The original malware performs the behavior.
Proofmetry does not replace a supported sample with a generic behavior simulator. It reconstructs the interaction needed for the original implementation to run in a controlled customer lab.
About Proofmetry
Native behavior, recovered with evidence.
Proofmetry is a malware research and validation project focused on recovering native behavior hidden behind unavailable C2 tasking. Platform access is coordinated directly through a guided evaluation process.
The focus
Close the gap between a mapped capability and an observable effect.
Malware research can reveal what a sample appears able to do. Proofmetry continues the work: recover the expected tasking or configuration, reach selected native paths, and state exactly what the resulting evidence supports.
Claims stop where the evidence stops.
Static mapping, path reach, returned results, terminal states, and confirmed effects are kept distinct so research findings do not become broader product claims.
Areas of work
Research disciplines behind the platform.
Malware reverse engineering
Variant-level analysis of dispatchers, state, behavior paths, and observable effects.
Native Windows behavior analysis
Process, file, memory, system, desktop, and lifecycle behavior at the endpoint.
C2 protocol and command reconstruction
Controlled recovery of the tasking or configuration a supported sample expects.
Detection and telemetry research
Connecting native activity to records produced by customer-operated endpoint and network sensors.
Evidence-oriented validation
Documenting mapped, reached, observed, terminal, and confirmed evidence without collapsing the distinctions.
Guided evaluation