+- Hack Forums (https://hackforums.net)
+-- Forum: Hacks, Exploits, and Various Discussions (https://hackforums.net/forumdisplay.php?fid=45)
+--- Forum: Blackhat • Red Team • Offensive Security (https://hackforums.net/forumdisplay.php?fid=447)
+---- Forum: Cryptography, Encryption, and Decryption (https://hackforums.net/forumdisplay.php?fid=126)
+---- Thread: Process Hollowing X64/x86 [ Support Miners, Packed, Obfuscated Files ] (/showthread.php?tid=6329440)
Process Hollowing X64/x86 [ Support Miners, Packed, Obfuscated Files ] - KevenLionardo - Jul 30, 2026
Handles Packed EXEs – Many implementations choke on compressed/encrypted binaries. Mine unpacks them in memory before injection, so UPX, Themida, or custom packers don't break the flow.
Works Amazing With XMR Miners And Other Miners. 😋
Works x64/x86 .NET/Native
https://pastebin.com/raw/UzsYtiUu
RE: Process Hollowing X64/x86 [ Support Miners, Packed, Obfuscated Files ] - closedeyeknight - Aug 1, 2026
I tried Process Hollowing or RunPE etc kinda tech, all killed by av/edr. Does it still work?
RE: Process Hollowing X64/x86 [ Support Miners, Packed, Obfuscated Files ] - KevenLionardo - Aug 1, 2026
(Aug 1, 2026 03:41 PM)closedeyeknight Wrote: I tried Process Hollowing or RunPE etc kinda tech, all killed by av/edr. Does it still work?
with the Process Hollowing code i shared it's possible to bypass with a little changes and don't forget to pack your .exe file so modafoking AV's like ESET EDR can't see/scan memory page, returns clean but not "#" example.
you got the idea?
i'm smart ASF :D you can also before using that process hollowing you can code simple loader that loads in memory then pack then use process hollowing. this Bypasses AVAST/AVG Sandbox 15 seconds instantly returns clean
~ i love malware since 2013 and i love nanocore rat
RE: Process Hollowing X64/x86 [ Support Miners, Packed, Obfuscated Files ] - closedeyeknight - Aug 1, 2026
(Aug 1, 2026 05:48 PM)KevenLionardo Wrote: with the Process Hollowing code i shared it's possible to bypass with a little changes and don't forget to pack your .exe file so modafoking AV's like ESET EDR can't see/scan memory page, returns clean but not "#" example.
you got the idea?
i'm smart ASF :D you can also before using that process hollowing you can code simple loader that loads in memory then pack then use process hollowing. this Bypasses AVAST/AVG Sandbox 15 seconds instantly returns clean
~ i love malware since 2013 and i love nanocore rat
Wow! thank you for sharing this