• File: MatrixFreeMicromouse_Portable.exe
• Size: 441,856 bytes
• SHA-256: c71201d814f83a81eaf46f74d631731df7a0e977b6d9edc39b3e19629a6e30ec
• Format: PE32+ Windows x64 GUI, seven non-overlapping sections
• Linker: Zig/LLD
• Privilege level: asInvoker
• Authenticode: unsigned

Two independent canonical builds produced byte-identical executables.

The executable imports only:

• KERNEL32.dll
• USER32.dll
• GDI32.dll

The release gate rejects file creation or modification APIs, registry mutation APIs, network libraries, process-launch and process-injection APIs, and service-control APIs. The executable contains no packer, self-decryptor, updater, background service, or child-program extraction path.

CUDA is loaded from the installed NVIDIA driver through LoadLibraryW and GetProcAddress. The application loads its embedded PTX directly into the CUDA driver API.

Trojan:Win32/Wacatac.B!ml is a Microsoft Defender machine-learning and heuristic classification. The executable is unsigned, newly distributed, uses a custom native Win32 entry point, embeds CUDA PTX, and resolves the CUDA driver dynamically. These characteristics can contribute to a low-reputation heuristic classification.

Independent review should use the repository source, the reproducible build, the restricted import table, and the published SHA-256. The project does not require disabling real-time protection or creating broad antivirus exclusions.

1. Verify the downloaded file size and SHA-256.
2. Build the repository in a clean directory with the canonical build command.
3. Compare the rebuilt executable against the published hash.
4. Review the PE report generated by validate_build.py.
5. Submit the exact hash to Microsoft Security Intelligence for classification review when required.