{"adoption": {"forks": 296, "observed_at": "2026-08-28T04:06:43.794997+00:00", "stars": 2401}, "canonical_url": "https://ross.abutalabs.com/products/hollows_hunter", "card": {"archived": false, "artifact_type": "cli-tool", "description": "Scans all running processes. Recognizes and dumps a variety of potentially malicious implants (replaced/implanted PEs, shellcodes, hooks, in-memory patches).", "domain": ["security", "windows", "developer-tools"], "enriched": true, "function": ["security", "vulnerability-scanning", "reverse-engineering", "cli"], "health_score": 87, "homepage": "https://github.com/hasherezade/hollows_hunter/wiki", "language": "C", "license": "BSD-2-Clause", "license_family": "permissive", "maturity": "active", "member_repos": ["hasherezade/hollows_hunter"], "name": "hasherezade/hollows_hunter", "platform": ["windows", "cli"], "pushed_at": "2026-06-06T12:47:20+00:00", "repo": "hasherezade/hollows_hunter", "stars": 2401, "tags": ["memory-forensics", "process-scanning", "pe-sieve", "anti-malware", "shellcode-detection", "process-hollowing", "etw", "incident-response", "malware-analysis"], "topics": ["pe-sieve", "anti-malware", "malware-analysis", "malware-detection", "memory-forensics"], "urls": [], "use_cases": ["scan all running processes for malicious in-memory implants", "detect process hollowing and injected shellcode on Windows", "dump suspicious PE modules from live processes for malware analysis", "continuously monitor a system for memory-based malware", "triage an infected machine during incident response", "filter process scans by PID, name, or creation time"], "what_it_is": "Hollows Hunter is a Windows command-line tool built on the PE-sieve passive memory scanner that scans running processes for malicious implants such as replaced or implanted PEs, shellcodes, hooks, and in-memory patches, and dumps them for analysis. It supports filtering targets by PID, name, or creation time, continuous scanning via a loop mode, and ETW-based listening.", "when_to_avoid": ["you are on Linux or macOS - it is Windows-only", "you need real-time endpoint protection rather than on-demand scanning", "you want a GUI-based forensic suite", "you need to scan memory dumps offline rather than live processes"], "when_to_choose": ["you need to inspect live Windows process memory for injected code or patched modules", "you want to scan many processes at once rather than a single PID like PE-sieve", "you need to extract implants to disk for offline reverse engineering", "you want a lightweight, scriptable CLI for malware triage"]}, "data_as_of": "2026-08-30T08:39:29.467469+00:00", "members": [{"path": "/products/hollows_hunter", "repo": "hasherezade/hollows_hunter", "role": "main", "score": 71}], "provenance": {"archived": {"kind": "observed", "observed_at": "2026-08-28T04:06:43.794997+00:00", "source": "github"}, "artifact_type": {"confidence": null, "enriched_at": "2026-08-30T02:34:15.083963+00:00", "kind": "inferred", "prompt_version": 1, "sources": [{"content_hash": "d8638cc644654bcd82b16be3075737b10c72c06bc4a57201fe9ef5d59b579b2f", "fetched_at": "2026-08-28T04:06:43.794997+00:00", "kind": "readme", "missing": false, "url": "https://github.com/hasherezade/hollows_hunter"}, {"content_hash": "aca0faa08fb6fc5fe905ad0c7f3ddc1ce39af390e4f7cb274d9f35e1ad3e7c3a", "fetched_at": "2026-08-29T10:14:38.492564+00:00", "kind": "homepage", "missing": false, "url": "https://github.com/hasherezade/hollows_hunter/wiki"}], "taxonomy_version": 1}, "description": {"kind": "observed", "observed_at": "2026-08-28T04:06:43.794997+00:00", "source": "github"}, "domain": {"confidence": null, "enriched_at": "2026-08-30T02:34:15.083963+00:00", "kind": "inferred", "prompt_version": 