_TOKEN

Metadatacopy
struct _TOKEN {
    struct _TOKEN_SOURCE TokenSource;/* 0x0  16 */
    struct _LUID TokenId;/* 0x10  8 */
    struct _LUID AuthenticationId;/* 0x18  8 */
    struct _LUID ParentTokenId;/* 0x20  8 */
    union _LARGE_INTEGER ExpirationTime;/* 0x28  8 */
    struct _ERESOURCE* TokenLock;/* 0x30  8 */
    struct _LUID ModifiedId;/* 0x38  8 */
    /* ── cacheline 1 boundary (64 bytes) ── */
    struct _SEP_TOKEN_PRIVILEGES Privileges;/* 0x40  24 */
    struct _SEP_AUDIT_POLICY AuditPolicy;/* 0x58  32 */
    unsigned long SessionId;/* 0x78  4 */
    unsigned long UserAndGroupCount;/* 0x7c  4 */
    /* ── cacheline 2 boundary (128 bytes) ── */
    unsigned long RestrictedSidCount;/* 0x80  4 */
    unsigned long VariableLength;/* 0x84  4 */
    unsigned long DynamicCharged;/* 0x88  4 */
    unsigned long DynamicAvailable;/* 0x8c  4 */
    unsigned long DefaultOwnerIndex;/* 0x90  4 */
    /* 4 bytes padding */
    struct _SID_AND_ATTRIBUTES* UserAndGroups;/* 0x98  8 */
    struct _SID_AND_ATTRIBUTES* RestrictedSids;/* 0xa0  8 */
    void* PrimaryGroup;/* 0xa8  8 */
    unsigned long* DynamicPart;/* 0xb0  8 */
    struct _ACL* DefaultDacl;/* 0xb8  8 */
    /* ── cacheline 3 boundary (192 bytes) ── */
    enum _TOKEN_TYPE TokenType;/* 0xc0  4 */
    enum _SECURITY_IMPERSONATION_LEVEL ImpersonationLevel;/* 0xc4  4 */
    unsigned long TokenFlags;/* 0xc8  4 */
    unsigned char TokenInUse;/* 0xcc  1 */
    /* 3 bytes padding */
    unsigned long IntegrityLevelIndex;/* 0xd0  4 */
    unsigned long MandatoryPolicy;/* 0xd4  4 */
    struct _SEP_LOGON_SESSION_REFERENCES* LogonSession;/* 0xd8  8 */
    struct _LUID OriginatingLogonSession;/* 0xe0  8 */
    struct _SID_AND_ATTRIBUTES_HASH SidHash;/* 0xe8  272 */
    /* ── cacheline 7 boundary (448 bytes) ── */
    struct _SID_AND_ATTRIBUTES_HASH RestrictedSidHash;/* 0x1f8  272 */
    /* ── cacheline 12 boundary (768 bytes) ── */
    struct _AUTHZBASEP_SECURITY_ATTRIBUTES_INFORMATION* pSecurityAttributes;/* 0x308  8 */
    void* Package;/* 0x310  8 */
    struct _SID_AND_ATTRIBUTES* Capabilities;/* 0x318  8 */
    unsigned long CapabilityCount;/* 0x320  4 */
    /* 4 bytes padding */
    struct _SID_AND_ATTRIBUTES_HASH CapabilitiesHash;/* 0x328  272 */
    /* ── cacheline 16 boundary (1024 bytes) ── */
    struct _SEP_LOWBOX_NUMBER_ENTRY* LowboxNumberEntry;/* 0x438  8 */
    /* ── cacheline 17 boundary (1088 bytes) ── */
    struct _SEP_CACHED_HANDLES_ENTRY* LowboxHandlesEntry;/* 0x440  8 */
    struct _AUTHZBASEP_CLAIM_ATTRIBUTES_COLLECTION* pClaimAttributes;/* 0x448  8 */
    void* TrustLevelSid;/* 0x450  8 */
    struct _TOKEN* TrustLinkedToken;/* 0x458  8 */
    void* IntegrityLevelSidValue;/* 0x460  8 */
    struct _SEP_SID_VALUES_BLOCK* TokenSidValues;/* 0x468  8 */
    struct _SEP_LUID_TO_INDEX_MAP_ENTRY* IndexEntry;/* 0x470  8 */
    struct _SEP_TOKEN_DIAG_TRACK_ENTRY* DiagnosticInfo;/* 0x478  8 */
    /* ── cacheline 18 boundary (1152 bytes) ── */
    struct _SEP_CACHED_HANDLES_ENTRY* BnoIsolationHandlesEntry;/* 0x480  8 */
    void* SessionObject;/* 0x488  8 */
    union {
        unsigned __int64 TokenFlags2;/* 0x490  8 */
        struct {
            unsigned long IsInstaller : 1;/* 0x490:0  4 */
            unsigned long IsAgentic : 1;/* 0x490:1  4 */
        };/* 0x490  4 */
    };/* 0x490  8 */
    struct _SID_AND_ATTRIBUTES* AntiTamperSids;/* 0x498  8 */
    unsigned long AntiTamperSidCount;/* 0x4a0  4 */
    /* 4 bytes padding */
    struct _SID_AND_ATTRIBUTES_HASH AntiTamperSidHash;/* 0x4a8  272 */
    /* ── cacheline 22 boundary (1408 bytes) ── */
    struct _SEP_ANTITAMPER_ENTRY* AntiTamperEntry;/* 0x5b8  8 */
    /* ── cacheline 23 boundary (1472 bytes) ── */
    struct _TOKEN* FallbackToken;/* 0x5c0  8 */
    struct _AUTHZBASEP_SECURITY_ATTRIBUTES_INFORMATION EmbeddedSecurityAttributes;/* 0x5c8  48 */
    unsigned __int64 VariablePart;/* 0x5f8  8 */
};