2112
. Note the ThreadId
is also shown in the output of Get-InjectedThread powershell script:~
command:StartAddress
which can be retrieved with ~.
command when in the context of the thread of interest.0x1494 = 5268
ID. That thread is then inspected for its StartAddress
, which happened to be 0x03730000 = 57868288
. Get-InjectedThreads
indicating ThreadId
and StartAddress
in decimal.MemoryType == MEM_IMAGE && MemoryState == MEM_COMMIT