This structure defines the extension to the basic information about the process.
NtQueryInformationProcesswithProcessBasicInformation(0)
Specifies the size in bytes of the valid portion of this structure's header.
The basic information. See PROCESS_BASIC_INFORMATION for more details.
A bit mask of various flags about the process.
The process is full- or light-protected.
PROCESSINFOCLASSvalue ofProcessProtectionInformation(61)PS_PROTECTION
Indicates that the process is 32-bit and runs under the WoW64 emulation.
PROCESSINFOCLASSvalue ofProcessWow64Information(26)
The process is terminating and its object is marked for deletion.
NtTerminateProcess
The process was created cross-session.
The threads in the process are suspended and cannot be resumed until the process is unfrozen.
The process belongs to a background job.
The process has a strong package identity.
RtlQueryPackageIdentity
The process runs in Isolated User Mode (IUM).
This field was introduced in Windows 10 TH1 (1507).
The process is a Pico or a WSL process.
This field was previously known as IsPicoProcess.
This field was introduced in Windows 10 RS1 (1607).
PROCESSINFOCLASSvalue ofProcessSubsystemInformation(75)
This structure was introduced in Windows 8.