HollowsHunter
Scans all running processes. Recognizes and dumps a variety of potentially malicious implants (replaced/implanted PEs, shellcodes, hooks, in-memory patches).
|
Functions | |
bool | is_wow_64 (HANDLE process) |
bool | is_wow_64_by_pid (DWORD processID) |
bool | get_process_path (DWORD processID, WCHAR *szProcessName, size_t processNameSize) |
size_t | suspend_suspicious (std::vector< DWORD > &suspicious_pids) |
size_t | kill_suspicious (std::vector< DWORD > &suspicious_pids) |
|
inline |
Definition at line 42 of file process_util.h.
|
inline |
Definition at line 10 of file process_util.h.
|
inline |
|
inline |
Definition at line 74 of file process_util.h.
|
inline |