# Technical Documentation: hasherezade/hollows_hunter > โ„น๏ธ **Provenance:** Hybrid Fusion: `hasherezade/hollows_hunter` (README + 1 In-Tree Chapters) ยท [CodeWiki Reference](https://codewiki.google/github.com/hasherezade/hollows_hunter) ยท Recency: Active (< 180 days) ## 1. Project Overview & Quickstart (hasherezade/hollows_hunter) # hollows_hunter [](https://ci.appveyor.com/project/hasherezade/hollows-hunter) [](https://app.codacy.com/gh/hasherezade/hollows_hunter/dashboard?branch=master) [](https://github.com/hasherezade/hollows_hunter/commits) [](https://github.com/hasherezade/hollows_hunter/commits) [](https://github.com/hasherezade/hollows_hunter/releases) [](https://github.com/hasherezade/hollows_hunter/releases) [](https://github.com/hasherezade/hollows_hunter/releases) [](https://github.com/hasherezade/hollows_hunter/releases) [](https://github.com/hasherezade/hollows_hunter/blob/master/LICENSE) [](https://github.com/hasherezade/hollows_hunter) Hollows Hunter is a command-line application based on [PE-sieve](https://github.com/hasherezade/pe-sieve.git) passive memory scanner. Recognizes and dumps a variety of potentially malicious implants (replaced/implanted PEs, shellcodes, hooks, in-memory patches). While in case of PE-sieve you can select the process only by its PID, Hollows Hunter allows to select them by various criteria, such as: + list of PIDs + list of names + the time of creation (relatively to the Hollows Hunter execution time) If no specific target is selected, it proceeds to scan all available processes. Hollows Hunter allows also for continuous memory scanning, via `/loop` argument, or by being run as an ETW listener: in `/etw` mode (64-bit version only). > [!IMPORTANT] > The available arguments are documented on [Wiki](https://github.com/hasherezade/hollows_hunter/wiki). They can also be listed using the argument `/help`. ๐Ÿ“ฆ Uses: [PE-sieve](https://github.com/hasherezade/pe-sieve.git) (the [library version](https://github.com/hasherezade/pe-sieve/wiki/2.-How-to-build)). โ“ [PE-sieve FAQ - Frequently Asked Questions](https://github.com/hasherezade/pe-sieve/wiki/1.-FAQ) ๐Ÿ“– [Read Wiki](https://github.com/hasherezade/hollows_hunter/wiki) ## Clone Use recursive clone to get the repo together with all the submodules: ```console git clone --recursive https://github.com/hasherezade/hollows_hunter.git ``` ## Builds Download the latest [release](https://github.com/hasherezade/hollows_hunter/releases), or [read more](https://github.com/hasherezade/hollows_hunter/wiki#download). Available also via [Chocolatey](https://community.chocolatey.org/packages/hollowshunter) ## 2. In-Tree Documentation Chapters (hasherezade/hollows_hunter) # hollows_hunter [](https://ci.appveyor.com/project/hasherezade/hollows-hunter) [](https://app.codacy.com/gh/hasherezade/hollows_hunter/dashboard?branch=master) [](https://github.com/hasherezade/hollows_hunter/commits) [](https://github.com/hasherezade/hollows_hunter/commits) [](https://github.com/hasherezade/hollows_hunter/releases) [](https://github.com/hasherezade/hollows_hunter/releases) [](https://github.com/hasherezade/hollows_hunter/releases) [](https://github.com/hasherezade/hollows_hunter/releases) [](https://github.com/hasherezade/hollows_hunter/blob/master/LICENSE) [](https://github.com/hasherezade/hollows_hunter) Hollows Hunter is a command-line application based on [PE-sieve](https://github.com/hasherezade/pe-sieve.git) passive memory scanner. Recognizes and dumps a variety of potentially malicious implants (replaced/implanted PEs, shellcodes, hooks, in-memory patches). While in case of PE-sieve you can select the process only by its PID, Hollows Hunter allows to select them by various criteria, such as: + list of PIDs + list of names + the time of creation (relatively to the Hollows Hunter execution time) If no specific target is selected, it proceeds to scan all available processes. Hollows Hunter allows also for continuous memory scanning, via `/loop` argument, or by being run as an ETW listener: in `/etw` mode (64-bit version only). > [!IMPORTANT] > The available arguments are documented on [Wiki](https://github.com/hasherezade/hollows_hunter/wiki). They can also be listed using the argument `/help`. ๐Ÿ“ฆ Uses: [PE-sieve](https://github.com/hasherezade/pe-sieve.git) (the [library version](https://github.com/hasherezade/pe-sieve/wiki/2.-How-to-build)). โ“ [PE-sieve FAQ - Frequently Asked Questions](https://github.com/hasherezade/pe-sieve/wiki/1.-FAQ) ๐Ÿ“– [Read Wiki](https://github.com/hasherezade/hollows_hunter/wiki) ## Clone Use recursive clone to get the repo together with all the submodules: ```console git clone --recursive https://github.com/hasherezade/hollows_hunter.git ``` ## Builds Download the latest [release](https://github.com/hasherezade/hollows_hunter/releases), or [read more](https://github.com/hasherezade/hollows_hunter/wiki#download). Available also via [Chocolatey](https://community.chocolatey.org/packages/hollowshunter) --- METRICS --- - Files Extracted: 2 - Estimated Token Budget: ~1189 tokens - Recency Window: Active (< 180 days) - Canonical Reference: https://codewiki.google/github.com/hasherezade/hollows_hunter