File scan report
Verdict Safe
Is Bloxstrap.
A signed Roblox bootstrapper component that none of the 66 antivirus engines that checked it flagged, with a clean combined sandbox result over four runs and no hostile network…
Read the whole reasonShow less
Moderate evidence · No engine flags it, but no publisher signature confirms who made it.
If you obtained this file from the launcher project's official release page, there is nothing to act on — keep it and leave your security software enabled. If it arrived from a file-hosting link or inside an unrelated download, replace it with a fresh copy from the official source.
Good practice2 tips
We found nothing harmful in this file.
Run it only if it came from the developer's own website or an official app store.
Keep your antivirus and Windows updates switched on.
No scanner can promise a file is 100% safe.
Antivirus results
0 of 66 flagged
- Flagged 0
- No detection 66
- No result 9
- Code signing SignPath Foundation
- Test run Completed
- First seen 3mo ago
Chapter 02
Why we think so
3 points against it and 5 in its favour, checked against the scan evidence.
The reasoning behind this verdict
None of the 66 antivirus engines that checked it flagged this file, including the highest-trust ones, and the sandbox runs produced a clean combined result with no injection into another process. The file carries a valid signature from a shared signing service, has been submitted by thousands of distinct sources, and the host checks found nothing known-malicious. Everything points to an ordinary game-launcher library.
This is a Windows executable that behaves as a launcher: the sandbox runs show it starting a .NET runtime bootstrap and opening a web browser, which is what a game bootstrapper does. Not a single antivirus engine flagged it — none of the 66 antivirus engines that checked it, including 18 of the most reliable ones, returned anything but a clean result. The host-reputation check covered 40 hosts and found nothing known-malicious or suspicious, the dropped files we could verify were clean, and the malware databases and community rule sets returned no hits. The one caveat is that the digital signature comes from a shared signing service rather than the project itself, so it confirms the file was not tampered with after signing but does not identify the author. Weighing the total absence of detections, the clean runtime result and the clean network picture, the file looks like legitimate software.
What We Detected
Nothing. The file is a 12.6 MB 64-bit Windows executable carrying a valid digital signature issued through a shared signing service. Across 75 engines, none returned a malicious or suspicious verdict — the 66 engines that returned a result all reported the file as clean, including the highest-trust products in the set. The executable is not packed: every section shows ordinary entropy and no packer or wrapper was identified. The file was first seen on Aug 5, 2026 and has been submitted from 3,665 distinct sources in more than 10,000 submissions, which is the profile of widely distributed, commonly downloaded software.
Threat Behavior
The sandbox runs, four in total, produced a clean combined result. The observed activity fits a game launcher: a .NET runtime bootstrap was started and a web browser was opened to complete that bootstrap, with Microsoft and browser-data hosts contacted alongside content-delivery and analytics devices. There were no rare high-risk techniques recorded. The host-reputation cross-check covered 40 hosts and found no known-malicious and no known-suspicious destinations; the two hosts with older reports were outside the useful age window and were not counted. No malicious file was dropped, and the reference databases and community rule sets returned no matching samples or rules for this hash.
What To Do Now
Keep the file if you downloaded it as part of a launcher package from the project's official release source. Its value depends entirely on where it came from: a copy obtained from a random file-hosting page or bundled inside an unrelated installer should be replaced with a fresh download from the official project page, because a valid signature from a shared signing service does not by itself prove where a particular copy originated. Leave your antivirus and other protection enabled — it reported nothing here and is still worth having on. No further action is needed if the file came from the official source.
Where this verdict could be wrong2 caveats
- A researcher annotation on the file mentions infection-style YARA triage keywords, but the public rule sets returned no matching malware rules and no engine flagged the file, so that annotation is unconfirmed commentary.
- The digital signature is valid yet issued by a shared signing service used by many unrelated projects, so it confirms the file was not altered after signing but says nothing about who produced it.
These are the assessment's weak points. If you believe one applies to your file, report the verdict and we'll re-review it.
- None of the 66 antivirus engines that checked it flagged the file, and all 18 of the highest-trust engines reported it clean.
