File scan report
Verdict Safe
Is Fishstrap.
Only APEX flagged this widely submitted executable, while higher-confidence engines, sandbox observations, host checks, and external intelligence supplied no malicious…
Read the whole reasonShow less
Moderate evidence · No engine flags it, but no publisher signature confirms who made it.
Keep security protection enabled and use a copy obtained directly from the official project release channel. Verify the SHA-256 when the publisher provides a release checksum.
Good practice2 tips
We found nothing harmful in this file.
Run it only if it came from the developer's own website or an official app store.
Keep your antivirus and Windows updates switched on.
No scanner can promise a file is 100% safe.
Antivirus results
1 of 69 flagged
- Flagged 1
- No detection 68
- No result 6
- Code signing Unsigned
- Test run Completed
- First seen 7d ago
Chapter 02
Why we think so
3 points against it and 5 in its favour, checked against the scan evidence.
The reasoning behind this verdict
Only 1 of the 69 antivirus engines that checked it flagged the file, and that isolated generic result came from a less reliable detector; all higher-confidence engines remained silent. Its broad distribution, combined clean sandbox verdict, fully covered host-reputation check, and lack of malicious files it created or intelligence matches make a false alarm highly likely.
The antivirus results show one generic detection among 75 engines, with no higher-confidence engine flagging the file. The file has been submitted by 752 sources, providing a meaningful benign anchor despite its unsigned status. Five sandbox runs produced a combined clean verdict, recorded no named injection target, and supplied no high-risk technique backed by an actual artefact. Reputation checks covered all observed hosts and found none with a current malicious or suspicious result, while no inspected child was harmful. Malware-specific community rules and public sample-database checks also supplied no match, so the solitary APEX result is best explained as a false positive.
What We Detected
APEX was the only engine to flag the file, producing a generic malicious label. The other 74 of the 69 antivirus engines that checked it did not flag it, including all higher-confidence engines. No malware family was identified.
Threat Behavior
Five sandbox runs produced a combined clean verdict. They recorded no named injection target, no corroborated high-risk technique, and no malicious file it created. Reputation checks covered every observed host and found no current malicious or suspicious result.
Supporting Context
The file has 752 distinct submitters and 898 submissions, which strongly reduces concern that it is an isolated malicious sample. No malware-specific community rule, public sample-database listing, suspicious packing, or verified malicious network destination corroborated the lone detection. The executable is unsigned, and our static analysis was not available, so its publisher and concealed code cannot be independently authenticated.
What To Do Now
Keep security software enabled and obtain the file from the project's official release channel. If the copy came from an unrelated mirror or unexpected message, compare its SHA-256 with the publisher's documented release hash before running it.
Where this verdict could be wrong3 caveats
- APEX labels the file malicious, although no other engine supports that generic result.
- The executable is unsigned, so there is no verified publisher identity to authenticate its origin.
- Our static analysis was not available, so the bytes were not independently examined for concealed functionality.
These are the assessment's weak points. If you believe one applies to your file, report the verdict and we'll re-review it.
- Only 1 of the 69 antivirus engines that checked it flagged the file, and no higher-confidence engine detected it.
- The file was submitted 898 times by 752 distinct sources.
- Five sandbox runs produced a combined clean verdict with no named injection target.
- Reputation checks covered all observed hosts and found no current malicious or suspicious result.
- No inspected child was malicious, and no malware-specific community rule or public sample-database match was found.
- The executable is unsigned, so its publisher cannot be authenticated through a code-signing certificate.
- APEX supplied one generic malicious detection.
- Our static analysis was not available to inspect the bytes for concealed functionality.
6 sources checked · all complete. See every source
Chapter 03
What it did in our test
It ran in 5 isolated tests; no test environment rated what it did as risky.
Test run summary
Capture complete- 5isolated sandbox runs
- 17sandbox rule tags
- 5spawned processes
- 40network contacts
- 16filesystem & mutex artifacts
What this file did when executed
This file was detonated in 5 sandboxes and its runtime behaviour was observed.
Sandbox verdicts
1- VT: CLEANclean
Techniques observed in the sandbox
17MITRE ATT&CK techniques the sandbox mapped. Highlighted ones are rare in normal software; the others are common in legitimate programs too.
- T1012
- T1027· Obfuscated code
- T1027.002· Obfuscated code
- T1033· Reads user info
- T1036
- T1055· Process injection
- T1064
- T1071· Application protocol
- T1082· System recon
- T1129· Loads modules
- T1497.001· Sandbox evasion
- T1539
- T1553
- T1553.002
- T1562· Disables security
- T1562.001· Disables security
- T1574· Execution hijack
Observed activity
Processes started
5Programs the file ran, with their command lines.
