Min version	XP	XP SP2	2003/XP64	2003/XP64 SP1		Vista	Vista SP1	Vista SP2	Vista SP2		7 SP1		7 SP1	8 Pre RTM		8 Pre RTM	8	8.1 Update 1	8.1	8.1 Update 1		8.1 Update 1		10 Pre RTM	10 Pre RTM	10		10 TH2
Max version	XP SP1	XP SP3		2003/XP64 SP2			Vista SP2									8			8.1 Update 1
Architecture	x86	x86	x86	x86	x64	x86	x86	x64	x86	x64	x86	x64	x86	x86	x64	x86	x64	x86	x64	x86	x64	x86	x64	x64	x64	x86	x64	x64
x86 offset offset:bitpos	Field Name																												x64 offset offset:bitpos
0x0000	struct _KPROCESS Pcb			struct _KPROCESS Pcb		struct _KPROCESS Pcb					struct _KPROCESS Pcb	struct _KPROCESS Pcb	struct _KPROCESS Pcb	struct _KPROCESS Pcb	struct _KPROCESS Pcb	struct _KPROCESS Pcb	struct _KPROCESS Pcb	struct _KPROCESS Pcb	struct _KPROCESS Pcb	struct _KPROCESS Pcb	struct _KPROCESS Pcb	struct _KPROCESS Pcb	struct _KPROCESS Pcb	struct _KPROCESS Pcb	struct _KPROCESS Pcb	struct _KPROCESS Pcb	struct _KPROCESS Pcb		0x0000
0x006C	struct _EX_PUSH_LOCK ProcessLock
0x0070	union _LARGE_INTEGER CreateTime
0x0078	union _LARGE_INTEGER ExitTime			struct _EX_PUSH_LOCK ProcessLock																									0x00B8
0x0080	struct _EX_RUNDOWN_REF RundownProtect			union _LARGE_INTEGER CreateTime		struct _EX_PUSH_LOCK ProcessLock																							0x00C0
0x0084	void * UniqueProcessId
0x0088	struct _LIST_ENTRY ActiveProcessLinks			union _LARGE_INTEGER ExitTime		union _LARGE_INTEGER CreateTime																							0x00C8
0x0090	unsigned long[3] QuotaUsage			struct _EX_RUNDOWN_REF RundownProtect		union _LARGE_INTEGER ExitTime		union _LARGE_INTEGER ExitTime	union _LARGE_INTEGER ExitTime	union _LARGE_INTEGER ExitTime																			0x00D0
0x0094				void * UniqueProcessId	void * UniqueProcessId																								0x00D8
0x0098							struct _EX_RUNDOWN_REF RundownProtect	struct _EX_RUNDOWN_REF RundownProtect	struct _EX_RUNDOWN_REF RundownProtect	struct _EX_RUNDOWN_REF RundownProtect																			0x00D8
0x0098				struct _LIST_ENTRY ActiveProcessLinks	struct _LIST_ENTRY ActiveProcessLinks	struct _EX_RUNDOWN_REF RundownProtect							struct _EX_PUSH_LOCK ProcessLock																0x00E0
0x0098											struct _EX_PUSH_LOCK ProcessLock																		0x0160
0x009C	unsigned long[3] QuotaPeak					void * UniqueProcessId																							0x00E0
0x00A0							struct _LIST_ENTRY ActiveProcessLinks	struct _LIST_ENTRY ActiveProcessLinks	struct _LIST_ENTRY ActiveProcessLinks	struct _LIST_ENTRY ActiveProcessLinks																			0x00E8
0x00A0				uintptr_t[3] QuotaUsage	uintptr_t[3] QuotaUsage																								0x00F0
0x00A0						struct _LIST_ENTRY ActiveProcessLinks					union _LARGE_INTEGER CreateTime	union _LARGE_INTEGER CreateTime	union _LARGE_INTEGER CreateTime																0x0168
0x00A0														struct _EX_PUSH_LOCK ProcessLock	struct _EX_PUSH_LOCK ProcessLock														0x01B8
0x00A0																struct _EX_PUSH_LOCK ProcessLock													0x02C8
0x00A8							uintptr_t[3] QuotaUsage	uintptr_t[3] QuotaUsage	uintptr_t[3] QuotaUsage	uintptr_t[3] QuotaUsage																			0x00F8
0x00A8											union _LARGE_INTEGER ExitTime	union _LARGE_INTEGER ExitTime																	0x0170
0x00A8														union _LARGE_INTEGER CreateTime	union _LARGE_INTEGER CreateTime														0x01C0
0x00A8	unsigned long CommitCharge					unsigned long[3] QuotaUsage							union _LARGE_INTEGER ExitTime			union _LARGE_INTEGER CreateTime	union _LARGE_INTEGER CreateTime	union _LARGE_INTEGER CreateTime	union _LARGE_INTEGER CreateTime	union _LARGE_INTEGER CreateTime	union _LARGE_INTEGER CreateTime	union _LARGE_INTEGER CreateTime	union _LARGE_INTEGER CreateTime	struct _EX_PUSH_LOCK ProcessLock					0x02D0
0x00A8																										struct _EX_PUSH_LOCK ProcessLock			0x02D8
0x00AC	unsigned long PeakVirtualSize			uintptr_t[3] QuotaPeak	uintptr_t[3] QuotaPeak																								0x0108
0x00AC																										struct _EX_RUNDOWN_REF RundownProtect			0x02E0
0x00B0											struct _EX_RUNDOWN_REF RundownProtect	struct _EX_RUNDOWN_REF RundownProtect																	0x0178
0x00B0														struct _EX_RUNDOWN_REF RundownProtect	struct _EX_RUNDOWN_REF RundownProtect														0x01C8
0x00B0	unsigned long VirtualSize												struct _EX_RUNDOWN_REF RundownProtect			struct _EX_RUNDOWN_REF RundownProtect									struct _EX_PUSH_LOCK ProcessLock	void * VdmObjects		struct _EX_PUSH_LOCK ProcessLock	0x02D8
0x00B4							uintptr_t[3] QuotaPeak	uintptr_t[3] QuotaPeak	uintptr_t[3] QuotaPeak	uintptr_t[3] QuotaPeak																			0x0110
0x00B4	struct _LIST_ENTRY SessionProcessLinks					unsigned long[3] QuotaPeak					void * UniqueProcessId	void * UniqueProcessId	void * UniqueProcessId																0x0180
0x00B4														void * UniqueProcessId	void * UniqueProcessId														0x01D0
0x00B4																void * UniqueProcessId	void * UniqueProcessId	void * UniqueProcessId	void * UniqueProcessId	void * UniqueProcessId	void * UniqueProcessId	void * UniqueProcessId	void * UniqueProcessId						0x02E0
0x00B4																										void * UniqueProcessId			0x02E8
0x00B8				uintptr_t CommitCharge	uintptr_t CommitCharge								struct _LIST_ENTRY ActiveProcessLinks																0x0120
0x00B8											struct _LIST_ENTRY ActiveProcessLinks	struct _LIST_ENTRY ActiveProcessLinks																	0x0188
0x00B8														struct _LIST_ENTRY ActiveProcessLinks	struct _LIST_ENTRY ActiveProcessLinks														0x01D8
0x00B8																struct _LIST_ENTRY ActiveProcessLinks	struct _LIST_ENTRY ActiveProcessLinks	struct _LIST_ENTRY ActiveProcessLinks	struct _LIST_ENTRY ActiveProcessLinks	struct _LIST_ENTRY ActiveProcessLinks	struct _LIST_ENTRY ActiveProcessLinks	struct _LIST_ENTRY ActiveProcessLinks	struct _LIST_ENTRY ActiveProcessLinks						0x02E8
0x00B8																									struct _LIST_ENTRY ActiveProcessLinks	struct _LIST_ENTRY ActiveProcessLinks	struct _LIST_ENTRY ActiveProcessLinks		0x02F0
0x00BC	void * DebugPort			uintptr_t PeakVirtualSize	uintptr_t PeakVirtualSize																								0x0128
0x00C0							volatile unsigned long CommitCharge	volatile uint64_t CommitCharge	volatile unsigned long CommitCharge	volatile uint64_t CommitCharge																			0x0128
0x00C0				uintptr_t VirtualSize	uintptr_t VirtualSize																								0x0130
0x00C0											uintptr_t[2] ProcessQuotaUsage	uintptr_t[2] ProcessQuotaUsage																	0x0198
0x00C0	void * ExceptionPort					volatile unsigned long CommitCharge							uintptr_t[2] ProcessQuotaUsage		uintptr_t[2] ProcessQuotaUsage														0x01E8
0x00C0																unsigned long Flags2								unsigned long JobNotReallyActive					0x02F8
0x00C0:0x00																unsigned long JobNotReallyActive	unsigned long JobNotReallyActive	unsigned long JobNotReallyActive	unsigned long JobNotReallyActive	unsigned long JobNotReallyActive	unsigned long JobNotReallyActive	unsigned long JobNotReallyActive	unsigned long JobNotReallyActive						0x02F8:0x00
0x00C0																										unsigned long Flags2			0x0300
0x00C0:0x00																										unsigned long JobNotReallyActive			0x0300:0x00
0x00C0:0x01																unsigned long AccountingFolded	unsigned long AccountingFolded	unsigned long AccountingFolded	unsigned long AccountingFolded	unsigned long AccountingFolded	unsigned long AccountingFolded	unsigned long AccountingFolded	unsigned long AccountingFolded						0x02F8:0x01
0x00C0:0x01																									unsigned long AccountingFolded				0x0300:0x01
0x00C0:0x02																unsigned long NewProcessReported	unsigned long NewProcessReported	unsigned long NewProcessReported	unsigned long NewProcessReported	unsigned long NewProcessReported	unsigned long NewProcessReported	unsigned long NewProcessReported	unsigned long NewProcessReported						0x02F8:0x02
0x00C0:0x02																									unsigned long NewProcessReported				0x0300:0x02
0x00C0:0x03																unsigned long ExitProcessReported	unsigned long ExitProcessReported	unsigned long ExitProcessReported	unsigned long ExitProcessReported	unsigned long ExitProcessReported	unsigned long ExitProcessReported	unsigned long ExitProcessReported	unsigned long ExitProcessReported						0x02F8:0x03
0x00C0:0x03																									unsigned long ExitProcessReported				0x0300:0x03
0x00C0:0x04																unsigned long ReportCommitChanges	unsigned long ReportCommitChanges	unsigned long ReportCommitChanges	unsigned long ReportCommitChanges	unsigned long ReportCommitChanges	unsigned long ReportCommitChanges	unsigned long ReportCommitChanges	unsigned long ReportCommitChanges						0x02F8:0x04
0x00C0:0x04																									unsigned long ReportCommitChanges				0x0300:0x04
0x00C0:0x05																unsigned long LastReportMemory	unsigned long LastReportMemory	unsigned long LastReportMemory	unsigned long LastReportMemory	unsigned long LastReportMemory	unsigned long LastReportMemory	unsigned long LastReportMemory	unsigned long LastReportMemory						0x02F8:0x05
0x00C0:0x05																									unsigned long LastReportMemory				0x0300:0x05
0x00C0:0x06																unsigned long NoWakeCharge	unsigned long NoWakeCharge	unsigned long ForceWakeCharge	unsigned long ForceWakeCharge	unsigned long ForceWakeCharge	unsigned long ForceWakeCharge	unsigned long ForceWakeCharge	unsigned long ForceWakeCharge						0x02F8:0x06
0x00C0:0x06																									unsigned long ForceWakeCharge				0x0300:0x06
0x00C0:0x07																unsigned long HandleTableRundown	unsigned long HandleTableRundown	unsigned long CrossSessionCreate	unsigned long CrossSessionCreate	unsigned long CrossSessionCreate	unsigned long CrossSessionCreate	unsigned long CrossSessionCreate	unsigned long CrossSessionCreate						0x02F8:0x07
0x00C0:0x07																									unsigned long CrossSessionCreate				0x0300:0x07
0x00C0:0x08																unsigned long NeedsHandleRundown	unsigned long NeedsHandleRundown	unsigned long NeedsHandleRundown	unsigned long NeedsHandleRundown	unsigned long NeedsHandleRundown	unsigned long NeedsHandleRundown	unsigned long NeedsHandleRundown	unsigned long NeedsHandleRundown						0x02F8:0x08
0x00C0:0x08																									unsigned long NeedsHandleRundown				0x0300:0x08
0x00C0:0x09																unsigned long RefTraceEnabled	unsigned long RefTraceEnabled	unsigned long RefTraceEnabled	unsigned long RefTraceEnabled	unsigned long RefTraceEnabled	unsigned long RefTraceEnabled	unsigned long RefTraceEnabled	unsigned long RefTraceEnabled						0x02F8:0x09
0x00C0:0x09																									unsigned long RefTraceEnabled				0x0300:0x09
0x00C0:0x0A																unsigned long NumaAware	unsigned long NumaAware	unsigned long DisableDynamicCode	unsigned long DisableDynamicCode	unsigned long DisableDynamicCode	unsigned long DisableDynamicCode	unsigned long DisableDynamicCode	unsigned long DisableDynamicCode						0x02F8:0x0A
0x00C0:0x0A																									unsigned long DisableDynamicCode				0x0300:0x0A
0x00C0:0x0B																unsigned long EmptyJobEvaluated	unsigned long EmptyJobEvaluated	unsigned long EmptyJobEvaluated	unsigned long EmptyJobEvaluated	unsigned long EmptyJobEvaluated	unsigned long EmptyJobEvaluated	unsigned long EmptyJobEvaluated	unsigned long EmptyJobEvaluated						0x02F8:0x0B
0x00C0:0x0B																									unsigned long EmptyJobEvaluated				0x0300:0x0B
0x00C0:0x0C																unsigned long DefaultPagePriority	unsigned long DefaultPagePriority	unsigned long DefaultPagePriority	unsigned long DefaultPagePriority	unsigned long DefaultPagePriority	unsigned long DefaultPagePriority	unsigned long DefaultPagePriority	unsigned long DefaultPagePriority						0x02F8:0x0C
0x00C0:0x0C																									unsigned long DefaultPagePriority				0x0300:0x0C
0x00C0:0x0F																unsigned long PrimaryTokenFrozen	unsigned long PrimaryTokenFrozen	unsigned long PrimaryTokenFrozen	unsigned long PrimaryTokenFrozen	unsigned long PrimaryTokenFrozen	unsigned long PrimaryTokenFrozen	unsigned long PrimaryTokenFrozen	unsigned long PrimaryTokenFrozen						0x02F8:0x0F
0x00C0:0x0F																									unsigned long PrimaryTokenFrozen				0x0300:0x0F
0x00C0:0x10																unsigned long ProcessVerifierTarget	unsigned long ProcessVerifierTarget	unsigned long ProcessVerifierTarget	unsigned long ProcessVerifierTarget	unsigned long ProcessVerifierTarget	unsigned long ProcessVerifierTarget	unsigned long ProcessVerifierTarget	unsigned long ProcessVerifierTarget						0x02F8:0x10
0x00C0:0x10																									unsigned long ProcessVerifierTarget				0x0300:0x10
0x00C0:0x11																unsigned long StackRandomizationDisabled	unsigned long StackRandomizationDisabled	unsigned long StackRandomizationDisabled	unsigned long StackRandomizationDisabled	unsigned long StackRandomizationDisabled	unsigned long StackRandomizationDisabled	unsigned long StackRandomizationDisabled	unsigned long StackRandomizationDisabled						0x02F8:0x11
0x00C0:0x11																									unsigned long StackRandomizationDisabled				0x0300:0x11
0x00C0:0x12																unsigned long AffinityPermanent	unsigned long AffinityPermanent	unsigned long AffinityPermanent	unsigned long AffinityPermanent	unsigned long AffinityPermanent	unsigned long AffinityPermanent	unsigned long AffinityPermanent	unsigned long AffinityPermanent						0x02F8:0x12
0x00C0:0x12																									unsigned long AffinityPermanent				0x0300:0x12
0x00C0:0x13																unsigned long AffinityUpdateEnable	unsigned long AffinityUpdateEnable	unsigned long AffinityUpdateEnable	unsigned long AffinityUpdateEnable	unsigned long AffinityUpdateEnable	unsigned long AffinityUpdateEnable	unsigned long AffinityUpdateEnable	unsigned long AffinityUpdateEnable						0x02F8:0x13
0x00C0:0x13																									unsigned long AffinityUpdateEnable				0x0300:0x13
0x00C0:0x14																unsigned long PropagateNode	unsigned long PropagateNode	unsigned long PropagateNode	unsigned long PropagateNode	unsigned long PropagateNode	unsigned long PropagateNode	unsigned long PropagateNode	unsigned long PropagateNode						0x02F8:0x14
0x00C0:0x14																									unsigned long PropagateNode				0x0300:0x14
0x00C0:0x15																unsigned long ExplicitAffinity	unsigned long ExplicitAffinity	unsigned long ExplicitAffinity	unsigned long ExplicitAffinity	unsigned long ExplicitAffinity	unsigned long ExplicitAffinity	unsigned long ExplicitAffinity	unsigned long ExplicitAffinity						0x02F8:0x15
0x00C0:0x15																									unsigned long ExplicitAffinity				0x0300:0x15
0x00C0:0x16																unsigned long ProcessExecutionState	unsigned long ProcessExecutionState	unsigned long ProcessExecutionState	unsigned long ProcessExecutionState	unsigned long ProcessExecutionState	unsigned long ProcessExecutionState	unsigned long ProcessExecutionState	unsigned long ProcessExecutionState						0x02F8:0x16
0x00C0:0x16																									unsigned long ProcessExecutionState				0x0300:0x16
