Both ProcessEnvironmentBlock_VistaView PEB.Vista ProcessName ProcessId InheritedAddressSpace ReadImageFileExecOptions BeingDebugged ImageUsesLargePages IsProtectedProcess IsLegacyProcess IsImageDynamicallyRelocated SkipPatchingUser32Forwarders IsPackagedProcess IsAppContainer Mutant "0x$($_.Mutant.ToString("X$([IntPtr]::Size * 2)"))" ImageBaseAddress "0x$($_.ImageBaseAddress.ToString("X$([IntPtr]::Size * 2)"))" Ldr InLoadOrderModuleList InMemoryOrderModuleList InInitializationOrderModuleList ProcessParameters SubSystemData "0x$($_.SubSystemData.ToString("X$([IntPtr]::Size * 2)"))" ProcessHeap "0x$($_.ProcessHeap.ToString("X$([IntPtr]::Size * 2)"))" FastPebLock "0x$($_.FastPebLock.ToString("X$([IntPtr]::Size * 2)"))" AtlThunkSListPtr "0x$($_.AtlThunkSListPtr.ToString("X$([IntPtr]::Size * 2)"))" IFEOKey "0x$($_.IFEOKey.ToString("X$([IntPtr]::Size * 2)"))" ProcessInJob ProcessInitializing ProcessUsingVEH ProcessUsingVCH ProcessUsingFTH KernelCallbackTable "0x$($_.KernelCallbackTable.ToString("X$([IntPtr]::Size * 2)"))" SystemReserved 0x{0:X8} AtlThunkSListPtr32 0x{0:X8} ApiSetMap "0x$($_.ApiSetMap.ToString("X$([IntPtr]::Size * 2)"))" TlsExpansionCounter 0x{0:X8} TlsBitmap "0x$($_.TlsBitmap.ToString("X$([IntPtr]::Size * 2)"))" TlsBitmapBits ($_.TlsBitmapBits | % { "0x$($_.ToString('X8'))" }) -join ',' ReadOnlySharedMemoryBase "0x$($_.ReadOnlySharedMemoryBase.ToString("X$([IntPtr]::Size * 2)"))" HotpatchInformation "0x$($_.HotpatchInformation.ToString("X$([IntPtr]::Size * 2)"))" ReadOnlyStaticServerData "0x$($_.ReadOnlyStaticServerData.ToString("X$([IntPtr]::Size * 2)"))" AnsiCodePageData "0x$($_.AnsiCodePageData.ToString("X$([IntPtr]::Size * 2)"))" OemCodePageData "0x$($_.OemCodePageData.ToString("X$([IntPtr]::Size * 2)"))" UnicodeCaseTableData "0x$($_.UnicodeCaseTableData.ToString("X$([IntPtr]::Size * 2)"))" NumberOfProcessors 0x{0:X8} NtGlobalFlag 0x{0:X8} CriticalSectionTimeout 0x{0:X16} HeapSegmentReserve "0x$($_.HeapSegmentReserve.ToString("X$([IntPtr]::Size * 2)"))" HeapSegmentCommit "0x$($_.HeapSegmentCommit.ToString("X$([IntPtr]::Size * 2)"))" HeapDeCommitTotalFreeThreshold "0x$($_.HeapDeCommitTotalFreeThreshold.ToString("X$([IntPtr]::Size * 2)"))" HeapDeCommitFreeBlockThreshold "0x$($_.HeapDeCommitFreeBlockThreshold.ToString("X$([IntPtr]::Size * 2)"))" NumberOfHeaps 0x{0:X8} MaximumNumberOfHeaps 0x{0:X8} ProcessHeaps "0x$($_.ProcessHeaps.ToString("X$([IntPtr]::Size * 2)"))" GdiSharedHandleTable "0x$($_.GdiSharedHandleTable.ToString("X$([IntPtr]::Size * 2)"))" ProcessStarterHelper "0x$($_.ProcessStarterHelper.ToString("X$([IntPtr]::Size * 2)"))" GdiDCAttributeList 0x{0:X8} LoaderLock "0x$($_.LoaderLock.ToString("X$([IntPtr]::Size * 2)"))" OSMajorVersion OSMinorVersion OSBuildNumber OSCSDVersion OSPlatformId ImageSubsystem ImageSubsystemMajorVersion ImageSubsystemMinorVersion ActiveProcessAffinityMask "0x$($_.ActiveProcessAffinityMask.ToString("X$([IntPtr]::Size * 2)"))" GdiHandleBuffer ($_.GdiHandleBuffer | % { "0x$($_.ToString('X8'))" }) -join ',' PostProcessInitRoutine "0x$($_.PostProcessInitRoutine.ToString("X$([IntPtr]::Size * 2)"))" TlsExpansionBitmap "0x$($_.TlsExpansionBitmap.ToString("X$([IntPtr]::Size * 2)"))" TlsExpansionBitmapBits ($_.TlsExpansionBitmapBits | % { "0x$($_.ToString('X8'))" }) -join ',' SessionId 0x{0:X8} AppCompatFlags 0x{0:X16} AppCompatFlagsUser 0x{0:X16} pShimData "0x$($_.pShimData.ToString("X$([IntPtr]::Size * 2)"))" AppCompatInfo 0x{0:X8} CSDVersion ActivationContextData "0x$($_.ActivationContextData.ToString("X$([IntPtr]::Size * 2)"))" ProcessAssemblyStorageMap "0x$($_.ProcessAssemblyStorageMap.ToString("X$([IntPtr]::Size * 2)"))" SystemDefaultActivationContextData "0x$($_.SystemDefaultActivationContextData.ToString("X$([IntPtr]::Size * 2)"))" SystemAssemblyStorageMap "0x$($_.SystemAssemblyStorageMap.ToString("X$([IntPtr]::Size * 2)"))" MinimumStackCommit "0x$($_.MinimumStackCommit.ToString("X$([IntPtr]::Size * 2)"))" FlsCallback "0x$($_.FlsCallback.ToString("X$([IntPtr]::Size * 2)"))" FlsListHead FlsBitmap "0x$($_.FlsBitmap.ToString("X$([IntPtr]::Size * 2)"))" FlsBitmapBits ($_.FlsBitmapBits | % { "0x$($_.ToString('X8'))" }) -join ',' FlsHighIndex 0x{0:X8} WerRegistrationData "0x$($_.WerRegistrationData.ToString("X$([IntPtr]::Size * 2)"))" WerShipAssertPtr "0x$($_.WerShipAssertPtr.ToString("X$([IntPtr]::Size * 2)"))" pUnused "0x$($_.pUnused.ToString("X$([IntPtr]::Size * 2)"))" pImageHeaderHash "0x$($_.pImageHeaderHash.ToString("X$([IntPtr]::Size * 2)"))" HeapTracingEnabled CritSecTracingEnabled LibLoaderTracingEnabled CsrServerReadOnlySharedMemoryBase 0x{0:X16} ProcessEnvironmentBlock_Server2003View PEB.Server2003 ProcessName ProcessId InheritedAddressSpace if($_.InheritedAddressSpace -eq 0){$False}else{$True} ReadImageFileExecOptions if($_.ReadImageFileExecOptions -eq 0){$False}else{$True} BeingDebugged if($_.BeingDebugged -eq 0){$False}else{$True} ImageUsesLargePages Mutant "0x$($_.Mutant.ToString("X$([IntPtr]::Size * 2)"))" ImageBaseAddress "0x$($_.ImageBaseAddress.ToString("X$([IntPtr]::Size * 2)"))" Ldr InLoadOrderModuleList InMemoryOrderModuleList InInitializationOrderModuleList ProcessParameters SubSystemData "0x$($_.SubSystemData.ToString("X$([IntPtr]::Size * 2)"))" ProcessHeap "0x$($_.ProcessHeap.ToString("X$([IntPtr]::Size * 2)"))" FastPebLock "0x$($_.FastPebLock.ToString("X$([IntPtr]::Size * 2)"))" AtlThunkSListPtr "0x$($_.AtlThunkSListPtr.ToString("X$([IntPtr]::Size * 2)"))" SparePtr2 "0x$($_.SparePtr2.ToString("X$([IntPtr]::Size * 2)"))" EnvironmentUpdateCount 0x{0:X8} KernelCallbackTable "0x$($_.KernelCallbackTable.ToString("X$([IntPtr]::Size * 2)"))" SystemReserved 0x{0:X8} AtlThunkSListPtr32 0x{0:X8} ApiSetMap "0x$($_.ApiSetMap.ToString("X$([IntPtr]::Size * 2)"))" TlsExpansionCounter 0x{0:X8} TlsBitmap "0x$($_.TlsBitmap.ToString("X$([IntPtr]::Size * 2)"))" TlsBitmapBits ($_.TlsBitmapBits | % { "0x$($_.ToString('X8'))" }) -join ',' ReadOnlySharedMemoryBase "0x$($_.ReadOnlySharedMemoryBase.ToString("X$([IntPtr]::Size * 2)"))" ReadOnlySharedMemoryHeap "0x$($_.ReadOnlySharedMemoryHeap.ToString("X$([IntPtr]::Size * 2)"))" ReadOnlyStaticServerData "0x$($_.ReadOnlyStaticServerData.ToString("X$([IntPtr]::Size * 2)"))" AnsiCodePageData "0x$($_.AnsiCodePageData.ToString("X$([IntPtr]::Size * 2)"))" OemCodePageData "0x$($_.OemCodePageData.ToString("X$([IntPtr]::Size * 2)"))" UnicodeCaseTableData "0x$($_.UnicodeCaseTableData.ToString("X$([IntPtr]::Size * 2)"))" NumberOfProcessors 0x{0:X8} NtGlobalFlag 0x{0:X8} CriticalSectionTimeout 0x{0:X16} HeapSegmentReserve "0x$($_.HeapSegmentReserve.ToString("X$([IntPtr]::Size * 2)"))" HeapSegmentCommit "0x$($_.HeapSegmentCommit.ToString("X$([IntPtr]::Size * 2)"))" HeapDeCommitTotalFreeThreshold "0x$($_.HeapDeCommitTotalFreeThreshold.ToString("X$([IntPtr]::Size * 2)"))" HeapDeCommitFreeBlockThreshold "0x$($_.HeapDeCommitFreeBlockThreshold.ToString("X$([IntPtr]::Size * 2)"))" NumberOfHeaps 0x{0:X8} MaximumNumberOfHeaps 0x{0:X8} ProcessHeaps "0x$($_.ProcessHeaps.ToString("X$([IntPtr]::Size * 2)"))" GdiSharedHandleTable "0x$($_.GdiSharedHandleTable.ToString("X$([IntPtr]::Size * 2)"))" ProcessStarterHelper "0x$($_.ProcessStarterHelper.ToString("X$([IntPtr]::Size * 2)"))" GdiDCAttributeList 0x{0:X8} LoaderLock "0x$($_.LoaderLock.ToString("X$([IntPtr]::Size * 2)"))" OSMajorVersion OSMinorVersion OSBuildNumber OSCSDVersion OSPlatformId ImageSubsystem ImageSubsystemMajorVersion ImageSubsystemMinorVersion ActiveProcessAffinityMask "0x$($_.ActiveProcessAffinityMask.ToString("X$([IntPtr]::Size * 2)"))" GdiHandleBuffer ($_.GdiHandleBuffer | % { "0x$($_.ToString('X8'))" }) -join ',' PostProcessInitRoutine "0x$($_.PostProcessInitRoutine.ToString("X$([IntPtr]::Size * 2)"))" TlsExpansionBitmap "0x$($_.TlsExpansionBitmap.ToString("X$([IntPtr]::Size * 2)"))" TlsExpansionBitmapBits ($_.TlsExpansionBitmapBits | % { "0x$($_.ToString('X8'))" }) -join ',' SessionId 0x{0:X8} AppCompatFlags 0x{0:X16} AppCompatFlagsUser 0x{0:X16} pShimData "0x$($_.pShimData.ToString("X$([IntPtr]::Size * 2)"))" AppCompatInfo 0x{0:X8} CSDVersion ActivationContextData "0x$($_.ActivationContextData.ToString("X$([IntPtr]::Size * 2)"))" ProcessAssemblyStorageMap "0x$($_.ProcessAssemblyStorageMap.ToString("X$([IntPtr]::Size * 2)"))" SystemDefaultActivationContextData "0x$($_.SystemDefaultActivationContextData.ToString("X$([IntPtr]::Size * 2)"))" SystemAssemblyStorageMap "0x$($_.SystemAssemblyStorageMap.ToString("X$([IntPtr]::Size * 2)"))" MinimumStackCommit "0x$($_.MinimumStackCommit.ToString("X$([IntPtr]::Size * 2)"))" FlsCallback "0x$($_.FlsCallback.ToString("X$([IntPtr]::Size * 2)"))" FlsListHead FlsBitmap "0x$($_.FlsBitmap.ToString("X$([IntPtr]::Size * 2)"))" FlsBitmapBits ($_.FlsBitmapBits | % { "0x$($_.ToString('X8'))" }) -join ',' FlsHighIndex 0x{0:X8} ProcessEnvironmentBlock_XPView PEB.XP ProcessName ProcessId InheritedAddressSpace if($_.InheritedAddressSpace -eq 