Fishstrap.exe"C:\Users\<USER>\Desktop\Fishstrap.exe"msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://aka.ms/dotnet-core-applaunch?framework=Microsoft.NETCore.App&framework_version=6.0.0&arch=x64&rid=win-x64&os=win10&gui=trueidentity_helper.exe"C:\Program Files (x86)\Microsoft\Edge\Application\122.0.2365.92\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --no-appcompat-clear --mojo-platform-channel-handle=6180 --field-trial-handle=2052,i,6502137278505060406,16043448344592440381,262144 --variations-seed-version /prefetch:8Fishstrap.exe"C:\Users\user\Desktop\Fishstrap.exe"chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized --load-extension="C:\Windows\crx" --single-argument https://aka.ms/dotnet-core-applaunch?framework=Microsoft.NETCore.App&framework_version=6.0.0&arch=x64&rid=win-x64&os=win10&gui=true
Network contacts
4040 hosts, listed as 20 domains, 20 addresses. Links show the host and path only.
- Domain
aka.ms - Domain
js.monitor.azure.com - Domain
microsoftmscompoc.tt.omtrdc.net - Domain
uhf-exp-fd-gbcrdgggfbggh0g3.b02.azurefd.net - Domain
westus2-0.in.applicationinsights.azure.com - Domain
xpaywalletcdn.azureedge.net
Show all 40 entries for network contacts
- Domain
clients2.googleusercontent.com - Domain
rum.hlx.page - Domain
c.s-microsoft.com - Domain
www.clarity.ms - Domain
img-prod-cms-rt-microsoft-com.akamaized.net - Domain
lptag.liveperson.net - Domain
lpcdn.lpsnmedia.net - Domain
accdn.lpsnmedia.net - Domain
publisher.liveperson.net - Domain
mem.gfx.ms - Domain
d.impactradius-event.com - Domain
cdnssl.clicktale.net - Domain
bat.bing.com - Domain
scripts.clarity.ms - IP address
184.30.253.214 - IP address
150.171.109.116 - IP address
150.171.73.13 - IP address
20.9.155.148 - IP address
150.171.109.115 - IP address
192.178.239.132 - IP address
151.101.129.91 - IP address
4.153.187.221 - IP address
23.223.44.199 - IP address
208.89.12.153 - IP address
34.120.154.120 - IP address
208.89.12.91 - IP address
35.186.249.72 - IP address
150.171.27.10 - IP address
54.230.253.61 - IP address
150.171.109.119 - IP address
40.126.29.8 - IP address
52.152.143.207 - IP address
52.179.73.39 - IP address
150.171.74.13
Files
15Files the file created, changed or deleted.
- Written
C:\ProgramData\Microsoft\NetFramework\BreadcrumbStore\netcore,securifybv.PropertyStore,0.1.0 - Written
C:\ProgramData\Microsoft\NetFramework\BreadcrumbStore\netcore,CommunityToolkit.Mvvm - Written
C:\ProgramData\Microsoft\NetFramework\BreadcrumbStore\netcore,Microsoft.WindowsDesktop.App.Runtime.win-x64 - Written
C:\ProgramData\Microsoft\NetFramework\BreadcrumbStore\netcore,CommunityToolkit.Mvvm,8.4.0 - Written
C:\ProgramData\Microsoft\NetFramework\BreadcrumbStore\netcore,runtime.win-x64.Microsoft.NETCore.DotNetHostPolicy - Written
C:\ProgramData\Microsoft\NetFramework\BreadcrumbStore\netcore,runtime.win-x64.Microsoft.NETCore.DotNetHostPolicy,6.0.3
Show all 15 entries for files
- Written
C:\ProgramData\Microsoft\NetFramework\BreadcrumbStore\netcore,AvalonEdit,6.3.0.90 - Written
C:\ProgramData\Microsoft\NetFramework\BreadcrumbStore\netcore,AvalonEdit - Written
C:\ProgramData\Microsoft\NetFramework\BreadcrumbStore\netcore,DiscordRichPresence,1.6.1.70 - Written
C:\ProgramData\Microsoft\NetFramework\BreadcrumbStore\netcore,DiscordRichPresence - Written
C:\ProgramData\Microsoft\NetFramework\BreadcrumbStore\netcore,SharpZipLib,1.4.2 - Written
C:\ProgramData\Microsoft\NetFramework\BreadcrumbStore\netcore,Markdig,0.40.0 - Written
C:\ProgramData\Microsoft\NetFramework\BreadcrumbStore\netcore,Markdig - Written
C:\ProgramData\Microsoft\NetFramework\BreadcrumbStore\netcore,Newtonsoft.Json,13.0.1 - Written
C:\ProgramData\Microsoft\NetFramework\BreadcrumbStore\netcore,Newtonsoft.Json
Registry and auto-start
3Settings the file changed, including ways to start again after a restart.
- Set
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\SlowContextMenuEntries - Set
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Cookies\CachePrefix - Set
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\History\CachePrefix
Mutexes
1Named locks a program uses so only one copy runs; malware families often reuse them.
\Sessions\1\BaseNamedObjects\DBWinMutex
Sandbox background — not the file
1The analysis machine's own processes and connections, recorded in every run.