- The combined sandbox verdict was clean, with no process recorded as an injection target.
- The host-reputation check covered 40 contacted hosts and found none known-malicious or suspicious.
- The file has been submitted by 3,665 distinct sources over 10,217 submissions since first seen on Aug 5, 2026.
- No malicious dropped file, no malware-database listing and no matching malware-specific rules.
- The digital signature comes from a shared signing service used by many unrelated projects, so it verifies integrity but does not identify who built the file.
- This is a launcher component that depends on remote content and browser-based bootstrapping, so what it ultimately runs depends on servers outside the file itself.
- An annotation left on the file by another researcher references infection-style rule keywords, although no rule set or engine matched it.
6 sources checked · all complete. See every source
Chapter 03
What it did in our test
It ran in 4 isolated tests; no test environment rated what it did as risky.
Test run summary
Capture complete- 4isolated sandbox runs
- 11sandbox rule tags
- 6spawned processes
- 40network contacts
- 17filesystem & mutex artifacts
What this file did when executed
This file was detonated in 4 sandboxes and its runtime behaviour was observed.
Sandbox verdicts
1- VT: CLEANclean
Techniques observed in the sandbox
11MITRE ATT&CK techniques the sandbox mapped. Highlighted ones are rare in normal software; the others are common in legitimate programs too.
- T1012
- T1027· Obfuscated code
- T1027.002· Obfuscated code
- T1033· Reads user info
- T1055· Process injection
- T1071· Application protocol
- T1082· System recon
- T1129· Loads modules
- T1497.001· Sandbox evasion
- T1539
- T1574· Execution hijack
Observed activity
Processes started
6Programs the file ran, with their command lines.
Bloxstrap-v2.11.4.exe"C:\Users\<USER>\Desktop\Bloxstrap-v2.11.4.exe"msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://aka.ms/dotnet-core-applaunch?framework=Microsoft.NETCore.App&framework_version=6.0.0&arch=x64&rid=win-x64&os=win10&gui=trueidentity_helper.exe"C:\Program Files (x86)\Microsoft\Edge\Application\122.0.2365.92\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --no-appcompat-clear --mojo-platform-channel-handle=6476 --field-trial-handle=2196,i,14040375897727692700,12087177054973802055,262144 --variations-seed-version /prefetch:8Bloxstrap-v2.11.4.exe"C:\Users\user\Desktop\Bloxstrap-v2.11.4.exe"chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized --single-argument https://aka.ms/dotnet-core-applaunch?framework=Microsoft.NETCore.App&framework_version=6.0.0&arch=x64&rid=win-x64&os=win10&gui=truechrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --metrics-shmem-handle=2020,i,18416897994020218918,14741678586886368969,524288 --field-trial-handle=1812,i,9118809514170179846,5744213113366784583,262144 --variations-seed-version=20260803-170100.258000-production --mojo-platform-channel-handle=2136 /prefetch:11
Network contacts
4040 hosts, listed as 20 domains, 20 addresses. Links show the host and path only.
- Domain
aka.ms - Domain
js.monitor.azure.com - Domain
microsoftmscompoc.tt.omtrdc.net - Domain
uhf-exp-fd-gbcrdgggfbggh0g3.b02.azurefd.net - Domain
westus2-0.in.applicationinsights.azure.com - Domain
xpaywalletcdn.azureedge.net
Show all 40 entries for network contacts
- Domain
www.clarity.ms - Domain
scripts.clarity.ms - Domain
c.clarity.ms - Domain
c.bing.com - Domain
k.clarity.ms - Domain
clients2.googleusercontent.com - Domain
rum.hlx.page - Domain
img-prod-cms-rt-microsoft-com.akamaized.net - Domain
lptag.liveperson.net - Domain
lpcdn.lpsnmedia.net - Domain
accdn.lpsnmedia.net - Domain
publisher.liveperson.net - Domain
bat.bing.com - Domain
mem.gfx.ms - IP address
23.222.22.11 - IP address
150.171.110.195 - IP address
150.171.73.13 - IP address
20.9.155.145 - IP address
4.153.187.221 - IP address
150.171.27.10 - IP address
172.175.38.6 - IP address
142.251.184.132 - IP address
151.101.1.91 - IP address
23.33.22.150 - IP address
34.120.154.120 - IP address
208.89.12.153 - IP address
208.89.12.91 - IP address
35.186.249.72 - IP address
18.172.134.46 - IP address
172.64.146.215 - IP address
142.250.152.155 - IP address
151.101.130.49 - IP address
157.240.254.35 - IP address
184.33.74.189
Files
16Files the file created, changed or deleted.
