← Learn Process Hollowing Author Moise Medici Updated 09 May 2026 · Completed Appendix 1 ↩ Microsoft: HeapAlloc function 2 ↩ Microsoft: ReadFile function 3 ↩ Microsoft: CreateProcess function 4 ↩ Microsoft: VirtualAllocEx function 5 ↩ skr1x Github: Portable Executable Format 6 ↩ Medium: Dissecting PE Headers 7 ↩ Microsoft: WriteProcessMemory function 8 ↩ Microsoft: VirtualProtectEx function 9 ↩ Microsoft: SetThreadContext function 10 ↩ Microsoft: NT Context 11 ↩ Microsoft: CONTEXT struct 12 ↩ Microsoft: GetThreadContext function Section 3 of 3: Appendix ← Code Analysis