File scan report
Verdict Safe
Is Mod
No antivirus engine detected the long-circulating archive, although one sandbox recorded process-loading and direct-IP activity that lacks a complete host-reputation check.
Read the whole reasonShow less
Strong evidence · Widely seen for a long time, and nothing harmful found.
Good practice2 tips
We found nothing harmful in this file.
Open it only if you trust the person or website you got it from.
Keep your security software and system updates switched on.
No scanner can promise a file is 100% safe.
Reads the latest antivirus results for this file's hash. Nothing is uploaded.
Antivirus results
0 of 68 flagged
- Flagged 0
- No detection 68
- No result 7
- Code signing Not applicable
- Test run Completed
- First seen 11y ago
Chapter 02
Why we think so
3 points against it and 5 in its favour, checked against the scan evidence.
The reasoning behind this verdict
All 68 antivirus engines that checked it were free of detections, including 17 major antivirus engines, and the archive has circulated widely since 2015. One sandbox recorded potentially offensive techniques and 11 direct-IP contacts, but produced no malicious runtime verdict; those IPs were not fully reputation-checked.
The archive received no malicious or suspicious detections from 75 antivirus engines, including 17 major antivirus engines. It has been observed since 2015 across 256 sources and 480 submissions, making an undiscovered commodity threat less likely. One completed sandbox run mapped activity to and three other offensive techniques, but it did not issue a malicious sandbox verdict. Ten extracted children were inspected without a confirmed malicious child, although their individual verdicts remain unresolved. The 11 contacted IP addresses lack a complete host-reputation assessment. No complete contacted-host reputation result was available. Overall, the extensive detection history outweighs the uncorroborated behavioural heuristics.
What We Detected
No malicious or suspicious detection was reported among 75 antivirus engines. This includes 17 major antivirus engines, such as Avast, BitDefender, ESET-NOD32, Kaspersky, and Fortinet. The archive has also circulated since 2015, with 256 sources and 480 submissions, without accumulating a malware family label.
Threat Behavior
One sandbox run mapped activity to T1005, T1055, T1543.002, and T1562.001. It also observed rundll32 loading a temporary DLL and connections to 11 IP addresses, but issued no malicious sandbox verdict. Host reputation was not completely checked for those IP addresses. Ten extracted children were inspected without a confirmed malicious child, though their individual classifications remain unknown.
What To Do Now
Obtain the archive from its original trusted distribution channel and keep security software enabled while extracting or running it. If the source is uncertain, verify the SHA-256 hash and consider monitoring outbound connections during first use.
Where this verdict could be wrong3 caveats
- One of our behaviour rules mapped rundll32 loading zlib.net.dll to T1055, which warrants caution despite the lack of engine detections.
- One of our behaviour rules recorded 11 direct-IP contacts, while the missing contacted-host reputation result means their reputations were not completely checked.
- All 10 extracted children have unknown verdicts, so the absence of a known-malicious dropped file does not establish that every archive component is benign.
These are the assessment's weak points. If you believe one applies to your file, report the verdict and we'll re-review it.
- 0/68 antivirus engines reported a malicious or suspicious result.
- All 17 reporting major antivirus engines returned no detection.
- Observed since 2015 across 256 sources and 480 submissions.
- No malicious sandbox verdict was issued.
- No malicious child or external-intelligence hit was confirmed.
- Sandbox evidence mapped DLL loading through rundll32 to T1055.
- Four offensive MITRE techniques were recorded in one sandbox run.
- Eleven direct-IP contacts were observed without a complete host-reputation result.
6 sources checked · 5 complete · 1 partial. See every source
Chapter 03
What it did in our test
It ran in our isolated test environment; no test environment rated what it did as risky.
Test run summary
Capture complete- 18sandbox rule tags
- 7spawned processes
- 11network contacts
- 40filesystem & mutex artifacts
What this file did when executed
This file was run in a sandbox and its runtime behaviour was observed.
Techniques observed in the sandbox
18MITRE ATT&CK techniques the sandbox mapped. Highlighted ones are rare in normal software; the others are common in legitimate programs too.