- Written
C:\ProgramData\Microsoft\NetFramework\BreadcrumbStore\netcore,DiscordRichPresence,1.2.1.24 - Written
C:\ProgramData\Microsoft\NetFramework\BreadcrumbStore\netcore,securifybv.PropertyStore,0.1.0 - Written
C:\ProgramData\Microsoft\NetFramework\BreadcrumbStore\netcore,CommunityToolkit.Mvvm - Written
C:\ProgramData\Microsoft\NetFramework\BreadcrumbStore\netcore,runtime.win-x64.Microsoft.NETCore.DotNetHostPolicy - Written
C:\ProgramData\Microsoft\NetFramework\BreadcrumbStore\netcore,runtime.win-x64.Microsoft.NETCore.DotNetHostPolicy,6.0.3 - Written
C:\ProgramData\Microsoft\NetFramework\BreadcrumbStore\netcore,CommunityToolkit.Mvvm,8.4.2
Show all 16 entries for files
- Written
C:\ProgramData\Microsoft\NetFramework\BreadcrumbStore\netcore,System.Runtime.CompilerServices.Unsafe,6.1.2 - Written
C:\ProgramData\Microsoft\NetFramework\BreadcrumbStore\netcore,AvalonEdit,6.3.0.90 - Written
C:\ProgramData\Microsoft\NetFramework\BreadcrumbStore\netcore,AvalonEdit - Written
C:\ProgramData\Microsoft\NetFramework\BreadcrumbStore\netcore,DiscordRichPresence - Written
C:\ProgramData\Microsoft\NetFramework\BreadcrumbStore\netcore,securifybv.ShellLink - Written
C:\ProgramData\Microsoft\NetFramework\BreadcrumbStore\netcore,Markdig,1.1.3 - Written
C:\ProgramData\Microsoft\NetFramework\BreadcrumbStore\netcore,Markdig - Written
C:\ProgramData\Microsoft\NetFramework\BreadcrumbStore\netcore,Newtonsoft.Json,13.0.1 - Written
C:\ProgramData\Microsoft\NetFramework\BreadcrumbStore\netcore,Newtonsoft.Json - Deleted
C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\84a3b7ef-f447-4177-8902-e957e7a73bc2.tmp
Registry and auto-start
4Settings the file changed, including ways to start again after a restart.
- Set
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\SlowContextMenuEntries - Set
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Cookies\CachePrefix - Set
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\History\CachePrefix - Deleted
HKEY_CURRENT_USER\Software\Google\Chrome\PreferenceMACs\Default\extensions.settings
Mutexes
1Named locks a program uses so only one copy runs; malware families often reuse them.
\Sessions\1\BaseNamedObjects\DBWinMutex
Sandbox background — not the file
1The analysis machine's own processes and connections, recorded in every run.
- VM process
RuntimeBroker.exeC:\Windows\System32\RuntimeBroker.exe -Embedding
Files this sample writes at runtime
This file drops 3 children at runtime. None are currently flagged malicious in our cache. 2 have no saved verdict and were not checked; that is missing coverage, not a finding.
- 0d20debb26fc8b2bc84f…798941Clean0/75 enginestrust 93from our cache
- c2b9cecdbef5d978a547…37e13bNot checkedno saved verdict
- bac0bcdff730c55bf6b8…f43752Not checkedno saved verdict
Chapter 04
Technical details
None of the 66 antivirus engines that checked it flag it; signed by SignPath Foundation.
Sources checked
Every check behind this verdict
6 sources checked · all complete. Complete means the check returned a usable result; it does not mean the file is safe.
