HollowsHunter
Scans all running processes. Recognizes and dumps a variety of potentially malicious implants (replaced/implanted PEs, shellcodes, hooks, in-memory patches).
|
Go to the source code of this file.
Namespaces | |
namespace | process_util |
Functions | |
bool | process_util::is_wow_64 (HANDLE process) |
bool | process_util::is_wow_64_by_pid (DWORD processID) |
bool | process_util::get_process_path (DWORD processID, WCHAR *szProcessName, size_t processNameSize) |
size_t | process_util::suspend_suspicious (std::vector< DWORD > &suspicious_pids) |
size_t | process_util::kill_suspicious (std::vector< DWORD > &suspicious_pids) |