0x00C0:0x18																unsigned long DisallowStrippedImages	unsigned long DisallowStrippedImages	unsigned long DisallowStrippedImages	unsigned long DisallowStrippedImages	unsigned long DisallowStrippedImages	unsigned long DisallowStrippedImages	unsigned long DisallowStrippedImages	unsigned long DisallowStrippedImages						0x02F8:0x18
0x00C0:0x18																									unsigned long DisallowStrippedImages				0x0300:0x18
0x00C0:0x19																unsigned long HighEntropyASLREnabled	unsigned long HighEntropyASLREnabled	unsigned long HighEntropyASLREnabled	unsigned long HighEntropyASLREnabled	unsigned long HighEntropyASLREnabled	unsigned long HighEntropyASLREnabled	unsigned long HighEntropyASLREnabled	unsigned long HighEntropyASLREnabled						0x02F8:0x19
0x00C0:0x19																									unsigned long HighEntropyASLREnabled				0x0300:0x19
0x00C0:0x1A																unsigned long ExtensionPointDisable	unsigned long ExtensionPointDisable	unsigned long ExtensionPointDisable	unsigned long ExtensionPointDisable	unsigned long ExtensionPointDisable	unsigned long ExtensionPointDisable	unsigned long ExtensionPointDisable	unsigned long ExtensionPointDisable						0x02F8:0x1A
0x00C0:0x1A																									unsigned long ExtensionPointDisable				0x0300:0x1A
0x00C0:0x1B																unsigned long ForceRelocateImages	unsigned long ForceRelocateImages	unsigned long ForceRelocateImages	unsigned long ForceRelocateImages	unsigned long ForceRelocateImages	unsigned long ForceRelocateImages	unsigned long ForceRelocateImages	unsigned long ForceRelocateImages						0x02F8:0x1B
0x00C0:0x1B																									unsigned long ForceRelocateImages				0x0300:0x1B
0x00C0:0x1C																unsigned long ProcessStateChangeRequest	unsigned long ProcessStateChangeRequest	unsigned long ProcessStateChangeRequest	unsigned long ProcessStateChangeRequest	unsigned long ProcessStateChangeRequest	unsigned long ProcessStateChangeRequest	unsigned long ProcessStateChangeRequest	unsigned long ProcessStateChangeRequest						0x02F8:0x1C
0x00C0:0x1C																									unsigned long ProcessStateChangeRequest				0x0300:0x1C
0x00C0:0x1E																unsigned long ProcessStateChangeInProgress	unsigned long ProcessStateChangeInProgress	unsigned long ProcessStateChangeInProgress	unsigned long ProcessStateChangeInProgress	unsigned long ProcessStateChangeInProgress	unsigned long ProcessStateChangeInProgress	unsigned long ProcessStateChangeInProgress	unsigned long ProcessStateChangeInProgress						0x02F8:0x1E
0x00C0:0x1E																									unsigned long ProcessStateChangeInProgress				0x0300:0x1E
0x00C0:0x1F																unsigned long DisallowWin32kSystemCalls	unsigned long DisallowWin32kSystemCalls	unsigned long DisallowWin32kSystemCalls	unsigned long DisallowWin32kSystemCalls	unsigned long DisallowWin32kSystemCalls	unsigned long DisallowWin32kSystemCalls	unsigned long DisallowWin32kSystemCalls	unsigned long DisallowWin32kSystemCalls						0x02F8:0x1F
0x00C0:0x1F																									unsigned long DisallowWin32kSystemCalls				0x0300:0x1F
0x00C4							uintptr_t PeakVirtualSize	uintptr_t PeakVirtualSize	uintptr_t PeakVirtualSize	uintptr_t PeakVirtualSize																			0x0130
0x00C4	struct _HANDLE_TABLE * ObjectTable			struct _LIST_ENTRY SessionProcessLinks	struct _LIST_ENTRY SessionProcessLinks	unsigned long PeakVirtualSize																							0x0138
0x00C4																unsigned long Flags													0x02FC
0x00C4:0x00																unsigned long CreateReported	unsigned long CreateReported	unsigned long CreateReported	unsigned long CreateReported	unsigned long CreateReported	unsigned long CreateReported	unsigned long CreateReported	unsigned long CreateReported						0x02FC:0x00
0x00C4																							unsigned long Flags				0x0304
0x00C4:0x00												unsigned long CreateReported											0x0304:0x00
0x00C4:0x01											unsigned long NoDebugInherit	unsigned long NoDebugInherit	unsigned long NoDebugInherit	unsigned long NoDebugInherit	unsigned long NoDebugInherit	unsigned long NoDebugInherit	unsigned long NoDebugInherit	unsigned long NoDebugInherit						0x02FC:0x01
0x00C4:0x01																				unsigned long NoDebugInherit				0x0304:0x01
0x00C4:0x02											unsigned long ProcessExiting	unsigned long ProcessExiting	unsigned long ProcessExiting	unsigned long ProcessExiting	unsigned long ProcessExiting	unsigned long ProcessExiting	unsigned long ProcessExiting	unsigned long ProcessExiting						0x02FC:0x02
0x00C4:0x02																				unsigned long ProcessExiting				0x0304:0x02
0x00C4:0x03											unsigned long ProcessDelete	unsigned long ProcessDelete	unsigned long ProcessDelete	unsigned long ProcessDelete	unsigned long ProcessDelete	unsigned long ProcessDelete	unsigned long ProcessDelete	unsigned long ProcessDelete						0x02FC:0x03
0x00C4:0x03																				unsigned long ProcessDelete				0x0304:0x03
0x00C4:0x04											unsigned long Wow64SplitPages	unsigned long Wow64SplitPages	unsigned long ControlFlowGuardEnabled	unsigned long ControlFlowGuardEnabled	unsigned long ControlFlowGuardEnabled	unsigned long ControlFlowGuardEnabled	unsigned long ControlFlowGuardEnabled	unsigned long ControlFlowGuardEnabled						0x02FC:0x04
0x00C4:0x04																				unsigned long ControlFlowGuardEnabled				0x0304:0x04
0x00C4:0x05											unsigned long VmDeleted	unsigned long VmDeleted	unsigned long VmDeleted	unsigned long VmDeleted	unsigned long VmDeleted	unsigned long VmDeleted	unsigned long VmDeleted	unsigned long VmDeleted						0x02FC:0x05
0x00C4:0x05																				unsigned long VmDeleted				0x0304:0x05
0x00C4:0x06											unsigned long OutswapEnabled	unsigned long OutswapEnabled	unsigned long OutswapEnabled	unsigned long OutswapEnabled	unsigned long OutswapEnabled	unsigned long OutswapEnabled	unsigned long OutswapEnabled	unsigned long OutswapEnabled						0x02FC:0x06
0x00C4:0x06																				unsigned long OutswapEnabled				0x0304:0x06
0x00C4:0x07											unsigned long Outswapped	unsigned long Outswapped	unsigned long Outswapped	unsigned long Outswapped	unsigned long Outswapped	unsigned long Outswapped	unsigned long Outswapped	unsigned long Outswapped						0x02FC:0x07
0x00C4:0x07																				unsigned long Outswapped				0x0304:0x07
0x00C4:0x08											unsigned long ForkFailed	unsigned long ForkFailed	unsigned long ForkFailed	unsigned long ForkFailed	unsigned long ForkFailed	unsigned long ForkFailed	unsigned long ForkFailed	unsigned long ForkFailed	unsigned long Spare1					0x02FC:0x08
0x00C4:0x08																				unsigned long FailFastOnCommitFail				0x0304:0x08
0x00C4:0x09											unsigned long Wow64VaSpace4Gb	unsigned long Wow64VaSpace4Gb	unsigned long Wow64VaSpace4Gb	unsigned long Wow64VaSpace4Gb	unsigned long Wow64VaSpace4Gb	unsigned long Wow64VaSpace4Gb	unsigned long Wow64VaSpace4Gb	unsigned long Wow64VaSpace4Gb						0x02FC:0x09
0x00C4:0x09																				unsigned long Wow64VaSpace4Gb				0x0304:0x09
0x00C4:0x0A											unsigned long AddressSpaceInitialized	unsigned long AddressSpaceInitialized	unsigned long AddressSpaceInitialized	unsigned long AddressSpaceInitialized	unsigned long AddressSpaceInitialized	unsigned long AddressSpaceInitialized	unsigned long AddressSpaceInitialized	unsigned long AddressSpaceInitialized						0x02FC:0x0A
0x00C4:0x0A																				unsigned long AddressSpaceInitialized				0x0304:0x0A
0x00C4:0x0C											unsigned long SetTimerResolution	unsigned long SetTimerResolution	unsigned long SetTimerResolution	unsigned long SetTimerResolution	unsigned long SetTimerResolution	unsigned long SetTimerResolution	unsigned long SetTimerResolution	unsigned long SetTimerResolution						0x02FC:0x0C
0x00C4:0x0C																				unsigned long SetTimerResolution				0x0304:0x0C
0x00C4:0x0D											unsigned long BreakOnTermination	unsigned long BreakOnTermination	unsigned long BreakOnTermination	unsigned long BreakOnTermination	unsigned long BreakOnTermination	unsigned long BreakOnTermination	unsigned long BreakOnTermination	unsigned long BreakOnTermination						0x02FC:0x0D
0x00C4:0x0D																				unsigned long BreakOnTermination				0x0304:0x0D
0x00C4:0x0E											unsigned long DeprioritizeViews	unsigned long DeprioritizeViews	unsigned long DeprioritizeViews	unsigned long DeprioritizeViews	unsigned long DeprioritizeViews	unsigned long DeprioritizeViews	unsigned long DeprioritizeViews	unsigned long DeprioritizeViews						0x02FC:0x0E
0x00C4:0x0E																				unsigned long DeprioritizeViews				0x0304:0x0E
0x00C4:0x0F											unsigned long WriteWatch	unsigned long WriteWatch	unsigned long WriteWatch	unsigned long WriteWatch	unsigned long WriteWatch	unsigned long WriteWatch	unsigned long WriteWatch	unsigned long WriteWatch						0x02FC:0x0F
0x00C4:0x0F																				unsigned long WriteWatch				0x0304:0x0F
0x00C4:0x10											unsigned long ProcessInSession	unsigned long ProcessInSession	unsigned long ProcessInSession	unsigned long ProcessInSession	unsigned long ProcessInSession	unsigned long ProcessInSession	unsigned long ProcessInSession	unsigned long ProcessInSession						0x02FC:0x10
0x00C4:0x10																				unsigned long ProcessInSession				0x0304:0x10
0x00C4:0x11											unsigned long OverrideAddressSpace	unsigned long OverrideAddressSpace	unsigned long OverrideAddressSpace	unsigned long OverrideAddressSpace	unsigned long OverrideAddressSpace	unsigned long OverrideAddressSpace	unsigned long OverrideAddressSpace	unsigned long OverrideAddressSpace						0x02FC:0x11
0x00C4:0x11																				unsigned long OverrideAddressSpace				0x0304:0x11
0x00C4:0x12											unsigned long HasAddressSpace	unsigned long HasAddressSpace	unsigned long HasAddressSpace	unsigned long HasAddressSpace	unsigned long HasAddressSpace	unsigned long HasAddressSpace	unsigned long HasAddressSpace	unsigned long HasAddressSpace						0x02FC:0x12
0x00C4:0x12																				unsigned long HasAddressSpace				0x0304:0x12
0x00C4:0x13											unsigned long LaunchPrefetched	unsigned long LaunchPrefetched	unsigned long LaunchPrefetched	unsigned long LaunchPrefetched	unsigned long LaunchPrefetched	unsigned long LaunchPrefetched	unsigned long LaunchPrefetched	unsigned long LaunchPrefetched						0x02FC:0x13
0x00C4:0x13																				unsigned long LaunchPrefetched				0x0304:0x13
0x00C4:0x14											unsigned long Background	unsigned long Background	unsigned long Background	unsigned long Background	unsigned long Background	unsigned long Background	unsigned long Background	unsigned long Background						0x02FC:0x14
0x00C4:0x14																				unsigned long Background				0x0304:0x14
0x00C4:0x15											unsigned long VmTopDown	unsigned long VmTopDown	unsigned long VmTopDown	unsigned long VmTopDown	unsigned long VmTopDown	unsigned long VmTopDown	unsigned long VmTopDown	unsigned long VmTopDown						0x02FC:0x15
0x00C4:0x15																				unsigned long VmTopDown				0x0304:0x15
0x00C4:0x16											unsigned long ImageNotifyDone	unsigned long ImageNotifyDone	unsigned long ImageNotifyDone	unsigned long ImageNotifyDone	unsigned long ImageNotifyDone	unsigned long ImageNotifyDone	unsigned long ImageNotifyDone	unsigned long ImageNotifyDone						0x02FC:0x16
0x00C4:0x16																				unsigned long ImageNotifyDone				0x0304:0x16
0x00C4:0x17											unsigned long PdeUpdateNeeded	unsigned long PdeUpdateNeeded	unsigned long PdeUpdateNeeded	unsigned long PdeUpdateNeeded	unsigned long PdeUpdateNeeded	unsigned long PdeUpdateNeeded	unsigned long PdeUpdateNeeded	unsigned long PdeUpdateNeeded						0x02FC:0x17
0x00C4:0x17																				unsigned long PdeUpdateNeeded				0x0304:0x17
0x00C4:0x18											unsigned long VdmAllowed	unsigned long VdmAllowed	unsigned long VdmAllowed	unsigned long VdmAllowed	unsigned long VdmAllowed	unsigned long VdmAllowed	unsigned long VdmAllowed	unsigned long VdmAllowed						0x02FC:0x18
0x00C4:0x18																				unsigned long VdmAllowed				0x0304:0x18
0x00C4:0x19											unsigned long CrossSessionCreate	unsigned long CrossSessionCreate	unsigned long ProcessRundown	unsigned long ProcessRundown	unsigned long ProcessRundown	unsigned long ProcessRundown	unsigned long ProcessRundown	unsigned long ProcessRundown						0x02FC:0x19
0x00C4:0x19																				unsigned long ProcessRundown				0x0304:0x19
0x00C4:0x1A											unsigned long ProcessInserted	unsigned long ProcessInserted	unsigned long ProcessInserted	unsigned long ProcessInserted	unsigned long ProcessInserted	unsigned long ProcessInserted	unsigned long ProcessInserted	unsigned long ProcessInserted						0x02FC:0x1A
0x00C4:0x1A																				unsigned long ProcessInserted				0x0304:0x1A
0x00C4:0x1B											unsigned long DefaultIoPriority	unsigned long DefaultIoPriority	unsigned long DefaultIoPriority	unsigned long DefaultIoPriority	unsigned long DefaultIoPriority	unsigned long DefaultIoPriority	unsigned long DefaultIoPriority	unsigned long DefaultIoPriority						0x02FC:0x1B
0x00C4:0x1B																				unsigned long DefaultIoPriority				0x0304:0x1B
0x00C4:0x1E											unsigned long ProcessSelfDelete	unsigned long ProcessSelfDelete	unsigned long ProcessSelfDelete	unsigned long ProcessSelfDelete	unsigned long ProcessSelfDelete	unsigned long ProcessSelfDelete	unsigned long ProcessSelfDelete	unsigned long ProcessSelfDelete						0x02FC:0x1E
0x00C4:0x1E																				unsigned long ProcessSelfDelete				0x0304:0x1E
0x00C4:0x1F											unsigned long SetTimerResolutionLink	unsigned long SetTimerResolutionLink	unsigned long SetTimerResolutionLink	unsigned long SetTimerResolutionLink	unsigned long SetTimerResolutionLink	unsigned long SetTimerResolutionLink	unsigned long SetTimerResolutionLink	unsigned long SetTimerResolutionLink						0x02FC:0x1F
0x00C4:0x1F																				unsigned long SetTimerResolutionLink				0x0304:0x1F
0x00C8	struct _EX_FAST_REF Token					uintptr_t VirtualSize		uintptr_t VirtualSize	uintptr_t VirtualSize	uintptr_t VirtualSize			unsigned long[2] ProcessQuotaPeak														0x0138
0x00C8											uintptr_t[2] ProcessQuotaPeak																uintptr_t[2] ProcessQuotaPeak	0x01A8
0x00C8																											uintptr_t[2] ProcessQuotaPeak	uintptr_t[2] ProcessQuotaPeak	0x01F8
0x00C8												uintptr_t[2] ProcessQuotaUsage		uintptr_t[2] ProcessQuotaUsage		uintptr_t[2] ProcessQuotaUsage	uintptr_t[2] ProcessQuotaUsage	uintptr_t[2] ProcessQuotaUsage		uintptr_t[2] ProcessQuotaUsage	uintptr_t[2] ProcessQuotaUsage	uintptr_t[2] ProcessQuotaUsage	unsigned long JobNotReallyActive			unsigned long JobNotReallyActive		0x0300
0x00C8					uint64_t[2] ProcessQuotaUsage														union _LARGE_INTEGER CreateTime				union _LARGE_INTEGER CreateTime	union _LARGE_INTEGER CreateTime		0x0308
0x00CC						struct _LIST_ENTRY SessionProcessLinks	struct _LIST_ENTRY SessionProcessLinks	struct _LIST_ENTRY SessionProcessLinks	struct _LIST_ENTRY SessionProcessLinks																	0x0140
0x00CC	struct _FAST_MUTEX WorkingSetLock		unsigned long WorkingSetPage	void * DebugPort																						struct _LIST_ENTRY SessionProcessLinks		0x0148
0x00D0				void * ExceptionPort	void * ExceptionPort																							0x0150
