HollowsHunter
Scans all running processes. Recognizes and dumps a variety of potentially malicious implants (replaced/implanted PEs, shellcodes, hooks, in-memory patches).
|
This is the complete list of members for HHScanner, including all inherited members.
hh_args | HHScanner | protected |
HHScanner(t_hh_params &_args, time_t _initTime=0) | HHScanner | |
initOutDir(time_t scan_time, pesieve::t_params &pesieve_args) | HHScanner | protected |
initTime | HHScanner | protected |
isScannerCompatibile() | HHScanner | static |
isScannerWow64 | HHScanner | protected |
outDir | HHScanner | protected |
printScanRoundStats(size_t found, size_t ignored_count, size_t not_matched_count) | HHScanner | protected |
printSingleReport(pesieve::t_report &report) | HHScanner | protected |
scan() | HHScanner | |
scanNextProcess(DWORD pid, WCHAR *image_buf, HHScanReport &report) | HHScanner | protected |
scanProcesses(HHScanReport &my_report) | HHScanner | protected |
shouldScanProcess(const hh_params &hh_args, const time_t hh_initTime, const DWORD pid, const WCHAR *exe_file) | HHScanner | static |
summarizeScan(HHScanReport *hh_report, const pesieve::t_results_filter rfilter) | HHScanner | |
writeToLog(HHScanReport *hh_report) | HHScanner |