1, "sources": [{"content_hash": "d8638cc644654bcd82b16be3075737b10c72c06bc4a57201fe9ef5d59b579b2f", "fetched_at": "2026-08-28T04:06:43.794997+00:00", "kind": "readme", "missing": false, "url": "https://github.com/hasherezade/hollows_hunter"}, {"content_hash": "aca0faa08fb6fc5fe905ad0c7f3ddc1ce39af390e4f7cb274d9f35e1ad3e7c3a", "fetched_at": "2026-08-29T10:14:38.492564+00:00", "kind": "homepage", "missing": false, "url": "https://github.com/hasherezade/hollows_hunter/wiki"}], "taxonomy_version": 1}, "enriched": {"inputs": [], "kind": "computed", "method": "enrichment_status"}, "function": {"confidence": null, "enriched_at": "2026-08-30T02:34:15.083963+00:00", "kind": "inferred", "prompt_version": 1, "sources": [{"content_hash": "d8638cc644654bcd82b16be3075737b10c72c06bc4a57201fe9ef5d59b579b2f", "fetched_at": "2026-08-28T04:06:43.794997+00:00", "kind": "readme", "missing": false, "url": "https://github.com/hasherezade/hollows_hunter"}, {"content_hash": "aca0faa08fb6fc5fe905ad0c7f3ddc1ce39af390e4f7cb274d9f35e1ad3e7c3a", "fetched_at": "2026-08-29T10:14:38.492564+00:00", "kind": "homepage", "missing": false, "url": "https://github.com/hasherezade/hollows_hunter/wiki"}], "taxonomy_version": 1}, "health_score": {"inputs": ["days_since_push", "days_since_release", "archived"], "kind": "computed", "method": "health_v1"}, "homepage": {"kind": "observed", "observed_at": "2026-08-28T04:06:43.794997+00:00", "source": "github"}, "language": {"kind": "observed", "observed_at": "2026-08-28T04:06:43.794997+00:00", "source": "github"}, "license": {"kind": "observed", "observed_at": "2026-08-28T04:06:43.794997+00:00", "source": "github"}, "license_family": {"inputs": ["license"], "kind": "computed", "method": "license_family"}, "maturity": {"confidence": null, "enriched_at": "2026-08-30T02:34:15.083963+00:00", "kind": "inferred", "prompt_version": 1, "sources": [{"content_hash": "d8638cc644654bcd82b16be3075737b10c72c06bc4a57201fe9ef5d59b579b2f", "fetched_at": "2026-08-28T04:06:43.794997+00:00", "kind": "readme", "missing": false, "url": "https://github.com/hasherezade/hollows_hunter"}, {"content_hash": "aca0faa08fb6fc5fe905ad0c7f3ddc1ce39af390e4f7cb274d9f35e1ad3e7c3a", "fetched_at": "2026-08-29T10:14:38.492564+00:00", "kind": "homepage", "missing": false, "url": "https://github.com/hasherezade/hollows_hunter/wiki"}], "taxonomy_version": 1}, "member_repos": {"kind": "observed", "observed_at": "2026-08-28T04:06:43.794997+00:00", "source": "github"}, "name": {"kind": "observed", "observed_at": "2026-08-28T04:06:43.794997+00:00", "source": "github"}, "platform": {"confidence": null, "enriched_at": "2026-08-30T02:34:15.083963+00:00", "kind": "inferred", "prompt_version": 1, "sources": [{"content_hash": "d8638cc644654bcd82b16be3075737b10c72c06bc4a57201fe9ef5d59b579b2f", "fetched_at": "2026-08-28T04:06:43.794997+00:00", "kind": "readme", "missing": false, "url": "https://github.com/hasherezade/hollows_hunter"}, {"content_hash": "aca0faa08fb6fc5fe905ad0c7f3ddc1ce39af390e4f7cb274d9f35e1ad3e7c3a", "fetched_at": "2026-08-29T10:14:38.492564+00:00", "kind": "homepage", "missing": false, "url": "https://github.com/hasherezade/hollows_hunter/wiki"}], "taxonomy_version": 1}, "pushed_at": {"kind": "observed", "observed_at": "2026-08-28T04:06:43.794997+00:00", "source": "github"}, "repo": {"kind": "observed", "observed_at": "2026-08-28T04:06:43.794997+00:00", "source": "github"}, "stars": {"kind": "observed", "observed_at": "2026-08-28T04:06:43.794997+00:00", "source": "github"}, "tags": {"confidence": null, "enriched_at": "2026-08-30T02:34:15.083963+00:00", "kind": "inferred", "prompt_version": 