File fingerprint
- Last analyzed
- Nov 6, 2026, 10:28 PM UTC
- SHA-256
9ad7758093a356fe5bd9d49911aaacf766dbb9289b6f3662a8ed3242230f46b2- SHA-1
84d9e3ef605d7ef184e8e24d6f8c0ec5670fa98a- MD5
f408c18edc86d2dc33385c2f11a57fb7
About this file
Bloxstrap.dll is a Win32 EXE file of 12.6 MB.
- Claims to be
- BloxstrapFrom the file's own version information, written by whoever built it.
- Original name
- Bloxstrap.dllMatches the shared file name.
- Type and size
- Win32 EXE · 12.6 MB
- Signer
- SignPath FoundationValid code signature.
- First seen
- Aug 5, 2026On VirusTotal.
- Submitted by
- 3,665 distinct sources
- Packer
- None detected
- Entropy
- 5.95 of 8
First scanned
Antivirus consensus
0 of 66 engines flagged this file
9 of the 75 engines returned no result for this file (file type not supported, or the scan did not finish), so they did not check it.
- Tier-118 engines0flagged
- Tier-231 engines0flagged
- Low-trust17 engines0flagged
View all 75 engine results
- AcronisClean
- AhnLab-V3Clean
- AlibabaClean
- alibabacloudClean
- ALYacClean
- Antiy-AVLClean
- APEXClean
- ArcabitClean
- AvastClean
- Avast-MobileNo result
- AVGClean
- AviraClean
- BitDefenderClean
- BitDefenderFalxNo result
- BkavClean
- CAT-QuickHealClean
- ClamAVNo result
- CMCClean
- CrowdStrikeClean
- CTXClean
- CylanceClean
- CynetClean
- DeepInstinctNo result
- DrWebClean
- ElasticClean
- EmsisoftClean
- ESET-NOD32Clean
- F-SecureClean
- FortinetClean
- GDataClean
- GoogleNo result
- GridinsoftClean
- huorongClean
- IkarusClean
- JiangminClean
- K7AntiVirusClean
- K7GWClean
- KasperskyClean
- KingsoftClean
- LionicClean
- MalwarebytesClean
- MaxSecureClean
- McAfeeDClean
- MicrosoftClean
- MicroWorld-eScanClean
- NANO-AntivirusClean
- PaloaltoClean
- PandaClean
- RisingClean
- SangforClean
- SentinelOneClean
- SkyhighNo result
- SophosClean
- SUPERAntiSpywareClean
- SymantecClean
- SymantecMobileInsightNo result
- TACHYONClean
- tehtrisNo result
- TencentClean
- TrapmineClean
- TrellixENSClean
- TrendMicroClean
- TrendMicro-HouseCallClean
- TrustlookNo result
- VaristClean
- VBA32Clean
- VIPREClean
- VirITClean
- ViRobotClean
- WebrootClean
- XcitiumClean
- YandexClean
- ZillyaClean
- ZoneAlarmClean
- ZonerClean
Signatures and behavior heuristics
Low-severity pattern matches — worth noting but not on their own cause for alarm.
VirusTotal's sandbox summary maps this run to MITRE T1055 (Process Injection), but no injected process of the sample's own was recorded (the analysis VM's own WMI adapter, crash handlers and Chrome updater are not counted). VirusTotal maps T1055 on about half of all files no engine flags, so the mapping alone is not evidence of injection.
EvidenceT1055 (sandbox MITRE mapping)
Section entropy & packers
No high-entropy executable section or known packer signature was detected. Data and resource sections can still have high entropy without indicating packed code.
How widely this file has been seen
Widely uploaded, but first seen within the last six months. No strong prior applies.
Chapter 05
Questions & answers
Short answers to the 7 questions people ask most about this file.
Is Bloxstrap.dll safe?
What is Bloxstrap.dll?
How many antivirus engines detected Bloxstrap.dll?
Is Bloxstrap.dll digitally signed?
What is the SHA-256 hash of Bloxstrap.dll?
Is it safe to run Bloxstrap.dll?
How up to date is this analysis of Bloxstrap.dll?
Community
Member reviews and reports for this exact file hash.