_SE_AUDIT_PROCESS_CREATION_INFO

Metadatacopy
struct _SE_AUDIT_PROCESS_CREATION_INFO {
    struct _OBJECT_NAME_INFORMATION* ImageFileName;/* 0x0  8 */
};