0){$False}else{$True} ReadImageFileExecOptions if($_.ReadImageFileExecOptions -eq 0){$False}else{$True} BeingDebugged if($_.BeingDebugged -eq 0){$False}else{$True} Mutant "0x$($_.Mutant.ToString("X$([IntPtr]::Size * 2)"))" ImageBaseAddress "0x$($_.ImageBaseAddress.ToString("X$([IntPtr]::Size * 2)"))" Ldr InLoadOrderModuleList InMemoryOrderModuleList InInitializationOrderModuleList ProcessParameters SubSystemData "0x$($_.SubSystemData.ToString("X$([IntPtr]::Size * 2)"))" ProcessHeap "0x$($_.ProcessHeap.ToString("X$([IntPtr]::Size * 2)"))" FastPebLock "0x$($_.FastPebLock.ToString("X$([IntPtr]::Size * 2)"))" FastPebLockRoutine "0x$($_.FastPebLockRoutine.ToString("X$([IntPtr]::Size * 2)"))" FastPebUnlockRoutine "0x$($_.FastPebUnlockRoutine.ToString("X$([IntPtr]::Size * 2)"))" EnvironmentUpdateCount 0x{0:X8} KernelCallbackTable "0x$($_.KernelCallbackTable.ToString("X$([IntPtr]::Size * 2)"))" SystemReserved 0x{0:X8} AtlThunkSListPtr32 0x{0:X8} ApiSetMap "0x$($_.ApiSetMap.ToString("X$([IntPtr]::Size * 2)"))" TlsExpansionCounter 0x{0:X8} TlsBitmap "0x$($_.TlsBitmap.ToString("X$([IntPtr]::Size * 2)"))" TlsBitmapBits ($_.TlsBitmapBits | % { "0x$($_.ToString('X8'))" }) -join ',' ReadOnlySharedMemoryBase "0x$($_.ReadOnlySharedMemoryBase.ToString("X$([IntPtr]::Size * 2)"))" ReadOnlySharedMemoryHeap "0x$($_.ReadOnlySharedMemoryHeap.ToString("X$([IntPtr]::Size * 2)"))" ReadOnlyStaticServerData "0x$($_.ReadOnlyStaticServerData.ToString("X$([IntPtr]::Size * 2)"))" AnsiCodePageData "0x$($_.AnsiCodePageData.ToString("X$([IntPtr]::Size * 2)"))" OemCodePageData "0x$($_.OemCodePageData.ToString("X$([IntPtr]::Size * 2)"))" UnicodeCaseTableData "0x$($_.UnicodeCaseTableData.ToString("X$([IntPtr]::Size * 2)"))" NumberOfProcessors 0x{0:X8} NtGlobalFlag 0x{0:X8} CriticalSectionTimeout 0x{0:X16} HeapSegmentReserve "0x$($_.HeapSegmentReserve.ToString("X$([IntPtr]::Size * 2)"))" HeapSegmentCommit "0x$($_.HeapSegmentCommit.ToString("X$([IntPtr]::Size * 2)"))" HeapDeCommitTotalFreeThreshold "0x$($_.HeapDeCommitTotalFreeThreshold.ToString("X$([IntPtr]::Size * 2)"))" HeapDeCommitFreeBlockThreshold "0x$($_.HeapDeCommitFreeBlockThreshold.ToString("X$([IntPtr]::Size * 2)"))" NumberOfHeaps 0x{0:X8} MaximumNumberOfHeaps 0x{0:X8} ProcessHeaps "0x$($_.ProcessHeaps.ToString("X$([IntPtr]::Size * 2)"))" GdiSharedHandleTable "0x$($_.GdiSharedHandleTable.ToString("X$([IntPtr]::Size * 2)"))" ProcessStarterHelper "0x$($_.ProcessStarterHelper.ToString("X$([IntPtr]::Size * 2)"))" GdiDCAttributeList 0x{0:X8} LoaderLock "0x$($_.LoaderLock.ToString("X$([IntPtr]::Size * 2)"))" OSMajorVersion OSMinorVersion OSBuildNumber OSCSDVersion OSPlatformId ImageSubsystem ImageSubsystemMajorVersion ImageSubsystemMinorVersion ActiveProcessAffinityMask "0x$($_.ActiveProcessAffinityMask.ToString("X$([IntPtr]::Size * 2)"))" GdiHandleBuffer ($_.GdiHandleBuffer | % { "0x$($_.ToString('X8'))" }) -join ',' PostProcessInitRoutine "0x$($_.PostProcessInitRoutine.ToString("X$([IntPtr]::Size * 