hollows_hunter — authorized multi-process PE sweep
hollows_hunter (hasherezade/hollows_hunter) sweeps many Windows processes for suspicious PE images and can dump them for offline review. Release v0.4.1.1 (2025-09-13 UTC) was the latest non-prerelease on 2026-10-24 and ships with pe-sieve v0.4.1.1. License is BSD-2-Clause. Use it only on hosts and processes you may examine.
Snapshot
| Field | Value |
|---|---|
| License | BSD-2-Clause |
| Latest checked | v0.4.1.1 (2025-09-13 UTC) |
| Job | Multi-process PE implant / hollowing detection + dump |
| Stars (order of magnitude) | ~2.4k on GitHub (counts change daily) |
| Engine peer | pe-sieve for single-PID work |
Allowed framing
- Incident-response hosts under ticketed authorization.
- Malware lab VMs you administer.
- Teaching detection concepts with your test implants in a sandbox.
Scope we will not cover
- No injector / hollowing / process-doppelgänging cookbooks.
- No “bypass EDR with hollows_hunter tips” framing.
- No remote scanning of systems without authorization.
Beginner path (authorized only)
- Work inside an isolated Windows lab VM with snapshots.
- Install from official hasherezade/hollows_hunter Releases (32/64-bit builds).
- Prefer a narrow scope when policy allows; save dumps next to case hashes.
- Triage dumps with PE-bear and Detect It Easy.
- For memory-first IR, also see Volatility 3.
- Use hollows_hunter for authorized multi-process PE anomaly sweeps.
- Prefer pe-sieve when you already have a PID.
- Never treat detection success as permission to scan arbitrary machines.
For legal, authorized and educational use only.
FAQ
What is hollows_hunter?
hollows_hunter is a Windows tool that walks many processes and runs pe-sieve-style checks for suspicious PE modules (for example hollowed or reflectively loaded images), then can dump findings for offline review.
Which version is cited?
v0.4.1.1 published 2025-09-13 UTC on hasherezade/hollows_hunter Releases; the release notes state it uses pe-sieve v0.4.1.1 (latest non-prerelease checked 2026-10-24).
Is hollows_hunter open source?
Yes. Upstream LICENSE is BSD 2-Clause; GitHub/shields report BSD-2-Clause (checked 2026-10-24).
How does it relate to pe-sieve?
pe-sieve focuses on scanning a selected process; hollows_hunter orchestrates sweeps across many processes using the same family of checks. Start with pe-sieve when you already know the PID.
Does this teach writing process hollowers?
No. Detection and dumping of authorized lab/IR targets only — BinBench will not help author injectors.