>Hi!
>
>>
>>I would like to see this. For now I used enumproc.dll from Downloads section and modified code of the sample call.
>
>
>I'm wondered, because if you look to the help for EnumProcesses and EnumProcessModules API functions, you will see that these functions do not require callback. They return values in the array. So, why extra DLL?

Since I am API-challenged at the moment, :) I tried what worked for me.
:)

>In addition, EnumProcessModules function is quite interesting. It lists all modules for particular process. That is what I meant as a 'parent-child'. Parent is NTWDM process, childs are all other modules running under it. Try this, maybe it can help. There are also certain functions that can help you get process/thread ID of the medule and module for process.
>
>HTH.