1, "sources": [{"content_hash": "d8638cc644654bcd82b16be3075737b10c72c06bc4a57201fe9ef5d59b579b2f", "fetched_at": "2026-08-28T04:06:43.794997+00:00", "kind": "readme", "missing": false, "url": "https://github.com/hasherezade/hollows_hunter"}, {"content_hash": "aca0faa08fb6fc5fe905ad0c7f3ddc1ce39af390e4f7cb274d9f35e1ad3e7c3a", "fetched_at": "2026-08-29T10:14:38.492564+00:00", "kind": "homepage", "missing": false, "url": "https://github.com/hasherezade/hollows_hunter/wiki"}], "taxonomy_version": 1}, "topics": {"kind": "observed", "observed_at": "2026-08-28T04:06:43.794997+00:00", "source": "github"}, "urls": {"kind": "observed", "observed_at": "2026-08-28T04:06:43.794997+00:00", "source": "github"}, "use_cases": {"confidence": null, "enriched_at": "2026-08-30T02:34:15.083963+00:00", "kind": "inferred", "prompt_version": 1, "sources": [{"content_hash": "d8638cc644654bcd82b16be3075737b10c72c06bc4a57201fe9ef5d59b579b2f", "fetched_at": "2026-08-28T04:06:43.794997+00:00", "kind": "readme", "missing": false, "url": "https://github.com/hasherezade/hollows_hunter"}, {"content_hash": "aca0faa08fb6fc5fe905ad0c7f3ddc1ce39af390e4f7cb274d9f35e1ad3e7c3a", "fetched_at": "2026-08-29T10:14:38.492564+00:00", "kind": "homepage", "missing": false, "url": "https://github.com/hasherezade/hollows_hunter/wiki"}], "taxonomy_version": 1}, "what_it_is": {"confidence": null, "enriched_at": "2026-08-30T02:34:15.083963+00:00", "kind": "inferred", "prompt_version": 1, "sources": [{"content_hash": "d8638cc644654bcd82b16be3075737b10c72c06bc4a57201fe9ef5d59b579b2f", "fetched_at": "2026-08-28T04:06:43.794997+00:00", "kind": "readme", "missing": false, "url": "https://github.com/hasherezade/hollows_hunter"}, {"content_hash": "aca0faa08fb6fc5fe905ad0c7f3ddc1ce39af390e4f7cb274d9f35e1ad3e7c3a", "fetched_at": "2026-08-29T10:14:38.492564+00:00", "kind": "homepage", "missing": false, "url": "https://github.com/hasherezade/hollows_hunter/wiki"}], "taxonomy_version": 1}, "when_to_avoid": {"confidence": null, "enriched_at": "2026-08-30T02:34:15.083963+00:00", "kind": "inferred", "prompt_version": 1, "sources": [{"content_hash": "d8638cc644654bcd82b16be3075737b10c72c06bc4a57201fe9ef5d59b579b2f", "fetched_at": "2026-08-28T04:06:43.794997+00:00", "kind": "readme", "missing": false, "url": "https://github.com/hasherezade/hollows_hunter"}, {"content_hash": "aca0faa08fb6fc5fe905ad0c7f3ddc1ce39af390e4f7cb274d9f35e1ad3e7c3a", "fetched_at": "2026-08-29T10:14:38.492564+00:00", "kind": "homepage", "missing": false, "url": "https://github.com/hasherezade/hollows_hunter/wiki"}], "taxonomy_version": 1}, "when_to_choose": {"confidence": null, "enriched_at": "2026-08-30T02:34:15.083963+00:00", "kind": "inferred", "prompt_version": 1, "sources": [{"content_hash": "d8638cc644654bcd82b16be3075737b10c72c06bc4a57201fe9ef5d59b579b2f", "fetched_at": "2026-08-28T04:06:43.794997+00:00", "kind": "readme", "missing": false, "url": "https://github.com/hasherezade/hollows_hunter"}, {"content_hash": "aca0faa08fb6fc5fe905ad0c7f3ddc1ce39af390e4f7cb274d9f35e1ad3e7c3a", "fetched_at": "2026-08-29T10:14:38.492564+00:00", "kind": "homepage", "missing": false, "url": "https://github.com/hasherezade/hollows_hunter/wiki"}], "taxonomy_version": 1}}, "score": {"components": {"activity": 86, "longevity": 100, "rhythm": 35}, "computed_at": "2026-09-03T02:20:16.233290+00:00", "flags": [], "formula": "round(0.45*activity + 0.35*rhythm + 0.20*longevity); archived -> min(score, 10)", "inputs": {"age_days": 3156, "days_push": 88, "days_rel": 354, "gap_med": 49, "n_releases_24m": 4}, "score": 71, "version": 2}, "staleness": {"enrichment_outdated": false, "low_confidence": false, "scrape_days": 9, "stale_scrape": false}}