struct _EPROCESS// Size=0x660
{
    struct _KPROCESS Pcb;// Offset=0x0 Size=0x2c8
    struct _EX_PUSH_LOCK ProcessLock;// Offset=0x2c8 Size=0x8
    union _LARGE_INTEGER CreateTime;// Offset=0x2d0 Size=0x8
    struct _EX_RUNDOWN_REF RundownProtect;// Offset=0x2d8 Size=0x8
    void * UniqueProcessId;// Offset=0x2e0 Size=0x8
    struct _LIST_ENTRY ActiveProcessLinks;// Offset=0x2e8 Size=0x10
    unsigned long Flags2;// Offset=0x2f8 Size=0x4
    unsigned long JobNotReallyActive:1;// Offset=0x2f8 Size=0x4 BitOffset=0x0 BitSize=0x1
    unsigned long AccountingFolded:1;// Offset=0x2f8 Size=0x4 BitOffset=0x1 BitSize=0x1
    unsigned long NewProcessReported:1;// Offset=0x2f8 Size=0x4 BitOffset=0x2 BitSize=0x1
    unsigned long ExitProcessReported:1;// Offset=0x2f8 Size=0x4 BitOffset=0x3 BitSize=0x1
    unsigned long ReportCommitChanges:1;// Offset=0x2f8 Size=0x4 BitOffset=0x4 BitSize=0x1
    unsigned long LastReportMemory:1;// Offset=0x2f8 Size=0x4 BitOffset=0x5 BitSize=0x1
    unsigned long NoWakeCharge:1;// Offset=0x2f8 Size=0x4 BitOffset=0x6 BitSize=0x1
    unsigned long HandleTableRundown:1;// Offset=0x2f8 Size=0x4 BitOffset=0x7 BitSize=0x1
    unsigned long NeedsHandleRundown:1;// Offset=0x2f8 Size=0x4 BitOffset=0x8 BitSize=0x1
    unsigned long RefTraceEnabled:1;// Offset=0x2f8 Size=0x4 BitOffset=0x9 BitSize=0x1
    unsigned long NumaAware:1;// Offset=0x2f8 Size=0x4 BitOffset=0xa BitSize=0x1
    unsigned long EmptyJobEvaluated:1;// Offset=0x2f8 Size=0x4 BitOffset=0xb BitSize=0x1
    unsigned long DefaultPagePriority:3;// Offset=0x2f8 Size=0x4 BitOffset=0xc BitSize=0x3
    unsigned long PrimaryTokenFrozen:1;// Offset=0x2f8 Size=0x4 BitOffset=0xf BitSize=0x1
    unsigned long ProcessVerifierTarget:1;// Offset=0x2f8 Size=0x4 BitOffset=0x10 BitSize=0x1
    unsigned long StackRandomizationDisabled:1;// Offset=0x2f8 Size=0x4 BitOffset=0x11 BitSize=0x1
    unsigned long AffinityPermanent:1;// Offset=0x2f8 Size=0x4 BitOffset=0x12 BitSize=0x1
    unsigned long AffinityUpdateEnable:1;// Offset=0x2f8 Size=0x4 BitOffset=0x13 BitSize=0x1
    unsigned long PropagateNode:1;// Offset=0x2f8 Size=0x4 BitOffset=0x14 BitSize=0x1
    unsigned long ExplicitAffinity:1;// Offset=0x2f8 Size=0x4 BitOffset=0x15 BitSize=0x1
    unsigned long ProcessExecutionState:2;// Offset=0x2f8 Size=0x4 BitOffset=0x16 BitSize=0x2
    unsigned long DisallowStrippedImages:1;// Offset=0x2f8 Size=0x4 BitOffset=0x18 BitSize=0x1
    unsigned long HighEntropyASLREnabled:1;// Offset=0x2f8 Size=0x4 BitOffset=0x19 BitSize=0x1
    unsigned long ExtensionPointDisable:1;// Offset=0x2f8 Size=0x4 BitOffset=0x1a BitSize=0x1
    unsigned long ForceRelocateImages:1;// Offset=0x2f8 Size=0x4 BitOffset=0x1b BitSize=0x1
    unsigned long ProcessStateChangeRequest:2;// Offset=0x2f8 Size=0x4 BitOffset=0x1c BitSize=0x2