0x00D0			struct _KGUARDED_MUTEX AddressCreationLock								volatile unsigned long CommitCharge	volatile uint64_t CommitCharge			volatile unsigned long CommitCharge													0x01B8
0x00D0													uintptr_t PeakVirtualSize															uintptr_t PeakVirtualSize	0x0208
0x00D0														uintptr_t[2] ProcessQuotaPeak		uintptr_t[2] ProcessQuotaPeak	uintptr_t[2] ProcessQuotaPeak	uintptr_t[2] ProcessQuotaPeak	uintptr_t[2] ProcessQuotaPeak		uintptr_t[2] ProcessQuotaPeak	uintptr_t[2] ProcessQuotaPeak	uintptr_t[2] ProcessQuotaPeak	uintptr_t[2] ProcessQuotaUsage	uintptr_t[2] ProcessQuotaUsage		uintptr_t[2] ProcessQuotaUsage		0x0310
0x00D4							void * DebugPort	void * DebugPort	void * DebugPort		void * DebugPort																		0x0150
0x00D4				struct _HANDLE_TABLE * ObjectTable	struct _HANDLE_TABLE * ObjectTable																								0x0158
0x00D4												struct _EPROCESS_QUOTA_BLOCK * QuotaBlock	struct _EPROCESS_QUOTA_BLOCK * QuotaBlock																0x01C0
0x00D4						void * DebugPort							struct _EPROCESS_QUOTA_BLOCK * QuotaBlock		uintptr_t VirtualSize														0x0210
0x00D8						unsigned long ExceptionPortState	void * ExceptionPortData																		0x0158
0x00D8							uintptr_t ExceptionPortValue																		0x0158
0x00D8:0x00							uintptr_t ExceptionPortState	uintptr_t ExceptionPortState	uintptr_t ExceptionPortState	uintptr_t ExceptionPortState															0x0158:0x00
0x00D8				struct _EX_FAST_REF Token	struct _EX_FAST_REF Token	void * ExceptionPortData						struct _PS_CPU_QUOTA_BLOCK * CpuQuotaBlock													0x0160
0x00D8											struct _PS_CPU_QUOTA_BLOCK * CpuQuotaBlock														struct _PS_CPU_QUOTA_BLOCK * CpuQuotaBlock				0x01C8
0x00D8														struct _LIST_ENTRY SessionProcessLinks											struct _LIST_ENTRY SessionProcessLinks				0x0218
0x00D8						unsigned long ExceptionPortValue										uintptr_t PeakVirtualSize								uintptr_t[2] ProcessQuotaPeak	uintptr_t[2] ProcessQuotaPeak	uintptr_t[2] ProcessQuotaPeak		0x0320
0x00DC							struct _HANDLE_TABLE * ObjectTable	struct _HANDLE_TABLE * ObjectTable	struct _HANDLE_TABLE * ObjectTable	struct _HANDLE_TABLE * ObjectTable																		0x0160
0x00DC				uintptr_t WorkingSetPage	uintptr_t WorkingSetPage																							0x0168
0x00DC						struct _HANDLE_TABLE * ObjectTable					uintptr_t PeakVirtualSize	uintptr_t PeakVirtualSize	uintptr_t PeakVirtualSize															0x01D0
0x00DC																uintptr_t VirtualSize												0x0328
0x00E0						struct _EX_FAST_REF Token		struct _EX_FAST_REF Token	struct _EX_FAST_REF Token	struct _EX_FAST_REF Token			unsigned long VirtualSize															0x0168
0x00E0				struct _KGUARDED_MUTEX AddressCreationLock	struct _KGUARDED_MUTEX AddressCreationLock																							0x0170
0x00E0											uintptr_t VirtualSize	uintptr_t VirtualSize																0x01D8
0x00E0														void * ExceptionPortData														0x0228
0x00E0														uintptr_t ExceptionPortValue														0x0228
0x00E0:0x00														uintptr_t ExceptionPortState	uintptr_t ExceptionPortState													0x0228:0x00
0x00E0																struct _LIST_ENTRY SessionProcessLinks	struct _LIST_ENTRY SessionProcessLinks	struct _LIST_ENTRY SessionProcessLinks	struct _LIST_ENTRY SessionProcessLinks	struct _LIST_ENTRY SessionProcessLinks	struct _LIST_ENTRY SessionProcessLinks	struct _LIST_ENTRY SessionProcessLinks	struct _LIST_ENTRY SessionProcessLinks		uintptr_t PeakVirtualSize			0x0330
0x00E4						uintptr_t WorkingSetPage		uintptr_t WorkingSetPage	uintptr_t WorkingSetPage	uintptr_t WorkingSetPage			struct _LIST_ENTRY SessionProcessLinks															0x0170
0x00E4											struct _LIST_ENTRY SessionProcessLinks	struct _LIST_ENTRY SessionProcessLinks																0x01E0
0x00E4														struct _EX_FAST_REF Token	struct _EX_FAST_REF Token													0x0230
0x00E4																									uintptr_t VirtualSize			0x0338
0x00E8							struct _EX_PUSH_LOCK AddressCreationLock	struct _EX_PUSH_LOCK AddressCreationLock	struct _EX_PUSH_LOCK AddressCreationLock	struct _EX_PUSH_LOCK AddressCreationLock																		0x0178
0x00E8						struct _EX_PUSH_LOCK AddressCreationLock								uintptr_t WorkingSetPage	uintptr_t WorkingSetPage													0x0238
0x00E8																void * ExceptionPortData									struct _LIST_ENTRY SessionProcessLinks	struct _LIST_ENTRY SessionProcessLinks		0x0340
0x00E8																uintptr_t ExceptionPortValue												0x0340
0x00E8:0x00																uintptr_t ExceptionPortState												0x0340:0x00
0x00EC	unsigned long WorkingSetPage					struct _ETHREAD * RotateInProgress		struct _ETHREAD * RotateInProgress	struct _ETHREAD * RotateInProgress	struct _ETHREAD * RotateInProgress			void * DebugPort															0x0180
0x00EC											void * DebugPort	void * DebugPort																0x01F0
0x00EC														struct _EX_PUSH_LOCK AddressCreationLock	struct _EX_PUSH_LOCK AddressCreationLock													0x0240
0x00EC																struct _EX_FAST_REF Token												uint64_t ExceptionPortState	0x0348
0x00F0							struct _ETHREAD * ForkInProgress	struct _ETHREAD * ForkInProgress	struct _ETHREAD * ForkInProgress	struct _ETHREAD * ForkInProgress																			0x0188
0x00F0											void * ExceptionPortData																		0x01F8
0x00F0											uintptr_t ExceptionPortValue																		0x01F8
0x00F0:0x00											uintptr_t ExceptionPortState	uintptr_t ExceptionPortState																	0x01F8:0x00
0x00F0	struct _FAST_MUTEX AddressCreationLock		unsigned long HyperSpaceLock			struct _ETHREAD * ForkInProgress							void * ExceptionPortData	struct _ETHREAD * RotateInProgress	struct _ETHREAD * RotateInProgress														0x0248
0x00F0													uintptr_t ExceptionPortValue			uintptr_t WorkingSetPage								uintptr_t ExceptionPortValue		void * ExceptionPortData		uintptr_t ExceptionPortValue	0x0350
0x00F0:0x00													uintptr_t ExceptionPortState											uintptr_t ExceptionPortState		uintptr_t ExceptionPortValue		uintptr_t ExceptionPortState	0x0350:0x00
0x00F0:0x00																										uintptr_t ExceptionPortState			0x0350:0x00
0x00F4							uintptr_t HardwareTrigger	uintptr_t HardwareTrigger	uintptr_t HardwareTrigger	uintptr_t HardwareTrigger																			0x0190
0x00F4			struct _ETHREAD * ForkInProgress			unsigned long HardwareTrigger					struct _HANDLE_TABLE * ObjectTable	struct _HANDLE_TABLE * ObjectTable	struct _HANDLE_TABLE * ObjectTable																0x0200
0x00F4														struct _ETHREAD * ForkInProgress	struct _ETHREAD * ForkInProgress														0x0250
0x00F4																struct _EX_PUSH_LOCK AddressCreationLock										struct _EX_FAST_REF Token			0x0358
0x00F8							struct _MM_AVL_TABLE * PhysicalVadRoot	struct _MM_AVL_TABLE * PhysicalVadRoot	struct _MM_AVL_TABLE * PhysicalVadRoot	struct _MM_AVL_TABLE * PhysicalVadRoot																			0x0198
0x00F8			unsigned long HardwareTrigger			struct _MM_AVL_TABLE * PhysicalVadRoot					struct _EX_FAST_REF Token	struct _EX_FAST_REF Token	struct _EX_FAST_REF Token																0x0208
0x00F8														uintptr_t HardwareTrigger	uintptr_t HardwareTrigger														0x0258
0x00F8																struct _ETHREAD * RotateInProgress		struct _EX_PUSH_LOCK PageTableCommitmentLock								uintptr_t WorkingSetPage			0x0360
0x00FC							void * CloneRoot	void * CloneRoot	void * CloneRoot	void * CloneRoot																			0x01A0
0x00FC			struct _MM_AVL_TABLE * PhysicalVadRoot			void * CloneRoot					uintptr_t WorkingSetPage	uintptr_t WorkingSetPage	uintptr_t WorkingSetPage																0x0210
0x00FC														struct _EJOB * volatile CommitChargeJob	struct _EJOB * volatile CommitChargeJob														0x0260
0x00FC																struct _ETHREAD * ForkInProgress		struct _ETHREAD * RotateInProgress								struct _EX_PUSH_LOCK AddressCreationLock			0x0368
0x0100				uintptr_t HyperSpaceLock	uintptr_t HyperSpaceLock		volatile unsigned long NumberOfPrivatePages	volatile uint64_t NumberOfPrivatePages	volatile unsigned long NumberOfPrivatePages	volatile uint64_t NumberOfPrivatePages																			0x01A8
0x0100			void * CloneRoot			volatile unsigned long NumberOfPrivatePages					struct _EX_PUSH_LOCK AddressCreationLock	struct _EX_PUSH_LOCK AddressCreationLock	struct _EX_PUSH_LOCK AddressCreationLock																0x0218
0x0100														struct _MM_AVL_TABLE * CloneRoot	struct _MM_AVL_TABLE * CloneRoot														0x0268
0x0100																uintptr_t HardwareTrigger		struct _ETHREAD * ForkInProgress								struct _EX_PUSH_LOCK PageTableCommitmentLock			0x0370
0x0104				struct _ETHREAD * ForkInProgress	struct _ETHREAD * ForkInProgress		volatile unsigned long NumberOfLockedPages	volatile uint64_t NumberOfLockedPages	volatile unsigned long NumberOfLockedPages	volatile uint64_t NumberOfLockedPages																			0x01B0
0x0104											struct _ETHREAD * RotateInProgress	struct _ETHREAD * RotateInProgress																	0x0220
0x0104			unsigned long NumberOfPrivatePages			volatile unsigned long NumberOfLockedPages							struct _ETHREAD * RotateInProgress	volatile unsigned long NumberOfPrivatePages	volatile uint64_t NumberOfPrivatePages														0x0270
0x0104																struct _EJOB * volatile CommitChargeJob										struct _ETHREAD * RotateInProgress			0x0378
0x0108			unsigned long NumberOfLockedPages	uintptr_t HardwareTrigger	uintptr_t HardwareTrigger	void * Win32Process		void * Win32Process	void * Win32Process	void * Win32Process			struct _ETHREAD * ForkInProgress																0x01B8
0x0108											struct _ETHREAD * ForkInProgress	struct _ETHREAD * ForkInProgress																	0x0228
0x0108														volatile unsigned long NumberOfLockedPages	volatile uint64_t NumberOfLockedPages														0x0278
0x0108																struct _MM_AVL_TABLE * CloneRoot		struct _RTL_AVL_TREE CloneRoot								struct _ETHREAD * ForkInProgress			0x0380
0x010C				struct _MM_AVL_TABLE * PhysicalVadRoot	struct _MM_AVL_TABLE * PhysicalVadRoot		struct _EJOB * Job	struct _EJOB * Job	struct _EJOB * Job	struct _EJOB * Job																			0x01C0
0x010C											uintptr_t HardwareTrigger	uintptr_t HardwareTrigger																	0x0230
0x010C			void * Win32Process			struct _EJOB * Job							unsigned long HardwareTrigger	void * Win32Process	void * Win32Process														0x0280
0x010C																volatile unsigned long NumberOfPrivatePages	volatile uint64_t NumberOfPrivatePages	volatile unsigned long NumberOfPrivatePages	volatile uint64_t NumberOfPrivatePages	volatile unsigned long NumberOfPrivatePages	volatile uint64_t NumberOfPrivatePages	volatile unsigned long NumberOfPrivatePages	volatile uint64_t NumberOfPrivatePages			struct _EJOB * volatile CommitChargeJob			0x0388
0x0110				void * CloneRoot	void * CloneRoot		void * SectionObject	void * SectionObject	void * SectionObject	void * SectionObject																			0x01C8
0x0110											struct _MM_AVL_TABLE * PhysicalVadRoot	struct _MM_AVL_TABLE * PhysicalVadRoot																	0x0238
0x0110														struct _EJOB * volatile Job	struct _EJOB * volatile Job														0x0288
0x0110	unsigned long HyperSpaceLock		struct _EJOB * Job			void * SectionObject							struct _MM_AVL_TABLE * PhysicalVadRoot			volatile unsigned long NumberOfLockedPages	volatile uint64_t NumberOfLockedPages	volatile unsigned long NumberOfLockedPages	volatile uint64_t NumberOfLockedPages	volatile unsigned long NumberOfLockedPages	volatile uint64_t NumberOfLockedPages	volatile unsigned long NumberOfLockedPages	volatile uint64_t NumberOfLockedPages			struct _RTL_AVL_TREE CloneRoot			0x0390
0x0114				uintptr_t NumberOfPrivatePages	uintptr_t NumberOfPrivatePages		void * SectionBaseAddress	void * SectionBaseAddress	void * SectionBaseAddress	void * SectionBaseAddress																			0x01D0
0x0114											void * CloneRoot	void * CloneRoot																	0x0240
0x0114														void * SectionObject	void * SectionObject														0x0290
0x0114	struct _ETHREAD * ForkInProgress		void * SectionObject			void * SectionBaseAddress							void * CloneRoot			void * Win32Process										volatile unsigned long NumberOfPrivatePages	volatile uint64_t NumberOfPrivatePages		0x0398
0x0118				uintptr_t NumberOfLockedPages	uintptr_t NumberOfLockedPages		struct _EPROCESS_QUOTA_BLOCK * QuotaBlock	struct _EPROCESS_QUOTA_BLOCK * QuotaBlock	struct _EPROCESS_QUOTA_BLOCK * QuotaBlock	struct _EPROCESS_QUOTA_BLOCK * QuotaBlock																			0x01D8
0x0118											volatile unsigned long NumberOfPrivatePages	volatile uint64_t NumberOfPrivatePages																	0x0248
0x0118	unsigned long HardwareTrigger		void * SectionBaseAddress			struct _EPROCESS_QUOTA_BLOCK * QuotaBlock							volatile unsigned long NumberOfPrivatePages	void * SectionBaseAddress	void * SectionBaseAddress														0x0298
0x0118																struct _EJOB * volatile Job										volatile unsigned long NumberOfLockedPages	volatile uint64_t NumberOfLockedPages		0x03A0
0x011C				void * Win32Process	void * Win32Process		struct _PAGEFAULT_HISTORY * WorkingSetWatch	struct _PAGEFAULT_HISTORY * WorkingSetWatch	struct _PAGEFAULT_HISTORY * WorkingSetWatch	struct _PAGEFAULT_HISTORY * WorkingSetWatch																			0x01E0
0x011C											volatile unsigned long NumberOfLockedPages	volatile uint64_t NumberOfLockedPages																	0x0250
0x011C												void * Spare		unsigned long Cookie	unsigned long Cookie														0x02A0
0x011C	void * VadRoot		struct _EPROCESS_QUOTA_BLOCK * QuotaBlock			struct _PAGEFAULT_HISTORY * WorkingSetWatch							volatile unsigned long NumberOfLockedPages			void * SectionObject								struct _EJOB * volatile Job	void * Win32Process				0x03A8
0x0120				struct _EJOB * Job	struct _EJOB * Job		void * Win32WindowStation	void * Win32WindowStation	void * Win32WindowStation	void * Win32WindowStation																			0x01E8
0x0120	void * VadHint		struct _PAGEFAULT_HISTORY * WorkingSetWatch			void * Win32WindowStation					void * Win32Process	void * Win32Process	void * Win32Process	void * VdmObjects															0x0258
0x0120																void * SectionBaseAddress										struct _EJOB * volatile Job			0x03B0
0x0124	void * CloneRoot		void * Win32WindowStation	void * SectionObject	void * SectionObject	void * InheritedFromUniqueProcessId		void * InheritedFromUniqueProcessId	void * InheritedFromUniqueProcessId	void * InheritedFromUniqueProcessId			struct _EJOB * volatile Job																0x01F0
0x0124											struct _EJOB * volatile Job	struct _EJOB * volatile Job																	0x0260
0x0124														struct _PAGEFAULT_HISTORY * WorkingSetWatch	struct _PAGEFAULT_HISTORY * WorkingSetWatch														0x02A8
0x0124																unsigned long Cookie										void * SectionObject			0x03B8
0x0128				void * SectionBaseAddress	void * SectionBaseAddress		void * LdtInformation	void * LdtInformation	void * LdtInformation	void * LdtInformation																			0x01F8
0x0128											void * SectionObject	void * SectionObject																	0x0268
