime
uint64_t
TotalUnbiasedFrozenTime
uint64_t
LastAppStateUptime
0x0750
uint64_t
LastAppState
0x0750:0x3D
0x0358struct _EX_PUSH_LOCK
SharedCommitLock
uint64_t
LastAppStateUpdateTime
volatile uint64_t
SharedCommitCharge
0x0758
0x0360:0x00struct _LIST_ENTRY
SharedCommitLinks
uint64_t
LastAppStateUptime
struct _EX_PUSH_LOCK
SharedCommitLock
0x0760
0x0360:0x3Duint64_t
LastAppState
0x0760:0x3D
0x0368volatile unsigned long
SharedCommitCharge
volatile uint64_t
SharedCommitCharge
struct _LIST_ENTRY
SharedCommitLinks
0x0768
0x036Cstruct _EX_PUSH_LOCK
SharedCommitLock
0x0770
uint64_t *
AllowedCpuSetsIndirect
0x0778
0x0370struct _LIST_ENTRY
SharedCommitLinks
struct _LIST_ENTRY
SharedCommitLinks
uint64_t
AllowedCpuSets
0x0778
uint64_t
DefaultCpuSets
0x0780
uint64_t *
DefaultCpuSetsIndirect
0x0780
0x0378uintptr_t
AllowedCpuSets
0x0788
0x0378uintptr_t *
AllowedCpuSetsIndirect
0x0788
0x037Cuintptr_t
DefaultCpuSets
0x0790
0x037Cuintptr_t *
DefaultCpuSetsIndirect
0x0790