2)"))" TlsExpansionBitmap "0x$($_.TlsExpansionBitmap.ToString("X$([IntPtr]::Size * 2)"))" TlsExpansionBitmapBits ($_.TlsExpansionBitmapBits | % { "0x$($_.ToString('X8'))" }) -join ',' SessionId 0x{0:X8} AppCompatFlags 0x{0:X16} AppCompatFlagsUser 0x{0:X16} pShimData "0x$($_.pShimData.ToString("X$([IntPtr]::Size * 2)"))" AppCompatInfo 0x{0:X8} CSDVersion ActivationContextData "0x$($_.ActivationContextData.ToString("X$([IntPtr]::Size * 2)"))" ProcessAssemblyStorageMap "0x$($_.ProcessAssemblyStorageMap.ToString("X$([IntPtr]::Size * 2)"))" SystemDefaultActivationContextData "0x$($_.SystemDefaultActivationContextData.ToString("X$([IntPtr]::Size * 2)"))" SystemAssemblyStorageMap "0x$($_.SystemAssemblyStorageMap.ToString("X$([IntPtr]::Size * 2)"))" MinimumStackCommit "0x$($_.MinimumStackCommit.ToString("X$([IntPtr]::Size * 2)"))" ProcessEnvironmentBlock_ModuleEntryView PEB.ModuleEntry InLoadOrderModuleList InMemoryOrderModuleList InInitializationOrderModuleList BaseAddress "0x$($_.BaseAddress.ToString("X$([IntPtr]::Size * 2)"))" EntryPoint "0x$($_.EntryPoint.ToString("X$([IntPtr]::Size * 2)"))" SizeOfImage 0x{0:X8} FullDllName BaseDllName PackagedBinary ImageDll LoadNotificationsSent TelemetryEntryProcessed ProcessStaticImport InLegacyLists InIndexes ShimDll InExceptionTable LoadInProgress EntryProcessed DontCallForThreads ProcessAttachCalled ProcessAttachFailed CorDeferredValidate CorImage DontRelocate CorILOnly Redirected CompatDatabaseProcessed ObsoleteLoadCount 0x{0:X4} TlsIndex 0x{0:X4} HashLinks TimeDateStamp EntryPointActivationContext "0x$($_.EntryPointActivationContext.ToString("X$([IntPtr]::Size * 2)"))" PatchInformation "0x$($_.PatchInformation.ToString("X$([IntPtr]::Size * 2)"))" DdagNode "0x$($_.DdagNode.ToString("X$([IntPtr]::Size * 2)"))" NodeModuleLink SnapContext "0x$($_.SnapContext.ToString("X$([IntPtr]::Size * 2)"))" ParentDllBase "0x$($_.ParentDllBase.ToString("X$([IntPtr]::Size * 2)"))" SwitchBackContext "0x$($_.SwitchBackContext.ToString("X$([IntPtr]::Size * 2)"))" BaseAddressIndexNode MappingInfoIndexNode OriginalBase "0x$($_.OriginalBase.ToString("X$([IntPtr]::Size * 2)"))" LoadTime 0x{0:X16} BaseNameHashValue 0x{0:X8} LoadReason ProcessParameters PEB.ProcessParameters MaximumLength 0x{0:X8} Length 0x{0:X8} Flags 0x{0:X8} DebugFlags 0x{0:X8} ConsoleHandle "0x$($_.ConsoleHandle.ToString("X$([IntPtr]::Size * 2)"))" ConsoleFlags 0x{0:X8} StandardInput "0x$($_.StandardInput.ToString("X$([IntPtr]::Size * 2)"))" StandardOutput "0x$($_.StandardOutput.ToString("X$([IntPtr]::Size * 2)"))" StandardError "0x$($_.StandardError.ToString("X$([IntPtr]::Size * 2)"))" CurrentDirectory DllPath ImagePathName CommandLine Environment "0x$($_.Environment.ToString("X$([IntPtr]::Size * 2)"))" StartingX 0x{0:X8} StartingY 0x{0:X8} CountX 0x{0:X8} CountY 0x{0:X8} CountCharsX 0x{0:X8} CountCharsY 0x{0:X8} FillAttribute 0x{0:X8} WindowFlags 0x{0:X8} ShowWindowFlags 0x{0:X8} WindowTitle DesktopInfo ShellInfo RuntimeData