0x0128	unsigned long NumberOfPrivatePages		void * InheritedFromUniqueProcessId			void * LdtInformation							void * SectionObject	void * Win32WindowStation	void * Win32WindowStation	void * VdmObjects		void * VdmObjects		void * VdmObjects		void * VdmObjects							0x02B0
0x0128																										void * SectionBaseAddress			0x03C0
0x012C				struct _EPROCESS_QUOTA_BLOCK * QuotaBlock	struct _EPROCESS_QUOTA_BLOCK * QuotaBlock		void * Spare	void * Spare	void * Spare	void * Spare																			0x0200
0x012C	unsigned long NumberOfLockedPages		void * LdtInformation			void * VadFreeHint					void * SectionBaseAddress	void * SectionBaseAddress	void * SectionBaseAddress																0x0270
0x012C														void * InheritedFromUniqueProcessId	void * InheritedFromUniqueProcessId														0x02B8
0x012C																struct _PAGEFAULT_HISTORY * WorkingSetWatch	struct _PAGEFAULT_HISTORY * WorkingSetWatch	struct _PAGEFAULT_HISTORY * WorkingSetWatch	struct _PAGEFAULT_HISTORY * WorkingSetWatch	struct _PAGEFAULT_HISTORY * WorkingSetWatch	struct _PAGEFAULT_HISTORY * WorkingSetWatch	struct _PAGEFAULT_HISTORY * WorkingSetWatch	struct _PAGEFAULT_HISTORY * WorkingSetWatch						0x03C0
0x012C																										unsigned long Cookie			0x03C8
0x0130				struct _PAGEFAULT_HISTORY * WorkingSetWatch	struct _PAGEFAULT_HISTORY * WorkingSetWatch		void * VdmObjects	void * VdmObjects	void * VdmObjects	void * VdmObjects																			0x0208
0x0130	void * Win32Process		void * VadFreeHint			void * VdmObjects		void * Wow64Process		void * Wow64Process	unsigned long Cookie	unsigned long Cookie	unsigned long Cookie	void * LdtInformation															0x0278
0x0130																void * Win32WindowStation	void * Win32WindowStation	void * Win32WindowStation	void * Win32WindowStation	void * Win32WindowStation	void * Win32WindowStation	void * Win32WindowStation	void * Win32WindowStation	struct _PAGEFAULT_HISTORY * WorkingSetWatch	unsigned long Cookie			unsigned long Cookie	0x03C8
0x0130																										struct _PAGEFAULT_HISTORY * WorkingSetWatch			0x03D0
0x0134	struct _EJOB * Job		void * VdmObjects	void * Win32WindowStation	void * Win32WindowStation	void * DeviceMap		void * DeviceMap	void * DeviceMap	void * DeviceMap			unsigned long Spare8																0x0210
0x0134											unsigned long Spare8	unsigned long Spare8																	0x027C
0x0134														struct _EPROCESS * CreatorProcess															0x02C0
0x0134														uintptr_t ConsoleHostProcess	uintptr_t ConsoleHostProcess														0x02C0
0x0134																void * InheritedFromUniqueProcessId	void * InheritedFromUniqueProcessId	void * InheritedFromUniqueProcessId	void * InheritedFromUniqueProcessId	void * InheritedFromUniqueProcessId	void * InheritedFromUniqueProcessId	void * InheritedFromUniqueProcessId	void * InheritedFromUniqueProcessId	void * Win32WindowStation	struct _PAGEFAULT_HISTORY * WorkingSetWatch			struct _PAGEFAULT_HISTORY * WorkingSetWatch	0x03D0
0x0134																										void * Win32WindowStation			0x03D8
0x0138	void * SectionObject		void * DeviceMap	void * InheritedFromUniqueProcessId	void * InheritedFromUniqueProcessId	void * EtwDataSource		void * EtwDataSource	void * EtwDataSource	void * EtwDataSource			struct _PAGEFAULT_HISTORY * WorkingSetWatch																0x0218
0x0138											struct _PAGEFAULT_HISTORY * WorkingSetWatch	struct _PAGEFAULT_HISTORY * WorkingSetWatch																	0x0280
0x0138														struct _PEB * Peb	struct _PEB * Peb														0x02C8
0x0138																void * LdtInformation	void * LdtInformation	void * LdtInformation	void * LdtInformation	void * LdtInformation	void * LdtInformation	void * LdtInformation	void * LdtInformation						0x03D8
0x0138																								void * LdtInformation	void * InheritedFromUniqueProcessId				0x03E0
0x013C				void * LdtInformation	void * LdtInformation		void * FreeTebHint	void * FreeTebHint	void * FreeTebHint	void * FreeTebHint																			0x0220
0x013C											void * Win32WindowStation	void * Win32WindowStation																	0x0288
0x013C	void * SectionBaseAddress		void *[3] Spare0			void * FreeTebHint							void * Win32WindowStation	void * Session	void * Session														0x02D0
0x013C																struct _EPROCESS * CreatorProcess		volatile unsigned long OwnerProcessId	volatile uint64_t OwnerProcessId	volatile unsigned long OwnerProcessId	volatile uint64_t OwnerProcessId	volatile unsigned long OwnerProcessId	volatile uint64_t OwnerProcessId						0x03E0
0x013C																uintptr_t ConsoleHostProcess	uintptr_t ConsoleHostProcess												0x03E0
0x013C																										void * LdtInformation			0x03E8
0x0140	struct _EPROCESS_QUOTA_BLOCK * QuotaBlock			void * VadFreeHint	void * VadFreeHint	struct _HARDWARE_PTE_X86 PageDirectoryPte		struct _HARDWARE_PTE PageDirectoryPte	struct _HARDWARE_PTE_X86 PageDirectoryPte	struct _HARDWARE_PTE PageDirectoryPte			void * InheritedFromUniqueProcessId																0x0228
0x0140						uint64_t Filler		uint64_t Filler	uint64_t Filler	uint64_t Filler																			0x0228
0x0140											void * InheritedFromUniqueProcessId	void * InheritedFromUniqueProcessId																	0x0290
0x0140														void * AweInfo	void * AweInfo														0x02D8
0x0140																struct _PEB * Peb	struct _PEB * Peb	struct _PEB * Peb	struct _PEB * Peb	struct _PEB * Peb	struct _PEB * Peb	struct _PEB * Peb	struct _PEB * Peb	volatile uint64_t OwnerProcessId	void * LdtInformation			void * LdtInformation	0x03E8
0x0140																										volatile unsigned long OwnerProcessId	volatile uint64_t OwnerProcessId		0x03F0
0x0144				void * VdmObjects	void * VdmObjects																								0x0230
0x0144											void * LdtInformation	void * LdtInformation																	0x0298
0x0144														struct _EPROCESS_QUOTA_BLOCK * QuotaBlock	struct _EPROCESS_QUOTA_BLOCK * QuotaBlock														0x02E0
0x0144	struct _PAGEFAULT_HISTORY * WorkingSetWatch												void * LdtInformation			void * Session	void * Session	void * Session	void * Session	void * Session	void * Session	void * Session	void * Session	struct _PEB * Peb	volatile uint64_t OwnerProcessId			volatile uint64_t OwnerProcessId	0x03F0
0x0144																										struct _PEB * Peb			0x03F8
0x0148							void * Session	void * Session	void * Session	void * Session																			0x0230
0x0148			uint64_t Filler	void * DeviceMap	void * DeviceMap																								0x0238
0x0148	void * Win32WindowStation		struct _HARDWARE_PTE_X86 PageDirectoryPte			void * Session					void * VdmObjects		void * VdmObjects	struct _HANDLE_TABLE * ObjectTable	struct _HANDLE_TABLE * ObjectTable									struct _LIST_ENTRY ActiveProcessLinks	void * UniqueProcessId			void * UniqueProcessId	0x02E8
0x0148																void * AweInfo	void * AweInfo	void * AweInfo	void * AweInfo	void * AweInfo	void * AweInfo	void * AweInfo	void * AweInfo	void * Session	struct _PEB * Peb			struct _PEB * Peb	0x03F8
0x0148																										void * Session			0x0400
0x014C	void * InheritedFromUniqueProcessId					uint8_t[16] ImageFileName		uint8_t[16] ImageFileName	uint8_t[16] ImageFileName	uint8_t[16] ImageFileName			unsigned long ConsoleHostProcess																0x0238
0x014C				void *[3] Spare0	void *[3] Spare0																								0x0240
0x014C					struct _WOW64_PROCESS * Wow64Process						uintptr_t ConsoleHostProcess	uintptr_t ConsoleHostProcess																	0x02A8
0x014C														void * DebugPort	void * DebugPort														0x02F0
0x014C																struct _EPROCESS_QUOTA_BLOCK * QuotaBlock	struct _EPROCESS_QUOTA_BLOCK * QuotaBlock	struct _EPROCESS_QUOTA_BLOCK * QuotaBlock	struct _EPROCESS_QUOTA_BLOCK * QuotaBlock	struct _EPROCESS_QUOTA_BLOCK * QuotaBlock	struct _EPROCESS_QUOTA_BLOCK * QuotaBlock	struct _EPROCESS_QUOTA_BLOCK * QuotaBlock	struct _EPROCESS_QUOTA_BLOCK * QuotaBlock	void * AweInfo	void * Session			void * Session	0x0400
0x014C																								struct _EPROCESS_QUOTA_BLOCK * QuotaBlock	void * AweInfo				0x0408
0x0150	void * LdtInformation		void * Session								void * DeviceMap	void * DeviceMap	void * DeviceMap	void * PaeTop															0x02B0
0x0150																struct _HANDLE_TABLE * ObjectTable	struct _HANDLE_TABLE * ObjectTable	struct _HANDLE_TABLE * ObjectTable	struct _HANDLE_TABLE * ObjectTable	struct _HANDLE_TABLE * ObjectTable	struct _HANDLE_TABLE * ObjectTable	struct _HANDLE_TABLE * ObjectTable	struct _HANDLE_TABLE * ObjectTable						0x0408
0x0150																								struct _HANDLE_TABLE * ObjectTable	struct _EPROCESS_QUOTA_BLOCK * QuotaBlock				0x0410
0x0154											void * EtwDataSource	void * EtwDataSource																	0x02B8
0x0154														void * DeviceMap	void * DeviceMap									union _LARGE_INTEGER CreateTime	unsigned long Flags2			unsigned long Flags2	0x0300
0x0154																void * DebugPort	void * DebugPort	void * DebugPort	void * DebugPort	void * DebugPort	void * DebugPort	void * DebugPort	void * DebugPort						0x0410
0x0154	void * VadFreeHint		uint8_t[16] ImageFileName										void * EtwDataSource				void * Wow64Process		void * Wow64Process		void * Wow64Process		void * Wow64Process	void * DebugPort	struct _HANDLE_TABLE * ObjectTable				0x0418
0x0158				struct _HARDWARE_PTE_X86 PageDirectoryPte	struct _HARDWARE_PTE PageDirectoryPte																								0x0258
0x0158				uint64_t Filler	uint64_t Filler																								0x0258
0x0158											void * FreeTebHint	void * FreeTebHint																	0x02C0
0x0158														void * EtwDataSource	void * EtwDataSource														0x0308
0x0158	void * VdmObjects												void * FreeTebHint			void * PaeTop		void * PaeTop		void * PaeTop		void * PaeTop				void * DebugPort			0x0420
0x015C	void * DeviceMap					struct _LIST_ENTRY JobLinks		struct _LIST_ENTRY JobLinks	struct _LIST_ENTRY JobLinks	struct _LIST_ENTRY JobLinks																void * PaeTop			0x0248
0x015C																void * DeviceMap								void * Wow64Process	void * DebugPort			void * DebugPort	0x0420
0x0160				void * Session	void * Session																								0x0260
0x0160											struct _HARDWARE_PTE_X86 PageDirectoryPte	struct _HARDWARE_PTE PageDirectoryPte	uint64_t Filler																0x02C8
0x0160											uint64_t Filler	uint64_t Filler																	0x02C8
0x0160														struct _HARDWARE_PTE_X86 PageDirectoryPte	struct _HARDWARE_PTE PageDirectoryPte														0x0310
0x0160														uint64_t Filler	uint64_t Filler														0x0310
0x0160	struct _LIST_ENTRY PhysicalVadList												struct _HARDWARE_PTE_X86 PageDirectoryPte			void * EtwDataSource	void * EtwDataSource	void * EtwDataSource	void * EtwDataSource	void * EtwDataSource	void * EtwDataSource	void * EtwDataSource	void * EtwDataSource	void * DeviceMap	void * Wow64Process		void * Wow64Process	struct _EWOW64PROCESS * WoW64Process	0x0428
0x0160																										void * DeviceMap			0x0430
0x0164							void * LockedPagesList	void * LockedPagesList	void * LockedPagesList	void * LockedPagesList																			0x0258
0x0164				uint8_t[16] ImageFileName	uint8_t[16] ImageFileName																								0x0268
0x0164			struct _LIST_ENTRY JobLinks			void * LockedPagesList																				void * EtwDataSource			0x0438
0x0168	struct _HARDWARE_PTE_X86 PageDirectoryPte					struct _LIST_ENTRY ThreadListHead		struct _LIST_ENTRY ThreadListHead	struct _LIST_ENTRY ThreadListHead	struct _LIST_ENTRY ThreadListHead			void * Session																0x0260
0x0168											void * Session	void * Session																	0x02D0
0x0168														uint8_t[15] ImageFileName	uint8_t[15] ImageFileName														0x0318
0x0168																uint64_t PageDirectoryPte	uint64_t PageDirectoryPte	uint64_t PageDirectoryPte	uint64_t PageDirectoryPte	uint64_t PageDirectoryPte	uint64_t PageDirectoryPte	uint64_t PageDirectoryPte	uint64_t PageDirectoryPte	void * EtwDataSource	void * DeviceMap			void * DeviceMap	0x0430
0x0168	uint64_t Filler																							uint8_t[15] ImageFileName	uint64_t PageDirectoryPte	uint64_t PageDirectoryPte	uint64_t PageDirectoryPte		0x0440
0x016C			void * LockedPagesList								uint8_t[15] ImageFileName	uint8_t[15] ImageFileName	uint8_t[15] ImageFileName																0x02D8
0x0170							void * SecurityPort	void * SecurityPort	void * SecurityPort	void * SecurityPort																			0x0270
0x0170	void * Session		struct _LIST_ENTRY ThreadListHead			void * SecurityPort										uint8_t[15] ImageFileName	uint8_t[15] ImageFileName	uint8_t[15] ImageFileName	uint8_t[15] ImageFileName	uint8_t[15] ImageFileName	uint8_t[15] ImageFileName	uint8_t[15] ImageFileName	uint8_t[15] ImageFileName	uint64_t PageDirectoryPte	void * EtwDataSource			void * EtwDataSource	0x0438
0x0170																										uint8_t[15] ImageFileName	uint8_t[15] ImageFileName		0x0448
0x0174	uint8_t[16] ImageFileName			struct _LIST_ENTRY JobLinks	struct _LIST_ENTRY JobLinks	void * PaeTop			void * PaeTop																				0x0278
0x0177														uint8_t PriorityClass															0x0327
0x0178							volatile unsigned long ActiveThreads	volatile unsigned long ActiveThreads	volatile unsigned long ActiveThreads	volatile unsigned long ActiveThreads																			0x0280
0x0178			void * SecurityPort			volatile unsigned long ActiveThreads								void * SecurityPort	void * SecurityPort														0x0328
0x017B											uint8_t PriorityClass																		0x02E7
0x017C							unsigned long ImagePathHash	unsigned long ImagePathHash	unsigned long ImagePathHash	unsigned long ImagePathHash																			0x0284
0x017C			void * PaeTop	void * LockedPagesList	void * LockedPagesList	unsigned long ImagePathHash							struct _LIST_ENTRY JobLinks																0x0288
0x017C											struct _LIST_ENTRY JobLinks	struct _LIST_ENTRY JobLinks																	0x02E8
0x017C														struct _SE_AUDIT_PROCESS_CREATION_INFO SeAuditProcessCreationInfo	struct _SE_AUDIT_PROCESS_CREATION_INFO SeAuditProcessCreationInfo														0x0330
0x017F																uint8_t PriorityClass													0x0447
																								uint8_t PriorityClass					0x044F
0x017F																									uint8_t PriorityClass				0x0457
0x0180							unsigned long DefaultHardErrorProcessing	unsigned long DefaultHardErrorProcessing	unsigned long DefaultHardErrorProcessing	unsigned long DefaultHardErrorProcessing																			0x0288
0x0180				struct _LIST_ENTRY ThreadListHead	struct _LIST_ENTRY ThreadListHead																								0x0290
0x0180														struct _LIST_ENTRY JobLinks	struct _LIST_ENTRY JobLinks														0x0338
0x0180			unsigned long ActiveThreads			unsigned long DefaultHardErrorProcessing										void * SecurityPort	void * SecurityPort	void * SecurityPort	void * SecurityPort	void * SecurityPort	void * SecurityPort	void * SecurityPort	void * SecurityPort		uint8_t[15] ImageFileName			struct _FILE_OBJECT * ImageFilePointer	0x0448
0x0180																								struct _SE_AUDIT_PROCESS_CREATION_INFO SeAuditProcessCreationInfo	void * SecurityPort				0x0458
