PE-sieve
Scans all running processes. Recognizes and dumps a variety of potentially malicious implants (replaced/implanted PEs, shellcodes, hooks, in-memory patches).
|
Public Attributes | |
HANDLE | orig_hndl |
HANDLE | returned_hndl |
DWORD | returned_pid |
bool | is_ok |
Definition at line 171 of file process_reflection.cpp.
bool pesieve::util::t_refl_args::is_ok |
Definition at line 175 of file process_reflection.cpp.
HANDLE pesieve::util::t_refl_args::orig_hndl |
Definition at line 172 of file process_reflection.cpp.
HANDLE pesieve::util::t_refl_args::returned_hndl |
Definition at line 173 of file process_reflection.cpp.
DWORD pesieve::util::t_refl_args::returned_pid |
Definition at line 174 of file process_reflection.cpp.