- Scan _ETHREAD with PoolTag='Thre' - Parse pid/ppid from _EPROCESS - Build process tree from output log - Static link for machine missing Windows C++ dev environment