    unsigned long ProcessStateChangeInProgress:1;// Offset=0x2f8 Size=0x4 BitOffset=0x1e BitSize=0x1
    unsigned long DisallowWin32kSystemCalls:1;// Offset=0x2f8 Size=0x4 BitOffset=0x1f BitSize=0x1
    unsigned long Flags;// Offset=0x2fc Size=0x4
    unsigned long CreateReported:1;// Offset=0x2fc Size=0x4 BitOffset=0x0 BitSize=0x1
    unsigned long NoDebugInherit:1;// Offset=0x2fc Size=0x4 BitOffset=0x1 BitSize=0x1
    unsigned long ProcessExiting:1;// Offset=0x2fc Size=0x4 BitOffset=0x2 BitSize=0x1
    unsigned long ProcessDelete:1;// Offset=0x2fc Size=0x4 BitOffset=0x3 BitSize=0x1
    unsigned long Wow64SplitPages:1;// Offset=0x2fc Size=0x4 BitOffset=0x4 BitSize=0x1
    unsigned long VmDeleted:1;// Offset=0x2fc Size=0x4 BitOffset=0x5 BitSize=0x1
    unsigned long OutswapEnabled:1;// Offset=0x2fc Size=0x4 BitOffset=0x6 BitSize=0x1
    unsigned long Outswapped:1;// Offset=0x2fc Size=0x4 BitOffset=0x7 BitSize=0x1
    unsigned long ForkFailed:1;// Offset=0x2fc Size=0x4 BitOffset=0x8 BitSize=0x1
    unsigned long Wow64VaSpace4Gb:1;// Offset=0x2fc Size=0x4 BitOffset=0x9 BitSize=0x1
    unsigned long AddressSpaceInitialized:2;// Offset=0x2fc Size=0x4 BitOffset=0xa BitSize=0x2
    unsigned long SetTimerResolution:1;// Offset=0x2fc Size=0x4 BitOffset=0xc BitSize=0x1
    unsigned long BreakOnTermination:1;// Offset=0x2fc Size=0x4 BitOffset=0xd BitSize=0x1
    unsigned long DeprioritizeViews:1;// Offset=0x2fc Size=0x4 BitOffset=0xe BitSize=0x1
    unsigned long WriteWatch:1;// Offset=0x2fc Size=0x4 BitOffset=0xf BitSize=0x1
    unsigned long ProcessInSession:1;// Offset=0x2fc Size=0x4 BitOffset=0x10 BitSize=0x1
    unsigned long OverrideAddressSpace:1;// Offset=0x2fc Size=0x4 BitOffset=0x11 BitSize=0x1
    unsigned long HasAddressSpace:1;// Offset=0x2fc Size=0x4 BitOffset=0x12 BitSize=0x1
    unsigned long LaunchPrefetched:1;// Offset=0x2fc Size=0x4 BitOffset=0x13 BitSize=0x1
    unsigned long Background:1;// Offset=0x2fc Size=0x4 BitOffset=0x14 BitSize=0x1
    unsigned long VmTopDown:1;// Offset=0x2fc Size=0x4 BitOffset=0x15 BitSize=0x1
    unsigned long ImageNotifyDone:1;// Offset=0x2fc Size=0x4 BitOffset=0x16 BitSize=0x1
    unsigned long PdeUpdateNeeded:1;// Offset=0x2fc Size=0x4 BitOffset=0x17 BitSize=0x1
    unsigned long VdmAllowed:1;// Offset=0x2fc Size=0x4 BitOffset=0x18 BitSize=0x1
    unsigned long CrossSessionCreate:1;// Offset=0x2fc Size=0x4 BitOffset=0x19 BitSize=0x1
    unsigned long ProcessInserted:1;// Offset=0x2fc Size=0x4 BitOffset=0x1a BitSize=0x1
    unsigned long DefaultIoPriority:3;// Offset=0x2fc Size=0x4 BitOffset=0x1b BitSize=0x3
    unsigned long ProcessSelfDelete:1;// Offset=0x2fc Size=0x4 BitOffset=0x1e BitSize=0x1
