VQL Reference Accessors winpmem winpmem Accessor Required permissions: MACHINE_STATE Description Access physical memory like a file. Any filename will result in a sparse view of physical memory.