- T1005
- T1010
- T1012
- T1055· Process injection
- T1056· Keylogging
- T1059· Runs commands
- T1064
- T1070· Covers its tracks
- T1070.004· Covers its tracks
- T1071· Application protocol
- T1082· System recon
- T1083· Scans your files
- T1497· Sandbox evasion
- T1518.001· Checks your AV
- T1543.002· Service install
- T1562.001· Disables security
- T1564.001· Hides artifacts
- T1574.002· Execution hijack
Observed activity
Processes started
7Programs the file ran, with their command lines.
rundll32.exe"C:\Windows\system32\rundll32.exe" "C:\Users\<USER>\AppData\Local\Temp\zlib.net.dll",#1DAIModManager.exe"C:\Users\<USER>\AppData\Local\Temp\DAIModManager.exe"wmiprvse.exeC:\Windows\system32\wbem\wmiprvse.exe -Embeddingunarchiver.exeC:\Windows\SysWOW64\unarchiver.exe" "C:\Users\user\Desktop\sample.zip7za.exeC:\Windows\SysWOW64\7za.exe C:\Windows\System32\7za.exe" x -pinfected -y -o"C:\Users\user\AppData\Local\Temp\2cvnael4.ghg" "C:\Users\user\Desktop\sample.zipcmd.exeC:\Windows\SysWOW64\cmd.exe cmd.exe" /C "C:\Users\user\AppData\Local\Temp\2cvnael4.ghg\DAIModManager.exe
Show all 7 entries for processes started
DAIModManager.exeC:\Users\user\AppData\Local\Temp\2cvnael4.ghg\DAIModManager.exe
Network contacts
1111 hosts, listed as 11 addresses. Links show the host and path only.
- IP address
72.21.81.240 - IP address
40.126.62.130 - IP address
104.107.106.121 - IP address
52.142.223.178 - IP address
40.68.123.157 - IP address
13.64.180.106
Show all 11 entries for network contacts
- IP address
20.163.45.184 - IP address
23.75.209.56 - IP address
52.183.220.149 - IP address
20.72.205.209 - IP address
13.95.31.18
Files
30Files the file created, changed or deleted.
- Written
C:\Users\user\AppData\Local\Microsoft\Windows\Caches - Written
C:\Users\user\AppData\Local\Microsoft\Windows\Explorer - Written
C:\Users\user\AppData\Local\Temp\hwvkn1l0.nvd - Written
C:\Users\user\AppData\Local\Temp\hwvkn1l0.nvd\DAIModManager.exe - Written
C:\Users\user\AppData\Local\Temp\hwvkn1l0.nvd\DAIModManager.pdb - Written
C:\Users\user\AppData\Local\Temp\hwvkn1l0.nvd\zlib.net.dll
Show all 30 entries for files
- Written
C:\Users\user\AppData\Local\Temp\unarchiver.log - Written
C:\Users\user\AppData\Roaming - Written
C:\Users\user\AppData\Roaming\Microsoft\Windows\Recent\AutomaticDestinations - Written
\Device\ConDrv\\Connect - Written
C:\Users\user\AppData\Local\Temp\arvv4b4z.14u - Written
C:\Users\user\AppData\Local\Temp\arvv4b4z.14u\DAIModManager.exe - Written
C:\Users\user\AppData\Local\Temp\arvv4b4z.14u\DAIModManager.pdb - Written
C:\Users\user\AppData\Local\Temp\arvv4b4z.14u\zlib.net.dll - Written
C:\Users\user\AppData\Local\Temp\g5myeail.zab - Deleted
/tmp/tmp.O97UuZdIbq - Deleted
/tmp/tmp.Trf6jCFwuy - Deleted
/tmp/tmp.l9VxJik2iO - Deleted
/var/lib/logrotate/status.tmp - Deleted
/var/log/apport.log.1 - Deleted
/var/log/auth.log.1 - Deleted
/var/log/auth.log.5.gz - Deleted
/var/log/cups/access_log.1 - Deleted
/var/log/cups/access_log.8.gz - Deleted
/var/log/kern.log.1 - Deleted
/var/log/kern.log.5.gz - Deleted
/var/log/syslog.1 - Deleted
/var/log/syslog.8.gz - Deleted
/tmp/tmp.bTAELZOU7q - Deleted
/tmp/tmp.dh74zSlFcG
Registry and auto-start
1Settings the file changed, including ways to start again after a restart.
