regsvr32 Squiblydoo and COM scriptlet abuse detector — free browser tool | fatcousin | fatcousin

tools→browse every utility in one place.manifesto→why fatcousin exists — local-first, no uploads.

ready

local

// fatcousin · local process monitor

00:00:00

// session started —

// tool · regsvr32-squiblydoo-artifact-detector

// origin · —

// user agent · —

// verdict · files processed locally · verify by watching NET events below

▮

NET · no outbound requests · all processing local

this panel shows everything. if something looks wrong, it is wrong. that's the contract.

drop 4688 or sysmon evtx csv · squiblydoo · remote com scriptlets · applocker bypass · child chains · export csv · runs locally

[input]

drop evtx csv

or click

Select file

security 4688 · sysmon event 1 · optional mft csv for local scriptlet status

drop 4688 or sysmon evtx csv · optional mft csv