0x0184							long LastThreadExitStatus	long LastThreadExitStatus	long LastThreadExitStatus	long LastThreadExitStatus																			0x028C
0x0184	struct _LIST_ENTRY JobLinks		unsigned long GrantedAccess			long LastThreadExitStatus					void * LockedPagesList	void * LockedPagesList	void * LockedPagesList		void * Wow64Process									unsigned long Flags2					0x02F8
0x0184																struct _SE_AUDIT_PROCESS_CREATION_INFO SeAuditProcessCreationInfo													0x0450
																												uint8_t PriorityClass	0x045F
0x0184																										struct _SE_AUDIT_PROCESS_CREATION_INFO SeAuditProcessCreationInfo			0x0460
0x0188							struct _PEB * Peb	struct _PEB * Peb	struct _PEB * Peb	struct _PEB * Peb																			0x0290
0x0188				void * SecurityPort	void * SecurityPort																								0x02A0
0x0188											struct _LIST_ENTRY ThreadListHead	struct _LIST_ENTRY ThreadListHead																	0x0300
0x0188			unsigned long DefaultHardErrorProcessing			struct _PEB * Peb							struct _LIST_ENTRY ThreadListHead	void * HighestUserAddress	void * HighestUserAddress									void * ExceptionPortData					0x0348
0x0188																struct _LIST_ENTRY JobLinks	struct _LIST_ENTRY JobLinks	struct _LIST_ENTRY JobLinks	struct _LIST_ENTRY JobLinks	struct _LIST_ENTRY JobLinks	struct _LIST_ENTRY JobLinks	struct _LIST_ENTRY JobLinks	struct _LIST_ENTRY JobLinks						0x0458
0x0188																										struct _LIST_ENTRY JobLinks	struct _LIST_ENTRY JobLinks		0x0468
0x018C	void * LockedPagesList		long LastThreadExitStatus	void * PaeTop		struct _EX_FAST_REF PrefetchTrace		struct _EX_FAST_REF PrefetchTrace	struct _EX_FAST_REF PrefetchTrace	struct _EX_FAST_REF PrefetchTrace																			0x0298
0x018C														struct _LIST_ENTRY ThreadListHead	struct _LIST_ENTRY ThreadListHead														0x0350
0x0190							union _LARGE_INTEGER ReadOperationCount	union _LARGE_INTEGER ReadOperationCount	union _LARGE_INTEGER ReadOperationCount	union _LARGE_INTEGER ReadOperationCount																			0x02A0
0x0190	struct _LIST_ENTRY ThreadListHead		struct _PEB * Peb	unsigned long ActiveThreads	unsigned long ActiveThreads	union _LARGE_INTEGER ReadOperationCount							void * SecurityPort																0x02B0
0x0190											void * SecurityPort	void * SecurityPort																	0x0310
0x0190																void * HighestUserAddress	void * HighestUserAddress	void * HighestUserAddress	void * HighestUserAddress	void * HighestUserAddress	void * HighestUserAddress	void * HighestUserAddress	void * HighestUserAddress						0x0468
0x0190																								struct _LIST_ENTRY ThreadListHead	void * HighestUserAddress				0x0478
0x0194				unsigned long GrantedAccess	unsigned long GrantedAccess																								0x02B4
0x0194														volatile unsigned long ActiveThreads	volatile unsigned long ActiveThreads														0x0360
0x0194																struct _LIST_ENTRY ThreadListHead	struct _LIST_ENTRY ThreadListHead	struct _LIST_ENTRY ThreadListHead	struct _LIST_ENTRY ThreadListHead	struct _LIST_ENTRY ThreadListHead	struct _LIST_ENTRY ThreadListHead	struct _LIST_ENTRY ThreadListHead	struct _LIST_ENTRY ThreadListHead						0x0470
0x0194			struct _EX_FAST_REF PrefetchTrace								void * PaeTop		void * PaeTop													struct _LIST_ENTRY ThreadListHead	struct _LIST_ENTRY ThreadListHead		0x0480
0x0198							union _LARGE_INTEGER WriteOperationCount	union _LARGE_INTEGER WriteOperationCount	union _LARGE_INTEGER WriteOperationCount	union _LARGE_INTEGER WriteOperationCount																			0x02A8
0x0198	void * SecurityPort		union _LARGE_INTEGER ReadOperationCount	unsigned long DefaultHardErrorProcessing	unsigned long DefaultHardErrorProcessing	union _LARGE_INTEGER WriteOperationCount							volatile unsigned long ActiveThreads																0x02B8
0x0198											volatile unsigned long ActiveThreads	volatile unsigned long ActiveThreads																	0x0320
0x0198														unsigned long ImagePathHash															0x0364
0x019C				long LastThreadExitStatus	long LastThreadExitStatus																								0x02BC
0x019C											unsigned long ImagePathHash	unsigned long ImagePathHash																	0x0324
0x019C	void * PaeTop												unsigned long ImagePathHash	unsigned long DefaultHardErrorProcessing	unsigned long DefaultHardErrorProcessing														0x0368
0x019C																volatile unsigned long ActiveThreads	volatile unsigned long ActiveThreads	volatile unsigned long ActiveThreads	volatile unsigned long ActiveThreads	volatile unsigned long ActiveThreads	volatile unsigned long ActiveThreads	volatile unsigned long ActiveThreads	volatile unsigned long ActiveThreads						0x0480
0x019C																										volatile unsigned long ActiveThreads			0x0490
0x01A0							union _LARGE_INTEGER OtherOperationCount	union _LARGE_INTEGER OtherOperationCount	union _LARGE_INTEGER OtherOperationCount	union _LARGE_INTEGER OtherOperationCount																			0x02B0
0x01A0				struct _PEB * Peb	struct _PEB * Peb																								0x02C0
0x01A0	unsigned long ActiveThreads		union _LARGE_INTEGER WriteOperationCount			union _LARGE_INTEGER OtherOperationCount					unsigned long DefaultHardErrorProcessing	unsigned long DefaultHardErrorProcessing	unsigned long DefaultHardErrorProcessing											uint64_t PeakVirtualSize					0x0328
0x01A0														long LastThreadExitStatus	long LastThreadExitStatus														0x036C
0x01A0																unsigned long ImagePathHash	unsigned long ImagePathHash	unsigned long ImagePathHash	unsigned long ImagePathHash	unsigned long ImagePathHash	unsigned long ImagePathHash	unsigned long ImagePathHash	unsigned long ImagePathHash						0x0484
0x01A0																								long LastThreadExitStatus	unsigned long ImagePathHash				0x0494
0x01A4				struct _EX_FAST_REF PrefetchTrace	struct _EX_FAST_REF PrefetchTrace																								0x02C8
0x01A4											long LastThreadExitStatus	long LastThreadExitStatus																	0x032C
0x01A4	unsigned long GrantedAccess												long LastThreadExitStatus	struct _EX_FAST_REF PrefetchTrace	struct _EX_FAST_REF PrefetchTrace									struct _ETHREAD * RotateInProgress	struct _EX_PUSH_LOCK PageTableCommitmentLock			struct _EX_PUSH_LOCK PageTableCommitmentLock	0x0370
0x01A4																unsigned long DefaultHardErrorProcessing	unsigned long DefaultHardErrorProcessing	unsigned long DefaultHardErrorProcessing	unsigned long DefaultHardErrorProcessing	unsigned long DefaultHardErrorProcessing	unsigned long DefaultHardErrorProcessing	unsigned long DefaultHardErrorProcessing	unsigned long DefaultHardErrorProcessing	volatile unsigned long ActiveThreads				struct _LIST_ENTRY ThreadListHead	0x0488
0x01A4																										unsigned long DefaultHardErrorProcessing			0x0498
0x01A8							union _LARGE_INTEGER ReadTransferCount	union _LARGE_INTEGER ReadTransferCount	union _LARGE_INTEGER ReadTransferCount	union _LARGE_INTEGER ReadTransferCount																			0x02B8
0x01A8				union _LARGE_INTEGER ReadOperationCount	union _LARGE_INTEGER ReadOperationCount																								0x02D0
0x01A8	unsigned long DefaultHardErrorProcessing		union _LARGE_INTEGER OtherOperationCount			union _LARGE_INTEGER ReadTransferCount					struct _PEB * Peb	struct _PEB * Peb	struct _PEB * Peb											uint64_t VirtualSize	uint64_t PeakVirtualSize			uint64_t PeakVirtualSize	0x0330
0x01A8														struct _MM_AVL_TABLE * LockedPagesList	struct _MM_AVL_TABLE * LockedPagesList														0x0378
0x01A8																long LastThreadExitStatus	long LastThreadExitStatus	long LastThreadExitStatus	long LastThreadExitStatus	long LastThreadExitStatus	long LastThreadExitStatus	long LastThreadExitStatus	long LastThreadExitStatus	unsigned long ImagePathHash					0x048C
0x01A8																									long LastThreadExitStatus			unsigned long ImagePathHash	0x049C
0x01AC											struct _EX_FAST_REF PrefetchTrace	struct _EX_FAST_REF PrefetchTrace												struct _LIST_ENTRY SessionProcessLinks	uint64_t VirtualSize			uint64_t VirtualSize	0x0338
0x01AC	long LastThreadExitStatus												struct _EX_FAST_REF PrefetchTrace			struct _EX_FAST_REF PrefetchTrace	struct _EX_FAST_REF PrefetchTrace	struct _EX_FAST_REF PrefetchTrace	struct _EX_FAST_REF PrefetchTrace	struct _EX_FAST_REF PrefetchTrace	struct _EX_FAST_REF PrefetchTrace	struct _EX_FAST_REF PrefetchTrace	struct _EX_FAST_REF PrefetchTrace	unsigned long DefaultHardErrorProcessing	volatile unsigned long ActiveThreads				0x0490
0x01AC																										struct _EX_FAST_REF PrefetchTrace			0x04A0
0x01B0							union _LARGE_INTEGER WriteTransferCount	union _LARGE_INTEGER WriteTransferCount	union _LARGE_INTEGER WriteTransferCount	union _LARGE_INTEGER WriteTransferCount																			0x02C0
0x01B0				union _LARGE_INTEGER WriteOperationCount	union _LARGE_INTEGER WriteOperationCount																								0x02D8
0x01B0											union _LARGE_INTEGER ReadOperationCount	union _LARGE_INTEGER ReadOperationCount													struct _LIST_ENTRY SessionProcessLinks			struct _LIST_ENTRY SessionProcessLinks	0x0340
0x01B0														union _LARGE_INTEGER ReadOperationCount	union _LARGE_INTEGER ReadOperationCount														0x0380
0x01B0	struct _PEB * Peb		union _LARGE_INTEGER ReadTransferCount			union _LARGE_INTEGER WriteTransferCount							union _LARGE_INTEGER ReadOperationCount			struct _MM_AVL_TABLE * LockedPagesList		void * LockedPagesList						struct _EX_FAST_REF PrefetchTrace	unsigned long DefaultHardErrorProcessing			volatile unsigned long ActiveThreads	0x0498
																												long LastThreadExitStatus	0x04A4
0x01B0																										void * LockedPagesList			0x04A8
0x01B4	struct _EX_FAST_REF PrefetchTrace
0x01B8							union _LARGE_INTEGER OtherTransferCount	union _LARGE_INTEGER OtherTransferCount	union _LARGE_INTEGER OtherTransferCount	union _LARGE_INTEGER OtherTransferCount																			0x02C8
0x01B8				union _LARGE_INTEGER OtherOperationCount	union _LARGE_INTEGER OtherOperationCount																								0x02E0
0x01B8	union _LARGE_INTEGER ReadOperationCount		union _LARGE_INTEGER WriteTransferCount			union _LARGE_INTEGER OtherTransferCount					union _LARGE_INTEGER WriteOperationCount	union _LARGE_INTEGER WriteOperationCount	union _LARGE_INTEGER WriteOperationCount											uint64_t ExceptionPortValue					0x0348
0x01B8														union _LARGE_INTEGER WriteOperationCount	union _LARGE_INTEGER WriteOperationCount														0x0388
0x01B8																union _LARGE_INTEGER ReadOperationCount	union _LARGE_INTEGER ReadOperationCount	union _LARGE_INTEGER ReadOperationCount	union _LARGE_INTEGER ReadOperationCount	union _LARGE_INTEGER ReadOperationCount	union _LARGE_INTEGER ReadOperationCount	union _LARGE_INTEGER ReadOperationCount	union _LARGE_INTEGER ReadOperationCount						0x04A0
0x01B8																										union _LARGE_INTEGER ReadOperationCount			0x04B0
0x01C0							uintptr_t CommitChargeLimit	uintptr_t CommitChargeLimit	uintptr_t CommitChargeLimit	uintptr_t CommitChargeLimit																			0x02D0
0x01C0				union _LARGE_INTEGER ReadTransferCount	union _LARGE_INTEGER ReadTransferCount																								0x02E8
0x01C0	union _LARGE_INTEGER WriteOperationCount		union _LARGE_INTEGER OtherTransferCount			unsigned long CommitChargeLimit					union _LARGE_INTEGER OtherOperationCount	union _LARGE_INTEGER OtherOperationCount	union _LARGE_INTEGER OtherOperationCount											struct _EX_FAST_REF Token	void * ExceptionPortData			void * ExceptionPortData	0x0350
0x01C0														union _LARGE_INTEGER OtherOperationCount	union _LARGE_INTEGER OtherOperationCount														0x0390
0x01C0																union _LARGE_INTEGER WriteOperationCount	union _LARGE_INTEGER WriteOperationCount	union _LARGE_INTEGER WriteOperationCount	union _LARGE_INTEGER WriteOperationCount	union _LARGE_INTEGER WriteOperationCount	union _LARGE_INTEGER WriteOperationCount	union _LARGE_INTEGER WriteOperationCount	union _LARGE_INTEGER WriteOperationCount	union _LARGE_INTEGER ReadOperationCount	void * LockedPagesList			struct _EX_FAST_REF PrefetchTrace	0x04A8
0x01C0																								union _LARGE_INTEGER OtherOperationCount	union _LARGE_INTEGER WriteOperationCount	union _LARGE_INTEGER WriteOperationCount	union _LARGE_INTEGER WriteOperationCount	union _LARGE_INTEGER ReadOperationCount	0x04B8
0x01C4						volatile unsigned long CommitChargePeak		volatile uint64_t CommitChargePeak	volatile unsigned long CommitChargePeak	volatile uint64_t CommitChargePeak																			0x02D8
0x01C8							void * AweInfo	void * AweInfo	void * AweInfo	void * AweInfo														void * UniqueProcessId	struct _EX_RUNDOWN_REF RundownProtect			struct _EX_RUNDOWN_REF RundownProtect	0x02E0
0x01C8				union _LARGE_INTEGER WriteTransferCount	union _LARGE_INTEGER WriteTransferCount																								0x02F0
0x01C8	union _LARGE_INTEGER OtherOperationCount		unsigned long CommitChargeLimit			void * AweInfo					union _LARGE_INTEGER ReadTransferCount	union _LARGE_INTEGER ReadTransferCount	union _LARGE_INTEGER ReadTransferCount											uint64_t WorkingSetPage	struct _EX_FAST_REF Token			struct _EX_FAST_REF Token	0x0358
0x01C8														union _LARGE_INTEGER ReadTransferCount	union _LARGE_INTEGER ReadTransferCount														0x0398
0x01C8																union _LARGE_INTEGER OtherOperationCount	union _LARGE_INTEGER OtherOperationCount	union _LARGE_INTEGER OtherOperationCount	union _LARGE_INTEGER OtherOperationCount	union _LARGE_INTEGER OtherOperationCount	union _LARGE_INTEGER OtherOperationCount	union _LARGE_INTEGER OtherOperationCount	union _LARGE_INTEGER OtherOperationCount						0x04B0
0x01C8																								union _LARGE_INTEGER ReadTransferCount	union _LARGE_INTEGER OtherOperationCount	union _LARGE_INTEGER OtherOperationCount	union _LARGE_INTEGER OtherOperationCount	union _LARGE_INTEGER WriteOperationCount	0x04C0
0x01CC			unsigned long CommitChargePeak			struct _SE_AUDIT_PROCESS_CREATION_INFO SeAuditProcessCreationInfo																							0x02E8
0x01D0							struct _MMSUPPORT Vm	struct _MMSUPPORT Vm	struct _MMSUPPORT Vm	struct _MMSUPPORT Vm																			0x02F0
0x01D0				union _LARGE_INTEGER OtherTransferCount	union _LARGE_INTEGER OtherTransferCount																								0x02F8
0x01D0											union _LARGE_INTEGER WriteTransferCount	union _LARGE_INTEGER WriteTransferCount												struct _EX_PUSH_LOCK AddressCreationLock	uint64_t WorkingSetPage			uint64_t WorkingSetPage	0x0360
0x01D0	union _LARGE_INTEGER ReadTransferCount		void * AweInfo			struct _MMSUPPORT Vm							union _LARGE_INTEGER WriteTransferCount		union _LARGE_INTEGER WriteTransferCount									void * Win32Process	volatile uint64_t NumberOfLockedPages			volatile uint64_t NumberOfLockedPages	0x03A0
0x01D0																union _LARGE_INTEGER ReadTransferCount	union _LARGE_INTEGER ReadTransferCount	union _LARGE_INTEGER ReadTransferCount	union _LARGE_INTEGER ReadTransferCount	union _LARGE_INTEGER ReadTransferCount	union _LARGE_INTEGER ReadTransferCount	union _LARGE_INTEGER ReadTransferCount	union _LARGE_INTEGER ReadTransferCount						0x04B8
