HollowsHunter
Scans all running processes. Recognizes and dumps a variety of potentially malicious implants (replaced/implanted PEs, shellcodes, hooks, in-memory patches).
|
#include <hh_params.h>
Public Member Functions | |
void | init () |
hh_params & | operator= (const hh_params &other) |
Public Attributes | |
std::string | out_dir |
bool | unique_dir |
bool | loop_scanning |
bool | etw_scan |
bool | suspend_suspicious |
bool | kill_suspicious |
bool | quiet |
bool | log |
bool | json_output |
LONGLONG | ptimes |
t_cache_mode | cache_mode |
std::set< std::wstring > | names_list |
std::set< long > | pids_list |
std::set< std::wstring > | ignored_names_list |
pesieve::t_params | pesieve_args |
Definition at line 19 of file hh_params.h.
void hh_params::init | ( | ) |
Definition at line 3 of file hh_params.cpp.
Definition at line 27 of file hh_params.cpp.
t_cache_mode hh_params::cache_mode |
Definition at line 32 of file hh_params.h.
bool hh_params::etw_scan |
Definition at line 25 of file hh_params.h.
std::set<std::wstring> hh_params::ignored_names_list |
Definition at line 35 of file hh_params.h.
bool hh_params::json_output |
Definition at line 30 of file hh_params.h.
bool hh_params::kill_suspicious |
Definition at line 27 of file hh_params.h.
bool hh_params::log |
Definition at line 29 of file hh_params.h.
bool hh_params::loop_scanning |
Definition at line 24 of file hh_params.h.
std::set<std::wstring> hh_params::names_list |
Definition at line 33 of file hh_params.h.
std::string hh_params::out_dir |
Definition at line 22 of file hh_params.h.
pesieve::t_params hh_params::pesieve_args |
Definition at line 36 of file hh_params.h.
std::set<long> hh_params::pids_list |
Definition at line 34 of file hh_params.h.
LONGLONG hh_params::ptimes |
Definition at line 31 of file hh_params.h.
bool hh_params::quiet |
Definition at line 28 of file hh_params.h.
bool hh_params::suspend_suspicious |
Definition at line 26 of file hh_params.h.
bool hh_params::unique_dir |
Definition at line 23 of file hh_params.h.