Vmm.dll - [portable]

: It is widely used in digital forensics and incident response to detect malicious processes masquerading as legitimate ones or to identify corrupted forensic timelines.

// Callback function type for reporting found artifacts typedef void (*VMM_ARTIFACT_CALLBACK)(uint64_t process_id, const char* process_name, uint64_t base_address, size_t size); vmm.dll