2112. Note the
ThreadIdis also shown in the output of Get-InjectedThread powershell script:
StartAddresswhich can be retrieved with
~.command when in the context of the thread of interest.
0x1494 = 5268ID. That thread is then inspected for its
StartAddress, which happened to be
0x03730000 = 57868288.
MemoryType == MEM_IMAGE && MemoryState == MEM_COMMIT