Subclass of BaseRecord.
The process and thread that crashed, as a triage dump recorded them: it
snapshots their EPROCESS and ETHREAD as raw bytes rather than as
mapped memory. A field is None if the dump does not record it.
-
property create_time: int | None
When the process was created (FILETIME).
-
property create_time_utc: str | None
When the process was created (ISO 8601 UTC). None if ntoseye cannot
convert the recorded time.
-
property exit_status: int | None
The process’s exit status (NTSTATUS).
-
property parent_process_id: int | None
-
property process_id: int | None
-
property process_name: str | None
-
property thread_exit_status: int | None
The thread’s exit status (NTSTATUS).
-
property thread_id: int | None