{"id":14637685,"url":"https://github.com/NuclearPhoenixx/fake-sandbox","last_synced_at":"2025-09-07T05:32:48.115Z","repository":{"id":50286985,"uuid":"67315431","full_name":"NuclearPhoenixx/fake-sandbox","owner":"NuclearPhoenixx","description":"👁‍🗨 This script will simulate fake processes of analysis sandbox/VM software that some malware will try to avoid.","archived":false,"fork":false,"pushed_at":"2025-06-21T14:44:03.000Z","size":204,"stargazers_count":140,"open_issues_count":0,"forks_count":20,"subscribers_count":7,"default_branch":"master","last_synced_at":"2025-06-21T15:34:05.753Z","etag":null,"topics":["antivirus","fake","malware","powershell","process","sandbox","spyware","tool","windows","windows-10"],"latest_commit_sha":null,"homepage":"","language":"Batchfile","has_issues":true,"has_wiki":null,"has_pages":null,"mirror_url":null,"source_name":null,"license":"gpl-3.0","status":null,"scm":"git","pull_requests_enabled":true,"icon_url":"https://github.com/NuclearPhoenixx.png","metadata":{"files":{"readme":"README.md","changelog":null,"contributing":null,"funding":null,"license":"LICENSE","code_of_conduct":null,"threat_model":null,"audit":null,"citation":null,"codeowners":null,"security":null,"support":null,"governance":null,"roadmap":null,"authors":null,"dei":null,"publiccode":null,"codemeta":null}},"created_at":"2016-09-03T23:01:00.000Z","updated_at":"2025-06-21T14:44:07.000Z","dependencies_parsed_at":"2024-07-30T13:25:34.916Z","dependency_job_id":null,"html_url":"https://github.com/NuclearPhoenixx/fake-sandbox","commit_stats":null,"previous_names":["nuclearphoenixx/fake-sandbox","phoenix1747/fake-sandbox"],"tags_count":20,"template":false,"template_full_name":null,"purl":"pkg:github/NuclearPhoenixx/fake-sandbox","repository_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/NuclearPhoenixx%2Ffake-sandbox","tags_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/NuclearPhoenixx%2Ffake-sandbox/tags","releases_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/NuclearPhoenixx%2Ffake-sandbox/releases","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/NuclearPhoenixx%2Ffake-sandbox/manifests","owner_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners/NuclearPhoenixx","download_url":"https://codeload.github.com/NuclearPhoenixx/fake-sandbox/tar.gz/refs/heads/master","sbom_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/NuclearPhoenixx%2Ffake-sandbox/sbom","scorecard":null,"host":{"name":"GitHub","url":"https://github.com","kind":"github","repositories_count":273997181,"owners_count":25204494,"icon_url":"https://github.com/github.png","version":null,"created_at":"2022-05-30T11:31:42.601Z","updated_at":"2022-07-04T15:15:14.044Z","status":"online","status_checked_at":"2025-09-07T02:00:09.463Z","response_time":67,"last_error":null,"robots_txt_status":"success","robots_txt_updated_at":"2025-07-24T06:49:26.215Z","robots_txt_url":"https://github.com/robots.txt","online":true,"can_crawl_api":true,"host_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub","repositories_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories","repository_names_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repository_names","owners_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners"}},"keywords":["antivirus","fake","malware","powershell","process","sandbox","spyware","tool","windows","windows-10"],"created_at":"2024-09-10T02:01:08.971Z","updated_at":"2025-09-07T05:32:48.081Z","avatar_url":"https://github.com/NuclearPhoenixx.png","language":"Batchfile","funding_links":["https://ko-fi.com/J3J61GLR3G"],"categories":["Batchfile"],"sub_categories":[],"readme":"# Fake Sandbox Processes (FSP)\n![latest version](https://img.shields.io/github/release/NuclearPhoenixx/fake-sandbox.svg?style=for-the-badge) ![issues](https://img.shields.io/github/issues/NuclearPhoenixx/fake-sandbox.svg?style=for-the-badge) ![open pr](https://img.shields.io/github/issues-pr-raw/NuclearPhoenixx/fake-sandbox.svg?style=for-the-badge)\n\nThis small script will simulate fake processes of analysis, sandbox and VM software that some malware will try to avoid.\nYou can download the original script made by @x0rz [here](https://gist.github.com/x0rz/e8b36fee33b87aa7e4e5dfd4c0cfc1a6) (thanks, by the way).\n\nYou can also download my slightly optimized script from the root directory. The file is named ```fsp.ps1```. This exact script is also used in the FSP installer.\n\n[![ko-fi](https://ko-fi.com/img/githubbutton_sm.svg)](https://ko-fi.com/J3J61GLR3G)\n\n---\n\n### Script-Features\n\n* Some (more advanced) spyware might stop executing correctly as long as the created processes run.\n* Requirements: Powershell (preinstalled on Win 7 and newer), that's all.\n* No system load at all (almost).\n\n### Installer-Features\n\n* Automatically install the script to your autostart directory, so that you don't have to execute it at every re-login.\n* Requirements: Only Powershell.\n* With uninstaller to purge all files.\n* Everything packed into one tiny offline package.\n* Optional auto-updater included, you can choose if you want it or not.\n\n---\n\n### Usage:\n\nRight-click the file and choose \"Run with Powershell\"\n\n~ OR ~\n\nOpen the command line and paste this command (don't forget to adjust the path):\n\n```Powershell -executionpolicy remotesigned -F 'Your\\Path\\fsp.ps1'```\n\nAfter pressing enter you can choose to either start or stop all processes.\n\n### Autostart\n\nIf you're just using the script and start it manually, you will have to re-run it at every re-login or startup to create the processes again.\nIn order to bypass this problem and autostart the script I made an easy-to-use installer.\n\n1. Download the ```fsp-installer.bat``` file from the release section or from the folder ```installer```.\n2. Double-click it (do _not_ start as administrator).\n3. Now you will see this command prompt window:\n\n![install1](screenshots/install.png)\n\n4. Choose \"i\" to start the installation.\n5. Now enter \"y\" to start installing or \"n\" to abort.\n6. If you entered \"y\" this image will now pop up:\n\n![install2](screenshots/install2.png)\n\n7. Enter \"y\" to install the auto-updater or \"n\" to not install it (it'll work anyways, but the updater is recommended).\n\n---\u003e You can now close the window or press any key to close it. The installation is complete.\n\n#### Uninstall\n\nIf you no longer want this program on your computer, you'll need the ```fsp-installer.bat``` file again.\nRun it and chose \"u\" to start the removal process. Then enter \"y\" if you are ready to purge all created files.\n\n![uninstall](screenshots/uninstall.png)\n\nIf the process was successful, you'll see a confirmation screen - done. No files will remain on your system. You need to delete the installer, though.\n\n---\n\nSuccessfully tested on the following Windows versions:\n\n* Win 10 Professional\n* Win 8.1 Home\n* Win 7 Professional\n","project_url":"https://awesome.ecosyste.ms/api/v1/projects/github.com%2FNuclearPhoenixx%2Ffake-sandbox","html_url":"https://awesome.ecosyste.ms/projects/github.com%2FNuclearPhoenixx%2Ffake-sandbox","lists_url":"https://awesome.ecosyste.ms/api/v1/projects/github.com%2FNuclearPhoenixx%2Ffake-sandbox/lists"}