Subclass of BaseRecord.
A process as !process shows it: its identity and the layout-sensitive
_EPROCESS fields. Each field is None when this build’s layout lacks
it or its read failed.
-
property commit_charge: int | None
-
property create_time: int | None
CreateTime as a FILETIME.
-
property debug_port: int | None
-
property directory_table_base: int | None
-
property handle_count: int | None
-
property info: ProcessInfo
-
property job: int | None
-
property kernel_time: int | None
-
property object_table: int | None
-
property parent_pid: int | None
-
property peak_virtual_size: int | None
-
property peb: int | None
The _PEB.
-
property private_page_count: int | None
-
property quota_nonpaged_pool: int | None
-
property quota_paged_pool: int | None
-
property session_id: int | None
-
property token: int | None
-
property user_time: int | None
-
property vad_count: int | None
The number of VADs, where the build counts them.
-
property vad_root: int | None
The root VAD.
-
property working_set_size: int | None