- VM process
RuntimeBroker.exeC:\Windows\System32\RuntimeBroker.exe -Embedding
Files this sample writes at runtime
This file drops 3 children at runtime. None are currently flagged malicious in our cache. 2 have no saved verdict and were not checked; that is missing coverage, not a finding.
- 0d20debb26fc8b2bc84f…798941Clean0/75 enginestrust 93from our cache
- d18bb8446bf545cf5c06…7beb34Not checkedno saved verdict
- 174a247b06ab5d658a71…e3a146Not checkedno saved verdict
Chapter 04
Technical details
1 of the 69 antivirus engines that checked it flags it; no publisher signature.
Sources checked
Every check behind this verdict
6 sources checked · all complete. Complete means the check returned a usable result; it does not mean the file is safe.
Engines that flagged it 1
The saved verdict treats these detections as likely false positives.
- APEXMalicious
File fingerprint
- Last analyzed
- Nov 7, 2026, 4:40 AM UTC
- SHA-256
769332bceee38396592c0dc113e797e0dd3dd5988de538cd3fc03ebdfe2d804b- SHA-1
40512ee939d3c7847b2c5e450d08da01a297064d- MD5
daaf7c649a602db0f49b2af34a9d8581
About this file
Fishstrap.dll is a Win32 EXE file of 15.7 MB.
- Claims to be
- FishstrapFrom the file's own version information, written by whoever built it.
- Original name
- Fishstrap.dllMatches the shared file name.
- Type and size
- Win32 EXE · 15.7 MB
- Signer
- UnsignedNo code signature.
- First seen
- Oct 31, 2026On VirusTotal.
- Submitted by
- 752 distinct sources
- Packer
- None detected
- Entropy
- 5.50 of 8
First scanned
Antivirus consensus
1 of 69 engines flagged this file
6 of the 75 engines returned no result for this file (file type not supported, or the scan did not finish), so they did not check it.
- Tier-118 engines0flagged
- Tier-234 engines0flagged
- Low-trust17 engines1flagged
View all 75 engine results
- APEXMalicious: Malicious
- AcronisClean
- AhnLab-V3Clean
- AlibabaClean
- alibabacloudClean
- ALYacClean
- Antiy-AVLClean
- ArcabitClean
- AvastClean
- Avast-MobileNo result
- AVGClean
- AviraClean
- BitDefenderClean
- BitDefenderFalxNo result
- BkavClean
- CAT-QuickHealClean
- ClamAVNo result
- CMCClean
- CrowdStrikeClean
- CTXClean
- CylanceClean
- CynetClean
- DeepInstinctClean
- DrWebClean
- ElasticClean
- EmsisoftClean
- ESET-NOD32Clean
- F-SecureClean
- FortinetClean
- GDataClean
- GoogleClean
- GridinsoftClean
- huorongClean
- IkarusClean
- JiangminClean
- K7AntiVirusClean
- K7GWClean
- KasperskyClean
- KingsoftClean
- LionicClean
- MalwarebytesClean
- MaxSecureClean
- McAfeeDClean
- MicrosoftClean
- MicroWorld-eScanClean
- NANO-AntivirusClean
- PaloaltoClean
- PandaClean
- RisingClean
- SangforClean
- SentinelOneClean
- SkyhighClean
- SophosClean
- SUPERAntiSpywareClean
- SymantecClean
- SymantecMobileInsightNo result
- TACHYONClean
- tehtrisNo result
- TencentClean
- TrapmineClean
- TrellixENSClean
- TrendMicroClean
- TrendMicro-HouseCallClean
- TrustlookNo result
- VaristClean
- VBA32Clean
- VIPREClean
- VirITClean
- ViRobotClean
- WebrootClean
- XcitiumClean
- YandexClean
- ZillyaClean
- ZoneAlarmClean
- ZonerClean
Signatures and behavior heuristics
Low-severity pattern matches — worth noting but not on their own cause for alarm.
VirusTotal's sandbox summary maps this run to MITRE T1055 (Process Injection), but no injected process of the sample's own was recorded (the analysis VM's own WMI adapter, crash handlers and Chrome updater are not counted). VirusTotal maps T1055 on about half of all files no engine flags, so the mapping alone is not evidence of injection.
EvidenceT1055 (sandbox MITRE mapping)
Section entropy & packers
No high-entropy executable section or known packer signature was detected. Data and resource sections can still have high entropy without indicating packed code.
How widely this file has been seen
Lots of people are uploading this but it's recent — typical of newly-released legitimate software. Low prior for malware.
Chapter 05
Questions & answers
Short answers to the 6 questions people ask most about this file.
Is Fishstrap.dll safe?
What is Fishstrap.dll?
How many antivirus engines detected Fishstrap.dll?
What is the SHA-256 hash of Fishstrap.dll?
Is it safe to run Fishstrap.dll?
How up to date is this analysis of Fishstrap.dll?
Community
Member reviews and reports for this exact file hash.