#event_simpleName=ProcessRollup2 WindowFlags=*
| bitfield:extractFlags(
field=WindowFlags,
 output=[
   [0, STARTF_USESHOWWINDOW],
   [1, STARTF_USESIZE],
   [2, STARTF_USEPOSITION],
   [3, STARTF_USECOUNTCHARS],
   [4, STARTF_USEFILLATTRIBUTE],
   [5, STARTF_RUNFULLSCREEN],
   [6, STARTF_FORCEONFEEDBACK],
   [7, STARTF_FORCEOFFFEEDBACK],
   [8, STARTF_USESTDHANDLES],
   [9, STARTF_USEHOTKEY],
   [10, STARTF_TITLEISLINKNAME],
   [11, STARTF_TITLEISAPPID],
   [12, STARTF_PREVENTPINNING],
   [13, STARTF_UNTRUSTEDSOURCE],
   [14, STARTF_MONITOR],
   [15, STARTF_SCREENSAVER]
])