_SE_AUDIT_PROCESS_CREATION_INFO

Metadatacopy
struct _SE_AUDIT_PROCESS_CREATION_INFO {
    struct _OBJECT_NAME_INFORMATION* ImageFileName;/* 0x0  4 */
};