    unsigned long SetTimerResolutionLink:1;// Offset=0x2fc Size=0x4 BitOffset=0x1f BitSize=0x1
    unsigned long long ProcessQuotaUsage[2];// Offset=0x300 Size=0x10
    unsigned long long ProcessQuotaPeak[2];// Offset=0x310 Size=0x10
    unsigned long long PeakVirtualSize;// Offset=0x320 Size=0x8
    unsigned long long VirtualSize;// Offset=0x328 Size=0x8
    struct _LIST_ENTRY SessionProcessLinks;// Offset=0x330 Size=0x10
    void * ExceptionPortData;// Offset=0x340 Size=0x8
    unsigned long long ExceptionPortValue;// Offset=0x340 Size=0x8
    unsigned long long ExceptionPortState:3;// Offset=0x340 Size=0x8 BitOffset=0x0 BitSize=0x3
    struct _EX_FAST_REF Token;// Offset=0x348 Size=0x8
    unsigned long long WorkingSetPage;// Offset=0x350 Size=0x8
    struct _EX_PUSH_LOCK AddressCreationLock;// Offset=0x358 Size=0x8
    struct _ETHREAD * RotateInProgress;// Offset=0x360 Size=0x8
    struct _ETHREAD * ForkInProgress;// Offset=0x368 Size=0x8
    unsigned long long HardwareTrigger;// Offset=0x370 Size=0x8
    struct _EJOB * CommitChargeJob;// Offset=0x378 Size=0x8
    struct _MM_AVL_TABLE * CloneRoot;// Offset=0x380 Size=0x8
    unsigned long long NumberOfPrivatePages;// Offset=0x388 Size=0x8
    unsigned long long NumberOfLockedPages;// Offset=0x390 Size=0x8
    void * Win32Process;// Offset=0x398 Size=0x8
    struct _EJOB * Job;// Offset=0x3a0 Size=0x8
    void * SectionObject;// Offset=0x3a8 Size=0x8
    void * SectionBaseAddress;// Offset=0x3b0 Size=0x8
    unsigned long Cookie;// Offset=0x3b8 Size=0x4
    struct _PAGEFAULT_HISTORY * WorkingSetWatch;// Offset=0x3c0 Size=0x8
    void * Win32WindowStation;// Offset=0x3c8 Size=0x8
    void * InheritedFromUniqueProcessId;// Offset=0x3d0 Size=0x8
    void * LdtInformation;// Offset=0x3d8 Size=0x8
    struct _EPROCESS * CreatorProcess;// Offset=0x3e0 Size=0x8
    unsigned long long ConsoleHostProcess;// Offset=0x3e0 Size=0x8
    struct _PEB * Peb;// Offset=0x3e8 Size=0x8
    void * Session;// Offset=0x3f0 Size=0x8
    void * AweInfo;// Offset=0x3f8 Size=0x8
    struct _EPROCESS_QUOTA_BLOCK * QuotaBlock;// Offset=0x400 Size=0x8
    struct _HANDLE_TABLE * ObjectTable;// Offset=0x408 Size=0x8
    void * DebugPort;// Offset=0x410 Size=0x8
    void * Wow64Process;// Offset=0x418 Size=0x8
    void * DeviceMap;// Offset=0x420 Size=0x8
    void * EtwDataSource;// Offset=0x428 Size=0x8
    unsigned long long PageDirectoryPte;// Offset=0x430 Size=0x8
    unsigned char ImageFileName[15];// Offset=0x438 Size=0xf
    unsigned char PriorityClass;// Offset=0x447 Size=0x1
    void * SecurityPort;// Offset=0x448 Size=0x8
    struct _SE_AUDIT_PROCESS_CREATION_INFO SeAuditProcessCreationInfo;// Offset=0x450 Size=0x8
    struct _LIST_ENTRY JobLinks;// Offset=0x458 Size=0x10
    void * HighestUserAddress;// Offset=0x468 Size=0x8
