perfmon says that 'Kernel Current URIs Cached = 2 (average) and that 'Output Cache Current Items' = 3000-4000 (average) I think that this means that almost all of the objects are in the User Mode ...

To capture hypervisor pages or user-mode memory pages in a live kernel memory dump, you may use live kernel memory dump file options available under the Task Manager settings.

Also called "supervisor mode," the kernel mode enables the OS (kernel) to execute "privileged instructions," which access the hardware directly. Applications run in the more restricted user mode.

"When cheat programs operate in kernel space, they can make their cheat functionally invisible to anti-cheat solutions that live in user-mode.

The new Call of Duty: Warzone anti-cheat system, called Ricochet, will include a kernel-mode driver that gives Activision the ability to access any bit of memory on your PC. Reddit user t_hugs3 ...

Following the massive Windows outage in July caused by a defective CrowdStrike update, Microsoft is working on a way to allow security products to ‘run in user mode just as apps do,’ Microsoft ...