0x01D0																										union _LARGE_INTEGER ReadTransferCount			0x04C8
0x01D4			struct _SE_AUDIT_PROCESS_CREATION_INFO SeAuditProcessCreationInfo
0x01D8				uintptr_t CommitChargeLimit	uintptr_t CommitChargeLimit																								0x0300
0x01D8	union _LARGE_INTEGER WriteTransferCount		struct _MMSUPPORT Vm								union _LARGE_INTEGER OtherTransferCount	union _LARGE_INTEGER OtherTransferCount	union _LARGE_INTEGER OtherTransferCount											struct _EX_PUSH_LOCK PageTableCommitmentLock	struct _EX_PUSH_LOCK AddressCreationLock			struct _EX_PUSH_LOCK AddressCreationLock	0x0368
0x01D8														union _LARGE_INTEGER OtherTransferCount	union _LARGE_INTEGER OtherTransferCount														0x03A8
0x01D8																union _LARGE_INTEGER WriteTransferCount	union _LARGE_INTEGER WriteTransferCount	union _LARGE_INTEGER WriteTransferCount	union _LARGE_INTEGER WriteTransferCount	union _LARGE_INTEGER WriteTransferCount	union _LARGE_INTEGER WriteTransferCount	union _LARGE_INTEGER WriteTransferCount	union _LARGE_INTEGER WriteTransferCount						0x04C0
0x01D8																										union _LARGE_INTEGER WriteTransferCount	union _LARGE_INTEGER WriteTransferCount		0x04D0
0x01DC				uintptr_t CommitChargePeak																									0x0308
0x01E0				void * AweInfo	void * AweInfo																								0x0310
0x01E0											uintptr_t CommitChargeLimit	uintptr_t CommitChargeLimit																	0x0370
0x01E0														uintptr_t CommitChargeLimit	uintptr_t CommitChargeLimit									void * SectionObject	struct _EJOB * volatile Job			struct _EJOB * volatile Job	0x03B0
0x01E0	union _LARGE_INTEGER OtherTransferCount												unsigned long CommitChargeLimit			union _LARGE_INTEGER OtherTransferCount	union _LARGE_INTEGER OtherTransferCount	union _LARGE_INTEGER OtherTransferCount	union _LARGE_INTEGER OtherTransferCount	union _LARGE_INTEGER OtherTransferCount	union _LARGE_INTEGER OtherTransferCount	union _LARGE_INTEGER OtherTransferCount	union _LARGE_INTEGER OtherTransferCount	union _LARGE_INTEGER WriteTransferCount	union _LARGE_INTEGER ReadTransferCount			union _LARGE_INTEGER OtherOperationCount	0x04C8
0x01E0																								uint64_t CommitChargeLimit	union _LARGE_INTEGER OtherTransferCount	union _LARGE_INTEGER OtherTransferCount	union _LARGE_INTEGER OtherTransferCount	union _LARGE_INTEGER WriteTransferCount	0x04D8
0x01E4				struct _SE_AUDIT_PROCESS_CREATION_INFO SeAuditProcessCreationInfo	struct _SE_AUDIT_PROCESS_CREATION_INFO SeAuditProcessCreationInfo							void * Wow64Process	volatile unsigned long CommitChargePeak											uint64_t[2] ProcessQuotaPeak					0x0318
0x01E4					unsigned long[2] Spares						volatile unsigned long CommitChargePeak	volatile uint64_t CommitChargePeak												struct _ETHREAD * ForkInProgress	struct _ETHREAD * RotateInProgress			struct _ETHREAD * RotateInProgress	0x0378
0x01E4														volatile unsigned long CommitCharge	volatile uint64_t CommitCharge									void * SectionBaseAddress	void * SectionObject			void * SectionObject	0x03B8
0x01E8				struct _MMSUPPORT Vm	struct _MMSUPPORT Vm																								0x0320
0x01E8											void * AweInfo	void * AweInfo												struct _EJOB * volatile CommitChargeJob	struct _ETHREAD * ForkInProgress			struct _ETHREAD * ForkInProgress	0x0380
0x01E8														volatile unsigned long CommitChargePeak	volatile uint64_t CommitChargePeak									unsigned long Cookie	void * SectionBaseAddress			void * SectionBaseAddress	0x03C0
0x01E8																uintptr_t CommitChargeLimit	uintptr_t CommitChargeLimit	uintptr_t CommitChargeLimit	uintptr_t CommitChargeLimit	volatile unsigned long CommitCharge	volatile uint64_t CommitCharge	volatile unsigned long CommitCharge	volatile uint64_t CommitCharge						0x04D0
0x01E8	uintptr_t CommitChargeLimit												void * AweInfo											volatile uint64_t CommitCharge	uintptr_t CommitChargeLimit			union _LARGE_INTEGER OtherTransferCount	0x04E0
0x01EC											struct _SE_AUDIT_PROCESS_CREATION_INFO SeAuditProcessCreationInfo	struct _SE_AUDIT_PROCESS_CREATION_INFO SeAuditProcessCreationInfo																	0x0388
0x01EC														struct _MMSUPPORT Vm	struct _MMSUPPORT Vm														0x03C8
0x01EC																volatile unsigned long CommitCharge	volatile uint64_t CommitCharge	volatile unsigned long CommitCharge	volatile uint64_t CommitCharge	struct _MMSUPPORT Vm	struct _MMSUPPORT Vm	struct _MMSUPPORT Vm	struct _MMSUPPORT Vm						0x04D8
0x01EC	unsigned long CommitChargePeak												struct _SE_AUDIT_PROCESS_CREATION_INFO SeAuditProcessCreationInfo											volatile uint64_t CommitChargePeak	volatile uint64_t CommitCharge	volatile unsigned long CommitCharge	volatile uint64_t CommitCharge	uint64_t CommitChargeLimit	0x04E8
0x01F0											struct _MMSUPPORT Vm	struct _MMSUPPORT Vm												volatile uint64_t NumberOfPrivatePages	struct _RTL_AVL_TREE CloneRoot			struct _RTL_AVL_TREE CloneRoot	0x0390
0x01F0																volatile unsigned long CommitChargePeak	volatile uint64_t CommitChargePeak	volatile unsigned long CommitChargePeak	volatile uint64_t CommitChargePeak										0x04E0
0x01F0	void * AweInfo												struct _MMSUPPORT Vm											struct _MMSUPPORT Vm	volatile uint64_t CommitChargePeak	volatile unsigned long CommitChargePeak	volatile uint64_t CommitChargePeak	volatile uint64_t CommitCharge	0x04F0
0x01F4																struct _MMSUPPORT Vm	struct _MMSUPPORT Vm	struct _MMSUPPORT Vm	struct _MMSUPPORT Vm										0x04E8
0x01F4	struct _SE_AUDIT_PROCESS_CREATION_INFO SeAuditProcessCreationInfo														struct _INVERTED_FUNCTION_TABLE * InvertedFunctionTable										struct _MMSUPPORT Vm	struct _MMSUPPORT Vm	struct _MMSUPPORT Vm	volatile uint64_t CommitChargePeak	0x04F8
0x01F8	struct _MMSUPPORT Vm
0x0218						struct _LIST_ENTRY MmProcessLinks																							0x0358
0x0220						unsigned long ModifiedPageCount																							0x0368
0x0224						unsigned long Flags2																							0x036C
0x0224:0x00						unsigned long JobNotReallyActive																							0x036C:0x00
0x0224:0x01						unsigned long AccountingFolded																							0x036C:0x01
0x0224:0x02						unsigned long NewProcessReported																							0x036C:0x02
0x0224:0x03						unsigned long ExitProcessReported																							0x036C:0x03
0x0224:0x04						unsigned long ReportCommitChanges																							0x036C:0x04
0x0224:0x05						unsigned long LastReportMemory																							0x036C:0x05
0x0224:0x06						unsigned long ReportPhysicalPageChanges																							0x036C:0x06
0x0224:0x07						unsigned long HandleTableRundown																							0x036C:0x07
0x0224:0x08						unsigned long NeedsHandleRundown																							0x036C:0x08
0x0224:0x09						unsigned long RefTraceEnabled																							0x036C:0x09
0x0224:0x0A						unsigned long NumaAware																							0x036C:0x0A
0x0224:0x0B						unsigned long ProtectedProcess																							0x036C:0x0B
0x0224:0x0C						unsigned long DefaultPagePriority																							0x036C:0x0C
0x0224:0x0F						unsigned long PrimaryTokenFrozen																							0x036C:0x0F
0x0224:0x10						unsigned long ProcessVerifierTarget																							0x036C:0x10
0x0224:0x11						unsigned long StackRandomizationDisabled																							0x036C:0x11
0x0224:0x12							unsigned long AffinityPermanent																						0x036C:0x12
0x0224:0x13							unsigned long AffinityUpdateEnable																						0x036C:0x13
0x0224:0x14							unsigned long CrossSessionCreate																						0x036C:0x14
0x0224:0x15									unsigned long LowVaAccessible																				0x036C:0x15
0x0228						unsigned long Flags																							0x0370
0x0228:0x00						unsigned long CreateReported																							0x0370:0x00
0x0228:0x01						unsigned long NoDebugInherit																							0x0370:0x01
0x0228:0x02						unsigned long ProcessExiting																							0x0370:0x02
0x0228:0x03						unsigned long ProcessDelete																							0x0370:0x03
0x0228:0x04						unsigned long Wow64SplitPages																							0x0370:0x04
0x0228:0x05						unsigned long VmDeleted																							0x0370:0x05
0x0228:0x06						unsigned long OutswapEnabled																							0x0370:0x06
0x0228:0x07						unsigned long Outswapped																							0x0370:0x07
0x0228:0x08						unsigned long ForkFailed																							0x0370:0x08
0x0228:0x09						unsigned long Wow64VaSpace4Gb																							0x0370:0x09
0x0228:0x0A						unsigned long AddressSpaceInitialized																							0x0370:0x0A
0x0228:0x0C						unsigned long SetTimerResolution																							0x0370:0x0C
0x0228:0x0D			unsigned long BreakOnTermination					0x0370:0x0D
0x0228:0x0E			unsigned long DeprioritizeViews					0x0370:0x0E
0x0228:0x0F			unsigned long WriteWatch					0x0370:0x0F
0x0228:0x10			unsigned long ProcessInSession					0x0370:0x10
0x0228:0x11			unsigned long OverrideAddressSpace					0x0370:0x11
0x0228:0x12			unsigned long HasAddressSpace					0x0370:0x12
0x0228:0x13			unsigned long LaunchPrefetched					0x0370:0x13
0x0228:0x14			unsigned long InjectInpageErrors					0x0370:0x14
0x0228:0x15			unsigned long VmTopDown					0x0370:0x15
0x0228:0x16			unsigned long ImageNotifyDone					0x0370:0x16
0x0228:0x17			unsigned long PdeUpdateNeeded					0x0370:0x17
0x0228:0x18			unsigned long VdmAllowed					0x0370:0x18
0x0228:0x19			unsigned long SmapAllowed					0x0370:0x19
0x0228:0x1A			unsigned long ProcessInserted					0x0370:0x1A
0x0228:0x1B			unsigned long DefaultIoPriority					0x0370:0x1B
0x0228:0x1E			unsigned long SparePsFlags1	unsigned long ProcessSelfDelete				0x0370:0x1E
0x0228:0x1F				unsigned long SpareProcessFlags				0x0370:0x1F
0x022C			long ExitStatus					0x0374
0x0230			struct _LIST_ENTRY MmProcessLinks	uint16_t Spare7					0x0378
0x0232				uint8_t SubSystemMinorVersion					0x037A
0x0232				uint16_t SubSystemVersion					0x037A
0x0233				uint8_t SubSystemMajorVersion					0x037B
0x0234				uint8_t PriorityClass					0x037C
0x0238	unsigned long LastFaultCount		struct _LIST_ENTRY MmProcessLinks	unsigned long ModifiedPageCount		struct _MM_AVL_TABLE VadRoot					0x0380
0x023C	unsigned long ModifiedPageCount			unsigned long JobStatus							0x0384
0x0240	unsigned long NumberOfVads		unsigned long ModifiedPageCount	unsigned long Flags							struct _RTL_AVL_TREE CloneRoot	struct _EJOB * volatile CommitChargeJob	struct _EJOB * volatile CommitChargeJob	0x0388
0x0240:0x00				unsigned long CreateReported										0x0388:0x00
0x0240:0x01				unsigned long NoDebugInherit										0x0388:0x01
0x0240:0x02				unsigned long ProcessExiting										0x0388:0x02
0x0240:0x03				unsigned long ProcessDelete										0x0388:0x03
0x0240:0x04				unsigned long Wow64SplitPages										0x0388:0x04
0x0240:0x05				unsigned long VmDeleted										0x0388:0x05
0x0240:0x06				unsigned long OutswapEnabled										0x0388:0x06
0x0240:0x07				unsigned long Outswapped										0x0388:0x07
0x0240:0x08				unsigned long ForkFailed										0x0388:0x08
0x0240:0x09				unsigned long Wow64VaSpace4Gb										0x0388:0x09
0x0240:0x0A				unsigned long AddressSpaceInitialized										0x0388:0x0A
0x0240:0x0C				unsigned long SetTimerResolution										0x0388:0x0C
0x0240:0x0D				unsigned long BreakOnTermination										0x0388:0x0D
0x0240:0x0E				unsigned long SessionCreationUnderway										0x0388:0x0E
0x0240:0x0F				unsigned long WriteWatch										0x0388:0x0F
0x0240:0x10				unsigned long ProcessInSession										0x0388:0x10
0x0240:0x11				unsigned long OverrideAddressSpace										0x0388:0x11
0x0240:0x12				unsigned long HasAddressSpace										0x0388:0x12
0x0240:0x13				unsigned long LaunchPrefetched										0x0388:0x13
0x0240:0x14				unsigned long InjectInpageErrors										0x0388:0x14
0x0240:0x15				unsigned long VmTopDown										0x0388:0x15
0x0240:0x16				unsigned long ImageNotifyDone										0x0388:0x16
0x0240:0x17				unsigned long PdeUpdateNeeded										0x0388:0x17
0x0240:0x18				unsigned long VdmAllowed										0x0388:0x18
0x0240:0x19				unsigned long SmapAllowed										0x0388:0x19
0x0240:0x1A				unsigned long CreateFailed										0x0388:0x1A
0x0240:0x1B				unsigned long DefaultIoPriority										0x0388:0x1B
0x0240:0x1E				unsigned long Spare1										0x0388:0x1E
0x0240:0x1F				unsigned long Spare2										0x0388:0x1F
0x0244	unsigned long JobStatus			long ExitStatus										0x038C
0x0248	unsigned long Flags			uint16_t NextPageColor										0x0390
0x0248:0x00	unsigned long CreateReported
0x0248:0x01	unsigned long NoDebugInherit
0x0248:0x02	unsigned long ProcessExiting
0x0248:0x03	unsigned long ProcessDelete
0x0248:0x04	unsigned long Wow64SplitPages
0x0248:0x05	unsigned long VmDeleted
0x0248:0x06	unsigned long OutswapEnabled
0x0248:0x07	unsigned long Outswapped
0x0248:0x08	unsigned long ForkFailed
0x0248:0x09	unsigned long HasPhysicalVad		unsigned long Wow64VaSpace4Gb
0x0248:0x0A	unsigned long AddressSpaceInitialized
0x0248:0x0C	unsigned long SetTimerResolution
0x0248:0x0D	unsigned long BreakOnTermination
0x0248:0x0E	unsigned long SessionCreationUnderway
0x0248:0x0F	unsigned long WriteWatch
0x024A	unsigned long ProcessInSession			uint8_t SubSystemMinorVersion										0x0392
0x024A				uint16_t SubSystemVersion										0x0392
0x0248:0x11	unsigned long OverrideAddressSpace
0x0248:0x12	unsigned long HasAddressSpace
0x0248:0x13	unsigned long LaunchPrefetched
0x0248:0x14	unsigned long InjectInpageErrors
0x0248:0x15	unsigned long Unused	unsigned long VmTopDown
0x0248:0x16		unsigned long Unused3	unsigned long ImageNotifyDone
0x0248:0x17		unsigned long Unused4	unsigned long PdeUpdateNeeded
0x024B		unsigned long VdmAllowed		uint8_t SubSystemMajorVersion										0x0393
0x0248:0x19		unsigned long Unused	unsigned long Unused
0x0248:0x1E		unsigned long Unused1
0x0248:0x1F		unsigned long Unused2
0x024C	long ExitStatus			uint8_t PriorityClass										0x0394
0x0250	uint16_t NextPageColor			struct _MM_AVL_TABLE VadRoot	struct _MM_AVL_TABLE VadRoot						volatile uint64_t NumberOfLockedPages	volatile uint64_t NumberOfPrivatePages	volatile uint64_t NumberOfPrivatePages	0x0398
0x0252	uint8_t SubSystemMinorVersion
0x0252	uint16_t SubSystemVersion
0x0253	uint8_t SubSystemMajorVersion
0x0254	uint8_t PriorityClass
0x0255	uint8_t WorkingSetAcquiredUnsafe
0x0258							unsigned long Cookie	unsigned long Cookie	unsigned long Cookie	unsigned long Cookie					0x03C0
0x0258		unsigned long Cookie	struct _MM_AVL_TABLE VadRoot			unsigned long Cookie					struct _LIST_ENTRY MmProcessLinks	struct _LIST_ENTRY MmProcessLinks		void * SecurityPort	uint8_t[15] ImageFileName	0x0450
0x025C							struct _ALPC_PROCESS_CONTEXT AlpcContext	struct _ALPC_PROCESS_CONTEXT AlpcContext	struct _ALPC_PROCESS_CONTEXT AlpcContext	struct _ALPC_PROCESS_CONTEXT AlpcContext								0x03C8
0x025C						struct _ALPC_PROCESS_CONTEXT AlpcContext						struct _LIST_ENTRY MmProcessLinks		struct _LIST_ENTRY MmProcessLinks				struct _LIST_ENTRY MmProcessLinks	0x0418
