Cross-Process Flags in the PEB

Windows Vista added a new set of bit fields to the PEB, reliably at offsets 0x28 and 0x50 in 32-bit and 64-bit Windows respectively. A single ULONG, named CrossProcessFlags, overlays the bits.

Mask Definition Versions
0x00000001
ULONG ProcessInJob : 1;
6.0 and higher
0x00000002
ULONG ProcessInitializing : 1;
6.0 and higher
0x00000004
ULONG ProcessUsingVEH : 1;
6.1 and higher
0x00000008
ULONG ProcessUsingVCH : 1;
6.1 and higher
0x00000010
ULONG ProcessUsingFTH : 1;
6.1 and higher
0x00000020
ULONG ProcessPreviouslyThrottled : 1;
1703 and higher
0x00000040
ULONG ProcessCurrentlyThrottled : 1;
1703 and higher
 
ULONG ReservedBits0 : 30;
6.0 only
ULONG ReservedBits0 : 27;
6.1 to 1607
ULONG ReservedBits0 : 25;
1703 and higher