In this case, isn't CreateToolhelp32Snapshot(TH32CS_SNAPPROCESS) better? I mean, NtQuerySystemInformation works, but it is undocumented internal Windows function and if there is a documented way to do the same shouldn't that be preferred in a program?