0x0260													unsigned long ModifiedPageCount		struct _LIST_ENTRY JobLinks	struct _SE_AUDIT_PROCESS_CREATION_INFO SeAuditProcessCreationInfo	void * SecurityPort		0x0460
0x0264											void * HighestUserAddress	void * HighestUserAddress											0x0428
0x0264													void * HighestUserAddress	unsigned long Flags2									0x0464
0x0264:0x00														unsigned long JobNotReallyActive									0x0464:0x00
															struct _EX_PUSH_LOCK InvertedFunctionTableLock								struct _MMSUPPORT Vm	0x0500
0x0264																struct _LIST_ENTRY MmProcessLinks								struct _LIST_ENTRY MmProcessLinks	0x0578
0x0264																		struct _LIST_ENTRY MmProcessLinks	struct _LIST_ENTRY MmProcessLinks					struct _LIST_ENTRY MmProcessLinks	struct _LIST_ENTRY MmProcessLinks	struct _LIST_ENTRY MmProcessLinks	struct _LIST_ENTRY MmProcessLinks	0x05C0
0x0264:0x01														unsigned long AccountingFolded														0x0464:0x01
0x0264:0x02														unsigned long NewProcessReported														0x0464:0x02
0x0264:0x03														unsigned long ExitProcessReported														0x0464:0x03
0x0264:0x04														unsigned long ReportCommitChanges														0x0464:0x04
0x0264:0x05														unsigned long LastReportMemory														0x0464:0x05
0x0264:0x06														unsigned long Spare1														0x0464:0x06
0x0264:0x07														unsigned long HandleTableRundown														0x0464:0x07
0x0264:0x08														unsigned long NeedsHandleRundown														0x0464:0x08
0x0264:0x09														unsigned long RefTraceEnabled														0x0464:0x09
0x0264:0x0A														unsigned long NumaAware														0x0464:0x0A
0x0264:0x0B														unsigned long Spare2														0x0464:0x0B
0x0264:0x0C														unsigned long DefaultPagePriority														0x0464:0x0C
0x0264:0x0F														unsigned long PrimaryTokenFrozen														0x0464:0x0F
0x0264:0x10														unsigned long ProcessVerifierTarget														0x0464:0x10
0x0264:0x11														unsigned long StackRandomizationDisabled														0x0464:0x11
0x0264:0x12														unsigned long AffinityPermanent														0x0464:0x12
0x0264:0x13														unsigned long AffinityUpdateEnable														0x0464:0x13
0x0264:0x14														unsigned long PropagateNode														0x0464:0x14
0x0264:0x15														unsigned long ExplicitAffinity														0x0464:0x15
0x0264:0x16														unsigned long LowVaAccessible														0x0464:0x16
0x0264:0x17														unsigned long ForceRelocateImages														0x0464:0x17
0x0264:0x18														unsigned long DisallowStrippedImages														0x0464:0x18
0x0264:0x19														unsigned long HighEntropyASLREnabled														0x0464:0x19
0x0264:0x1A														unsigned long ForceStackCheck														0x0464:0x1A
0x0264:0x1B														unsigned long ProcessDeepFrozen														0x0464:0x1B
0x0264:0x1C														unsigned long ProcessDeepFreezeRequest														0x0464:0x1C
0x0264:0x1D														unsigned long ProcessDeepFreezeInProgress														0x0464:0x1D
0x0264:0x1E														unsigned long DisallowWin32kSystemCalls														0x0464:0x1E
0x0264:0x1F														unsigned long SpareBits														0x0464:0x1F
0x0268											unsigned long ModifiedPageCount	unsigned long ModifiedPageCount																0x0430
0x0268													unsigned long ModifiedPageCount	unsigned long Flags							struct _LIST_ENTRY JobLinks						struct _SE_AUDIT_PROCESS_CREATION_INFO SeAuditProcessCreationInfo	0x0468
0x0268:0x00														unsigned long CreateReported														0x0468:0x00
0x0268:0x01														unsigned long NoDebugInherit														0x0468:0x01
0x0268:0x02														unsigned long ProcessExiting														0x0468:0x02
0x0268:0x03														unsigned long ProcessDelete														0x0468:0x03
0x0268:0x04														unsigned long Wow64SplitPages														0x0468:0x04
0x0268:0x05														unsigned long VmDeleted														0x0468:0x05
0x0268:0x06														unsigned long OutswapEnabled														0x0468:0x06
0x0268:0x07														unsigned long Outswapped														0x0468:0x07
0x0268:0x08														unsigned long ForkFailed														0x0468:0x08
0x0268:0x09														unsigned long Wow64VaSpace4Gb														0x0468:0x09
0x0268:0x0A														unsigned long AddressSpaceInitialized														0x0468:0x0A
0x0268:0x0C														unsigned long SetTimerResolution														0x0468:0x0C
0x0268:0x0D														unsigned long BreakOnTermination														0x0468:0x0D
0x0268:0x0E														unsigned long DeprioritizeViews														0x0468:0x0E
0x0268:0x0F														unsigned long WriteWatch														0x0468:0x0F
0x0268:0x10														unsigned long ProcessInSession														0x0468:0x10
0x0268:0x11														unsigned long OverrideAddressSpace														0x0468:0x11
0x0268:0x12														unsigned long HasAddressSpace														0x0468:0x12
0x0268:0x13														unsigned long LaunchPrefetched														0x0468:0x13
0x0268:0x14														unsigned long InjectInpageErrors														0x0468:0x14
0x0268:0x15														unsigned long VmTopDown														0x0468:0x15
0x0268:0x16														unsigned long ImageNotifyDone														0x0468:0x16
0x0268:0x17	unsigned long PdeUpdateNeeded													0x0468:0x17
0x0268:0x18	unsigned long VdmAllowed				0x0468:0x18
0x0268:0x19	unsigned long CrossSessionCreate				0x0468:0x19
0x0268:0x1A	unsigned long ProcessInserted				0x0468:0x1A
0x0268:0x1B	unsigned long DefaultIoPriority				0x0468:0x1B
0x0268:0x1E	unsigned long ProcessSelfDelete				0x0468:0x1E
0x0268:0x1F	unsigned long SetTimerResolutionLink				0x0468:0x1F
0x026C	unsigned long Flags2				unsigned long JobNotReallyActive											0x0434
0x026C:0x00	unsigned long JobNotReallyActive	unsigned long JobNotReallyActive	0x0434:0x00
0x026C			unsigned long Flags2	long ExitStatus	long ExitStatus	0x046C
0x026C						unsigned long ModifiedPageCount	unsigned long ModifiedPageCount	0x0588
0x026C								unsigned long ModifiedPageCount	unsigned long ModifiedPageCount	unsigned long ModifiedPageCount	unsigned long ModifiedPageCount	unsigned long ModifiedPageCount	unsigned long ModifiedPageCount			0x05D0
0x026C:0x01	unsigned long AccountingFolded															0x0434:0x01
0x026C:0x02	unsigned long NewProcessReported															0x0434:0x02
0x026C:0x03	unsigned long ExitProcessReported															0x0434:0x03
0x026C:0x04	unsigned long ReportCommitChanges															0x0434:0x04
0x026C:0x05	unsigned long LastReportMemory															0x0434:0x05
0x026C:0x06	unsigned long ReportPhysicalPageChanges															0x0434:0x06
0x026C:0x07	unsigned long HandleTableRundown															0x0434:0x07
0x026C:0x08	unsigned long NeedsHandleRundown															0x0434:0x08
0x026C:0x09	unsigned long RefTraceEnabled															0x0434:0x09
0x026C:0x0A	unsigned long NumaAware															0x0434:0x0A
0x026C:0x0B	unsigned long ProtectedProcess															0x0434:0x0B
0x026C:0x0C	unsigned long DefaultPagePriority															0x0434:0x0C
0x026C:0x0F	unsigned long PrimaryTokenFrozen															0x0434:0x0F
0x026C:0x10	unsigned long ProcessVerifierTarget															0x0434:0x10
0x026C:0x11	unsigned long StackRandomizationDisabled															0x0434:0x11
0x026C:0x12	unsigned long AffinityPermanent															0x0434:0x12
0x026C:0x13	unsigned long AffinityUpdateEnable															0x0434:0x13
0x026C:0x14	unsigned long PropagateNode															0x0434:0x14
0x026C:0x15	unsigned long ExplicitAffinity															0x0434:0x15
0x026C:0x16	unsigned long Spare1															0x0434:0x16
0x026C:0x17	unsigned long ForceRelocateImages															0x0434:0x17
0x026C:0x18	unsigned long DisallowStrippedImages															0x0434:0x18
0x026C:0x19	unsigned long LowVaAccessible
0x0270	unsigned long Cookie		unsigned long Cookie			unsigned long Flags										void * InheritedFromUniqueProcessId	void * Win32WindowStation	void * Win32WindowStation	0x03D8
0x0270			unsigned long Flags			unsigned long CreateReported													0x0438
0x0270:0x00			unsigned long CreateReported	unsigned long CreateReported															0x0438:0x00
0x0270					struct _MM_AVL_TABLE VadRoot			struct _MM_AVL_TABLE VadRoot								void * HighestUserAddress		struct _LIST_ENTRY JobLinks	0x0470
0x0270								long ExitStatus		long ExitStatus									0x058C
0x0270										long ExitStatus	long ExitStatus	long ExitStatus	long ExitStatus	long ExitStatus	long ExitStatus				0x05D4
0x0270:0x01			unsigned long NoDebugInherit												0x0438:0x01
0x0270:0x02			unsigned long ProcessExiting												0x0438:0x02
0x0270:0x03			unsigned long ProcessDelete												0x0438:0x03
0x0270:0x04			unsigned long Wow64SplitPages												0x0438:0x04
0x0270:0x05			unsigned long VmDeleted												0x0438:0x05
0x0270:0x06			unsigned long OutswapEnabled												0x0438:0x06
0x0270:0x07			unsigned long Outswapped												0x0438:0x07
0x0270:0x08			unsigned long ForkFailed												0x0438:0x08
0x0270:0x09			unsigned long Wow64VaSpace4Gb												0x0438:0x09
0x0270:0x0A			unsigned long AddressSpaceInitialized												0x0438:0x0A
0x0270:0x0C			unsigned long SetTimerResolution												0x0438:0x0C
0x0270:0x0D			unsigned long BreakOnTermination												0x0438:0x0D
0x0270:0x0E			unsigned long DeprioritizeViews												0x0438:0x0E
0x0270:0x0F			unsigned long WriteWatch												0x0438:0x0F
0x0270:0x10			unsigned long ProcessInSession												0x0438:0x10
0x0270:0x11			unsigned long OverrideAddressSpace												0x0438:0x11
0x0270:0x12			unsigned long HasAddressSpace												0x0438:0x12
0x0270:0x13			unsigned long LaunchPrefetched												0x0438:0x13
0x0270:0x14			unsigned long InjectInpageErrors												0x0438:0x14
0x0270:0x15			unsigned long VmTopDown												0x0438:0x15
0x0270:0x16			unsigned long ImageNotifyDone												0x0438:0x16
0x0270:0x17			unsigned long PdeUpdateNeeded												0x0438:0x17
0x0270:0x18			unsigned long VdmAllowed												0x0438:0x18
0x0270:0x19			unsigned long CrossSessionCreate												0x0438:0x19
0x0270:0x1A			unsigned long ProcessInserted												0x0438:0x1A
0x0270:0x1B			unsigned long DefaultIoPriority												0x0438:0x1B
0x0270:0x1E			unsigned long ProcessSelfDelete												0x0438:0x1E
0x0270:0x1F			unsigned long SetTimerResolutionLink												0x0438:0x1F
0x0274			long ExitStatus	long ExitStatus											0x043C
0x0274					long ExitStatus			struct _MM_AVL_TABLE VadRoot	struct _MM_AVL_TABLE VadRoot						0x0590
0x0274									struct _RTL_AVL_TREE VadRoot						struct _LIST_ENTRY MmProcessLinks	0x05D8
																long ExitStatus			0x05EC
0x0274																			struct _LIST_ENTRY MmProcessLinks	struct _LIST_ENTRY MmProcessLinks	0x05F0
0x0278			struct _MM_AVL_TABLE VadRoot	struct _MM_AVL_TABLE VadRoot																	0x0440
0x0278					struct _MM_AVL_TABLE VadRoot					void * VadHint											0x05E0
0x027C										uintptr_t VadCount	uintptr_t VadCount	uintptr_t VadCount	uintptr_t VadCount	uintptr_t VadCount	uintptr_t VadCount	unsigned long ModifiedPageCount					0x05E8
0x027C																uint64_t VadCount	unsigned long ModifiedPageCount			0x0600
0x0280										volatile unsigned long VadPhysicalPages	volatile uint64_t VadPhysicalPages	volatile unsigned long VadPhysicalPages	volatile uint64_t VadPhysicalPages	volatile unsigned long VadPhysicalPages	volatile uint64_t VadPhysicalPages	struct _RTL_AVL_TREE VadRoot	struct _LIST_ENTRY MmProcessLinks			0x05F0
0x0280																	long ExitStatus			0x0604
0x0284										uintptr_t VadPhysicalPagesLimit	uintptr_t VadPhysicalPagesLimit	uintptr_t VadPhysicalPagesLimit	uintptr_t VadPhysicalPagesLimit	uintptr_t VadPhysicalPagesLimit	uintptr_t VadPhysicalPagesLimit	void * VadHint				struct _LIST_ENTRY MmProcessLinks	0x05F8
0x0284																		struct _RTL_AVL_TREE VadRoot			0x0608
0x0288							volatile unsigned long VadPhysicalPages	volatile uint64_t VadPhysicalPages													0x04A0
0x0288										struct _ALPC_PROCESS_CONTEXT AlpcContext	struct _ALPC_PROCESS_CONTEXT AlpcContext	struct _ALPC_PROCESS_CONTEXT AlpcContext	struct _ALPC_PROCESS_CONTEXT AlpcContext	struct _ALPC_PROCESS_CONTEXT AlpcContext	struct _ALPC_PROCESS_CONTEXT AlpcContext						0x0600
0x0288																		void * VadHint			0x0610
0x028C							uintptr_t VadPhysicalPagesLimit	uintptr_t VadPhysicalPagesLimit													0x04A8
0x028C								volatile unsigned long VadPhysicalPages	volatile uint64_t VadPhysicalPages												0x05C0
0x028C									struct _INVERTED_FUNCTION_TABLE * InvertedFunctionTable							struct _ALPC_PROCESS_CONTEXT AlpcContext	uintptr_t VadCount			void * VadHint	0x0618
0x0290						struct _ALPC_PROCESS_CONTEXT AlpcContext	struct _ALPC_PROCESS_CONTEXT AlpcContext									union _LARGE_INTEGER WriteOperationCount	union _LARGE_INTEGER ReadOperationCount			void * LockedPagesList	0x04B0
0x0290								uintptr_t VadPhysicalPagesLimit	uintptr_t VadPhysicalPagesLimit												0x05C8
0x0290																		volatile unsigned long VadPhysicalPages	volatile uint64_t VadPhysicalPages		0x0620
0x0294								struct _ALPC_PROCESS_CONTEXT AlpcContext	struct _ALPC_PROCESS_CONTEXT AlpcContext												0x05D0
0x0294																	uintptr_t VadPhysicalPagesLimit			volatile uint64_t VadPhysicalPages	0x0628
0x0298			struct _ALPC_PROCESS_CONTEXT AlpcContext	struct _ALPC_PROCESS_CONTEXT AlpcContext	struct _ALPC_PROCESS_CONTEXT AlpcContext												struct _LIST_ENTRY ThreadListHead			void * HighestUserAddress	0x0480
0x0298									struct _EX_PUSH_LOCK InvertedFunctionTableLock	struct _LIST_ENTRY TimerResolutionLink	struct _LIST_ENTRY TimerResolutionLink	struct _LIST_ENTRY TimerResolutionLink	struct _LIST_ENTRY TimerResolutionLink	struct _LIST_ENTRY TimerResolutionLink	struct _LIST_ENTRY TimerResolutionLink		volatile uint64_t VadPhysicalPages			uint64_t VadCount	0x0620
0x0298																		struct _ALPC_PROCESS_CONTEXT AlpcContext	struct _ALPC_PROCESS_CONTEXT AlpcContext		0x0630
0x02A0						struct _LIST_ENTRY TimerResolutionLink	struct _LIST_ENTRY TimerResolutionLink									union _LARGE_INTEGER OtherTransferCount	union _LARGE_INTEGER WriteTransferCount			union _LARGE_INTEGER ReadTransferCount	0x04D0
0x02A0										struct _PO_DIAG_STACK_RECORD * TimerResolutionStackRecord											0x0630
0x02A4								struct _LIST_ENTRY TimerResolutionLink	struct _LIST_ENTRY TimerResolutionLink												0x05F0
0x02A4										unsigned long RequestedTimerResolution						struct _LIST_ENTRY TimerResolutionLink				struct _ALPC_PROCESS_CONTEXT AlpcContext	0x0638
0x02A8		struct _LIST_ENTRY TimerResolutionLink	struct _LIST_ENTRY TimerResolutionLink									void * LockedPagesList	struct _EX_FAST_REF PrefetchTrace		unsigned long DefaultHardErrorProcessing	0x04A0
0x02A8					struct _PO_DIAG_STACK_RECORD * TimerResolutionStackRecord							struct _PO_DIAG_STACK_RECORD * TimerResolutionStackRecord				0x04E0
