Cyber seCurity fundAmentAls 61
turn calls PspUserreadStartup, which begins by setting the locale
ID and processor type in the thread execution block (TEB) specific
to the executable’s header.
If the process has a user mode or kernel mode debugger attached,
the kernel informs the appropriate debugger of the creation of the new
process. If the debugger requests that the kernel kill the thread, the
operating system immediately terminates the thread. If the admin-
istrator has enabled prefetching on the system, the prefetcher
44
acti-
vates. e prefetcher allows the operating system to load a binary
faster by using a single data block to reference information from the
last time the same binary ran. Coordinating the necessary informa-
tion into a ...