    struct _LIST_ENTRY ThreadListHead;// Offset=0x470 Size=0x10
    unsigned long ActiveThreads;// Offset=0x480 Size=0x4
    unsigned long ImagePathHash;// Offset=0x484 Size=0x4
    unsigned long DefaultHardErrorProcessing;// Offset=0x488 Size=0x4
    long LastThreadExitStatus;// Offset=0x48c Size=0x4
    struct _EX_FAST_REF PrefetchTrace;// Offset=0x490 Size=0x8
    struct _MM_AVL_TABLE * LockedPagesList;// Offset=0x498 Size=0x8
    union _LARGE_INTEGER ReadOperationCount;// Offset=0x4a0 Size=0x8
    union _LARGE_INTEGER WriteOperationCount;// Offset=0x4a8 Size=0x8
    union _LARGE_INTEGER OtherOperationCount;// Offset=0x4b0 Size=0x8
    union _LARGE_INTEGER ReadTransferCount;// Offset=0x4b8 Size=0x8
    union _LARGE_INTEGER WriteTransferCount;// Offset=0x4c0 Size=0x8
    union _LARGE_INTEGER OtherTransferCount;// Offset=0x4c8 Size=0x8
    unsigned long long CommitChargeLimit;// Offset=0x4d0 Size=0x8
    unsigned long long CommitCharge;// Offset=0x4d8 Size=0x8
    unsigned long long CommitChargePeak;// Offset=0x4e0 Size=0x8
    struct _MMSUPPORT Vm;// Offset=0x4e8 Size=0x90
    struct _LIST_ENTRY MmProcessLinks;// Offset=0x578 Size=0x10
    unsigned long ModifiedPageCount;// Offset=0x588 Size=0x4
    long ExitStatus;// Offset=0x58c Size=0x4
    struct _MM_AVL_TABLE VadRoot;// Offset=0x590 Size=0x30
    unsigned long long VadPhysicalPages;// Offset=0x5c0 Size=0x8
    unsigned long long VadPhysicalPagesLimit;// Offset=0x5c8 Size=0x8
    struct _ALPC_PROCESS_CONTEXT AlpcContext;// Offset=0x5d0 Size=0x20
    struct _LIST_ENTRY TimerResolutionLink;// Offset=0x5f0 Size=0x10
    struct _PO_DIAG_STACK_RECORD * TimerResolutionStackRecord;// Offset=0x600 Size=0x8
    unsigned long RequestedTimerResolution;// Offset=0x608 Size=0x4
    unsigned long SmallestTimerResolution;// Offset=0x60c Size=0x4
    union _LARGE_INTEGER ExitTime;// Offset=0x610 Size=0x8
    struct _INVERTED_FUNCTION_TABLE * InvertedFunctionTable;// Offset=0x618 Size=0x8
    struct _EX_PUSH_LOCK InvertedFunctionTableLock;// Offset=0x620 Size=0x8
    unsigned long ActiveThreadsHighWatermark;// Offset=0x628 Size=0x4
    unsigned long LargePrivateVadCount;// Offset=0x62c Size=0x4
    struct _EX_PUSH_LOCK ThreadListLock;// Offset=0x630 Size=0x8
    void * WnfContext;// Offset=0x638 Size=0x8
    unsigned long long SectionMappingSize;// Offset=0x640 Size=0x8
    unsigned char SignatureLevel;// Offset=0x648 Size=0x1
    unsigned char SectionSignatureLevel;// Offset=0x649 Size=0x1
    unsigned char SpareByte20[2];// Offset=0x64a Size=0x2
    unsigned long KeepAliveCounter;// Offset=0x64c Size=0x4
    struct _PROCESS_DISK_COUNTERS * DiskCounters;// Offset=0x650 Size=0x8
    unsigned long long LastFreezeInterruptTime;// Offset=0x658 Size=0x8
};