0x02A8							unsigned long SmallestTimerResolution	unsigned long SmallestTimerResolution	unsigned long SmallestTimerResolution	unsigned long SmallestTimerResolution	unsigned long SmallestTimerResolution	unsigned long SmallestTimerResolution				0x063C
0x02A8				struct _LIST_ENTRY TimerResolutionLink				struct _EX_PUSH_LOCK InvertedFunctionTableLock		struct _EX_PUSH_LOCK InvertedFunctionTableLock		struct _EX_PUSH_LOCK InvertedFunctionTableLock	unsigned long RequestedTimerResolution	struct _LIST_ENTRY TimerResolutionLink		struct _LIST_ENTRY TimerResolutionLink	struct _LIST_ENTRY TimerResolutionLink	0x0650
0x02AC					unsigned long RequestedTimerResolution	unsigned long RequestedTimerResolution												0x04E8
0x02AC							struct _PO_DIAG_STACK_RECORD * TimerResolutionStackRecord											0x0600
0x02B0		unsigned long RequestedTimerResolution	unsigned long RequestedTimerResolution															0x04B0
0x02B0					unsigned long SmallestTimerResolution	unsigned long SmallestTimerResolution												0x04EC
0x02B0				unsigned long RequestedTimerResolution			unsigned long RequestedTimerResolution	unsigned long RequestedTimerResolution						volatile uint64_t VadPhysicalPages	struct _RTL_AVL_TREE VadRoot			unsigned long ModifiedPageCount	0x0608
0x02B0									union _LARGE_INTEGER ExitTime											0x0640
															unsigned long SmallestTimerResolution					0x0654
0x02B0																struct _PO_DIAG_STACK_RECORD * TimerResolutionStackRecord				0x0660
0x02B4		unsigned long ActiveThreadsHighWatermark	unsigned long ActiveThreadsHighWatermark																	0x04B4
0x02B4							unsigned long SmallestTimerResolution	unsigned long SmallestTimerResolution											long ExitStatus	0x060C
0x02B4				unsigned long ActiveThreadsHighWatermark											struct _EX_PUSH_LOCK InvertedFunctionTableLock	unsigned long RequestedTimerResolution			struct _PO_DIAG_STACK_RECORD * TimerResolutionStackRecord	0x0668
0x02B8		unsigned long SmallestTimerResolution	unsigned long SmallestTimerResolution																	0x04B8
0x02B8					union _LARGE_INTEGER ExitTime	union _LARGE_INTEGER ExitTime														0x04F0
0x02B8							union _LARGE_INTEGER ExitTime	union _LARGE_INTEGER ExitTime							uint64_t VadPhysicalPagesLimit	void * VadHint			struct _RTL_AVL_TREE VadRoot	0x0610
0x02B8									unsigned long ActiveThreadsHighWatermark	unsigned long ActiveThreadsHighWatermark	unsigned long ActiveThreadsHighWatermark	unsigned long ActiveThreadsHighWatermark	unsigned long ActiveThreadsHighWatermark	unsigned long ActiveThreadsHighWatermark						0x0658
0x02B8				unsigned long SmallestTimerResolution												unsigned long SmallestTimerResolution				0x066C
0x02BC		struct _PO_DIAG_STACK_RECORD * TimerResolutionStackRecord	struct _PO_DIAG_STACK_RECORD * TimerResolutionStackRecord																	0x04C0
0x02BC				struct _PO_DIAG_STACK_RECORD * TimerResolutionStackRecord					unsigned long LargePrivateVadCount											0x065C
0x02C0					unsigned long ActiveThreadsHighWatermark	unsigned long ActiveThreadsHighWatermark														0x0508
0x02C0							unsigned long ActiveThreadsHighWatermark	unsigned long ActiveThreadsHighWatermark												0x0628
0x02C0		uint64_t SequenceNumber							struct _EX_PUSH_LOCK ThreadListLock	struct _EX_PUSH_LOCK ThreadListLock	struct _EX_PUSH_LOCK ThreadListLock	struct _EX_PUSH_LOCK ThreadListLock	struct _EX_PUSH_LOCK ThreadListLock	struct _EX_PUSH_LOCK ThreadListLock	struct _INVERTED_FUNCTION_TABLE * InvertedFunctionTable	struct _PO_DIAG_STACK_RECORD * TimerResolutionStackRecord				0x0660
0x02C0																	union _LARGE_INTEGER ExitTime	union _LARGE_INTEGER ExitTime		0x0670
0x02C4					unsigned long LargePrivateVadCount	unsigned long LargePrivateVadCount														0x050C
0x02C4							unsigned long LargePrivateVadCount	unsigned long LargePrivateVadCount												0x062C
0x02C4									void * WnfContext											0x0668
0x02C8					void * WnfContext	void * WnfContext														0x0510
0x02C8							struct _EX_PUSH_LOCK ThreadListLock	struct _EX_PUSH_LOCK ThreadListLock								struct _ALPC_PROCESS_CONTEXT AlpcContext			uint64_t VadPhysicalPagesLimit	0x0630
0x02C8		uint64_t CreateInterruptTime							uintptr_t Spare0	uintptr_t Spare0	uintptr_t Spare0	uintptr_t Spare0	uintptr_t Spare0	uintptr_t Spare0	unsigned long ActiveThreadsHighWatermark	union _LARGE_INTEGER ExitTime			unsigned long RequestedTimerResolution	0x0670
															unsigned long LargePrivateVadCount				unsigned long SmallestTimerResolution	0x0674
0x02C8														uint64_t Spare0	unsigned long ActiveThreadsHighWatermark			struct _EX_PUSH_LOCK InvertedFunctionTableLock	0x0688
0x02CC					enum _SE_SIGNING_LEVEL SignatureLevel	enum _SE_SIGNING_LEVEL SignatureLevel													0x0518
0x02CC							void * WnfContext	void * WnfContext											0x0638
0x02CC								uint8_t SignatureLevel	uint8_t SignatureLevel	uint8_t SignatureLevel	uint8_t SignatureLevel	uint8_t SignatureLevel	uint8_t SignatureLevel	struct _EX_PUSH_LOCK ThreadListLock	struct _INVERTED_FUNCTION_TABLE * InvertedFunctionTable		struct _INVERTED_FUNCTION_TABLE * InvertedFunctionTable	union _LARGE_INTEGER ExitTime	0x0678
0x02CC															unsigned long LargePrivateVadCount	unsigned long LargePrivateVadCount	unsigned long LargePrivateVadCount		0x068C
0x02CD								uint8_t SectionSignatureLevel											0x0679
0x02CE								struct _PS_PROTECTION Protection											0x067A
0x02CF								uint8_t[1] SpareByte20											0x067B
0x02D0					unsigned long KeepAliveCounter	unsigned long KeepAliveCounter													0x051C
0x02D0	uint64_t CreateUnbiasedInterruptTime					uintptr_t SectionMappingSize	uintptr_t SectionMappingSize												0x0640
0x02D0								unsigned long Flags3											0x067C
0x02D0:0x00								unsigned long Minimal	unsigned long Minimal	unsigned long Minimal	unsigned long Minimal	unsigned long Minimal	unsigned long Minimal						0x067C:0x00
0x02D0														uint8_t SignatureLevel	struct _EX_PUSH_LOCK ThreadListLock			unsigned long ActiveThreadsHighWatermark	0x0690
0x02D4		struct _PROCESS_DISK_COUNTERS * DiskCounters			struct _PROCESS_DISK_COUNTERS * DiskCounters														0x0520
0x02D4						uint8_t SignatureLevel	uint8_t SignatureLevel		struct _INVERTED_FUNCTION_TABLE * InvertedFunctionTable		struct _INVERTED_FUNCTION_TABLE * InvertedFunctionTable		struct _INVERTED_FUNCTION_TABLE * InvertedFunctionTable	struct _PO_DIAG_STACK_RECORD * TimerResolutionStackRecord					0x0648
0x02D4								long SvmReserved						void * WnfContext	struct _EX_PUSH_LOCK InvertedFunctionTableLock		struct _EX_PUSH_LOCK InvertedFunctionTableLock	struct _INVERTED_FUNCTION_TABLE * InvertedFunctionTable	0x0680
														uint8_t SectionSignatureLevel					0x0691
														struct _PS_PROTECTION Protection					0x0692
														uint8_t[1] SpareByte20					0x0693
														unsigned long Flags3				unsigned long LargePrivateVadCount	0x0694
														unsigned long Minimal					0x0694:0x00
														unsigned long ReplacingPageRoot					0x0694:0x01
0x02D4														long SvmReserved	void * WnfContext	void * WnfContext	void * WnfContext	struct _EX_PUSH_LOCK ThreadListLock	0x0698
0x02D5						uint8_t SectionSignatureLevel													0x0649
0x02D6						uint8_t[2] SpareByte20													0x064A
0x02D8						unsigned long KeepAliveCounter	unsigned long KeepAliveCounter												0x064C
0x02D8								void * SvmReserved1	void * SvmReserved1	void * SvmReserved1	void * SvmReserved1	void * SvmReserved1	void * SvmReserved1						0x0688
0x02D8																uintptr_t Spare0			0x06A0
0x02DC						struct _PROCESS_DISK_COUNTERS * DiskCounters	struct _PROCESS_DISK_COUNTERS * DiskCounters												0x0650
0x02DC								uintptr_t SvmReserved2	uintptr_t SvmReserved2	uintptr_t SvmReserved2	uintptr_t SvmReserved2	uintptr_t SvmReserved2	uintptr_t SvmReserved2						0x0690
0x02DC									void * PicoContext		void * PicoContext		void * PicoContext	uint64_t SvmReserved2	uint8_t SignatureLevel			uint64_t Spare0	0x06A8
0x02DD															uint8_t SectionSignatureLevel				0x06A9
0x02DE															struct _PS_PROTECTION Protection				0x06AA
0x02DF															uint8_t HangCount				0x06AB
0x02E0						uint64_t LastFreezeInterruptTime	uint64_t LastFreezeInterruptTime							union _LARGE_INTEGER ExitTime				struct _LIST_ENTRY TimerResolutionLink	0x0658
0x02E0								uint64_t LastFreezeInterruptTime	uint64_t LastFreezeInterruptTime	uint64_t LastFreezeInterruptTime	uint64_t LastFreezeInterruptTime	uint64_t LastFreezeInterruptTime	uint64_t LastFreezeInterruptTime						0x0698
0x02E0															unsigned long Flags3				0x06AC
0x02E0:0x00															unsigned long Minimal				0x06AC:0x00
0x02E0:0x01															unsigned long ReplacingPageRoot				0x06AC:0x01
0x02E0:0x02															unsigned long DisableNonSystemFonts				0x06AC:0x02
0x02E0:0x03															unsigned long AuditNonSystemFontLoading				0x06AC:0x03
0x02E0:0x04															unsigned long Crashed				0x06AC:0x04
0x02E0:0x05															unsigned long JobVadsAreTracked				0x06AC:0x05
0x02E0:0x06															unsigned long VadTrackingDisabled				0x06AC:0x06
0x02E0:0x07															unsigned long AuxiliaryProcess				0x06AC:0x07
0x02E0:0x08																unsigned long SubsystemProcess			0x06AC:0x08
0x02E0:0x09																unsigned long IndirectCpuSets			0x06AC:0x09
0x02E0:0x0A																unsigned long InPrivate			0x06AC:0x0A
0x02E4														uint64_t LastFreezeInterruptTime	long DeviceAsid			uint8_t SignatureLevel	0x06B0
0x02E8								struct _PROCESS_DISK_COUNTERS * DiskCounters						void * SvmReserved1	uint64_t Spare0			void * WnfContext	0x06A0
																		uint8_t SectionSignatureLevel	0x06B1
																		struct _PS_PROTECTION Protection	0x06B2
			uint8_t HangCount															0x06B3
			unsigned long Minimal	0x06B4:0x00
			unsigned long ReplacingPageRoot	0x06B4:0x01
			unsigned long DisableNonSystemFonts	0x06B4:0x02
			unsigned long AuditNonSystemFontLoading	0x06B4:0x03
			unsigned long Crashed	0x06B4:0x04
			unsigned long JobVadsAreTracked	0x06B4:0x05
			unsigned long VadTrackingDisabled	0x06B4:0x06
			unsigned long AuxiliaryProcess	0x06B4:0x07
			unsigned long SubsystemProcess	0x06B4:0x08
			unsigned long IndirectCpuSets	0x06B4:0x09
			unsigned long InPrivate	0x06B4:0x0A
			unsigned long ProhibitRemoteImageMap	0x06B4:0x0B
			unsigned long ProhibitLowILImageMap	0x06B4:0x0C
			unsigned long SignatureMitigationOptIn	0x06B4:0x0D
0x02E8			void * SvmData														0x06B8
0x02EC			unsigned long KeepAliveCounter	unsigned long KeepAliveCounter				unsigned long KeepAliveCounter	unsigned long KeepAliveCounter	unsigned long KeepAliveCounter	unsigned long KeepAliveCounter						0x06B0
0x02EC												void * PicoContext	struct _EX_PUSH_LOCK SvmProcessLock			void * SvmData	0x06C0
0x02F0			unsigned long NoWakeKeepAliveCounter	unsigned long NoWakeKeepAliveCounter				unsigned long NoWakeKeepAliveCounter	unsigned long NoWakeKeepAliveCounter	unsigned long NoWakeKeepAliveCounter	unsigned long NoWakeKeepAliveCounter					unsigned long Flags3	0x06B4
0x02F0														uintptr_t SvmLock			0x06C8
0x02F4												uint64_t SecurePid	struct _LIST_ENTRY SvmProcessDeviceListHead	struct _LIST_ENTRY SvmProcessDeviceListHead	struct _LIST_ENTRY SvmProcessDeviceListHead	uint64_t SvmLock	0x06D0
0x02F8								uint64_t DeepFreezeStartTime				struct _PROCESS_DISK_COUNTERS * DiskCounters	void * SvmData			long DeviceAsid	0x06B8
0x0300								uintptr_t CommitChargeLimit	uintptr_t CommitChargeLimit	uintptr_t CommitChargeLimit	uintptr_t CommitChargeLimit						0x06C0
0x0300														uint64_t LastFreezeInterruptTime	uint64_t LastFreezeInterruptTime		0x06E0
0x0304								volatile unsigned long CommitChargePeak	volatile uint64_t CommitChargePeak	volatile unsigned long CommitChargePeak	volatile uint64_t CommitChargePeak	uint64_t SecretIdentity	uint64_t SvmLock			struct _EX_PUSH_LOCK SvmProcessLock	0x06C8
0x0308								unsigned long HighPriorityFaultsAllowed									0x06D0
										unsigned long NoWakeKeepAliveCounter	0x06E4
0x0308										unsigned long HighPriorityFaultsAllowed	struct _PROCESS_DISK_COUNTERS * DiskCounters			uint64_t LastFreezeInterruptTime	0x06E8
0x030C	struct _PROCESS_ENERGY_VALUES * EnergyValues	void * PicoContext								struct _PROCESS_DISK_COUNTERS * DiskCounters	0x06F0
0x0310	uint64_t SequenceNumber		void * ContextBuffer							struct _LIST_ENTRY SvmProcessDeviceListHead	0x06D8
			void * VmContext	uint64_t TrustletIdentity					uint64_t TrustletIdentity	void * PicoContext	0x06F8
0x0310				unsigned long KeepAliveCounter				uint64_t TrustletIdentity	0x0700
0x0314				unsigned long NoWakeKeepAliveCounter					0x0704
0x0318	uint64_t CreateInterruptTime	uint64_t CreateInterruptTime	unsigned long KeepAliveCounter	uint64_t LastFreezeInterruptTime				0x06E0
0x0318				unsigned long HighPriorityFaultsAllowed	unsigned long HighPriorityFaultsAllowed		unsigned long KeepAliveCounter	0x0708
0x031C					void * InstrumentationCallback
0x0320	uint64_t CreateUnbiasedInterruptTime							0x06E8
							unsigned long NoWakeKeepAliveCounter	0x070C
0x0320				struct _PROCESS_ENERGY_VALUES * EnergyValues			unsigned long HighPriorityFaultsAllowed	0x0710
0x0324				void * VmContext			struct _PROCESS_ENERGY_VALUES * EnergyValues	0x0718
0x0328				uint64_t SequenceNumber	struct _ESILO * Silo		void * VmContext	0x0720
0x032C				uint64_t CreateInterruptTime	struct _LIST_ENTRY SiloEntry	struct _LIST_ENTRY SiloEntry	uint64_t SequenceNumber	0x0728
				uint64_t CreateUnbiasedInterruptTime			uint64_t CreateInterruptTime	0x0730
0x0338				uint64_t TotalUnbiasedFrozenTime	uint64_t SequenceNumber		uint64_t CreateUnbiasedInterruptTime	0x0738
0x0340				uint64_t LastAppStateUpdateTime	uint64_t CreateInterruptTime		uint64_t TotalUnbiasedFrozenTime	0x0740
0x0348				uint64_t LastAppStateUptime	uint64_t CreateUnbiasedInterruptTime	uint64_t CreateUnbiasedInterruptTime	uint64_t LastAppStateUpdateTime	0x0748:0x00
				uint64_t LastAppState				0x0748:0x3D
0x0350				volatile uint64_t SharedCommitCharge	uint64_t TotalUnbiasedFrozenTime	uint64_t TotalUnbiasedFrozenTime	uint64_t LastAppStateUptime	0x0750
							uint64_t LastAppState	0x0750:0x3D
0x0358				struct _EX_PUSH_LOCK SharedCommitLock	uint64_t LastAppStateUpdateTime		volatile uint64_t SharedCommitCharge	0x0758
0x0360:0x00				struct _LIST_ENTRY SharedCommitLinks	uint64_t LastAppStateUptime		struct _EX_PUSH_LOCK SharedCommitLock	0x0760
0x0360:0x3D					uint64_t LastAppState			0x0760:0x3D
0x0368					volatile unsigned long SharedCommitCharge	volatile uint64_t SharedCommitCharge	struct _LIST_ENTRY SharedCommitLinks	0x0768
0x036C					struct _EX_PUSH_LOCK SharedCommitLock			0x0770
							uint64_t * AllowedCpuSetsIndirect	0x0778
0x0370					struct _LIST_ENTRY SharedCommitLinks	struct _LIST_ENTRY SharedCommitLinks	uint64_t AllowedCpuSets	0x0778
							uint64_t DefaultCpuSets	0x0780
							uint64_t * DefaultCpuSetsIndirect	0x0780
0x0378					uintptr_t AllowedCpuSets			0x0788
0x0378					uintptr_t * AllowedCpuSetsIndirect			0x0788
0x037C					uintptr_t DefaultCpuSets			0x0790
0x037C					uintptr_t * DefaultCpuSetsIndirect			0x0790