- Deleted
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\ComDlg32\LastVisitedPidlMRU\MRUList
Mutexes
10Named locks a program uses so only one copy runs; malware families often reuse them.
Local\SM0:3060:168:WilStaging_02Local\SM0:72:304:WilStaging_02Local\__DDrawExclMode__Local\__DDrawCheckExclMode__Local\SM0:72:120:WilError_03Global\C::Users:Bruno:AppData:Local:Microsoft:Windows:Explorer:iconcache_idx.db!rwWriterMutex
Show all 10 entries for mutexes
Global\C::Users:Bruno:AppData:Local:Microsoft:Windows:Explorer:iconcache_16.db!dfMaintainerGlobal\C::Users:Bruno:AppData:Local:Microsoft:Windows:Explorer:iconcache_32.db!dfMaintainerGlobal\C::Users:Bruno:AppData:Local:Microsoft:Windows:Explorer:iconcache_48.db!dfMaintainerGlobal\C::Users:Bruno:AppData:Local:Microsoft:Windows:Explorer:iconcache_96.db!dfMaintainer
Sandbox background — not the file
6The analysis machine's own processes and connections, recorded in every run.
- VM process
services.exeC:\Windows\system32\services.exe - VM process
svchost.exeC:\Windows\system32\svchost.exe -k DcomLaunch -p - VM process
DllHost.exeC:\Windows\system32\DllHost.exe /Processid:{AA65DD7C-83AC-48C0-A6FD-9B61FEBF8800} - VM process
svchost.exeC:\Windows\system32\svchost.exe -k netsvcs -p -s Winmgmt - VM process
svchost.exeC:\Windows\system32\svchost.exe -k wusvcs -p -s WaaSMedicSvc - VM process
conhost.exeC:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Files this sample writes at runtime
This file drops 10 children at runtime. None are currently flagged malicious in our cache. 10 have no saved verdict and were not checked; that is missing coverage, not a finding.
- 9425a94647b42358f53c…f28684Not checkedno saved verdict
- 50a7d0bccdf7ef5a79c4…b8b92bNot checkedno saved verdict
- 027b7c46a3ca0625b51b…3041c3Not checkedno saved verdict
- 4d9e6128c4ab80e391b0…02fe34Not checkedno saved verdict
- 4167b599f36af0781b81…4b516aNot checkedno saved verdict
- 82f28a88ecd35659cf9b…c9b38eNot checkedno saved verdict
- 2b5473c70e0dd22f6f0c…1cb73dNot checkedno saved verdict
- 300d468f8909489002e6…add512Not checkedno saved verdict
- 7311547a87c75f92566f…424ac9Not checkedno saved verdict
- 62e058bef6819056d9d3…f10746Not checkedno saved verdict
Chapter 04
Technical details
None of the 68 antivirus engines that checked it flag it.
Sources checked
Every check behind this verdict
6 sources checked · 5 complete · 1 partial. Complete means the check returned a usable result; it does not mean the file is safe.
File fingerprint
- Last analyzed
- Sep 9, 2026, 6:43 PM UTC
- SHA-256
39550fdf9b9647dcfffc049551908673ef01e18cd364486db47da09552df003f- SHA-1
c29fccaf4672ba1a3c0107ee6e965f8ed4987418- MD5
e145c2b9b4b704b0ee49e82c899732fd
About this file
ModManager (x64) 1.0.0.59.zip is a ZIP file of 142.2 kB.
- Type and size
- ZIP · 142.2 kB
- Signer
- Not applicable
- First seen
- Sep 15, 2015On VirusTotal.
- Submitted by
- 256 distinct sources
First scanned
Antivirus consensus
0 of 68 engines flagged this file
7 of the 75 engines returned no result for this file (file type not supported, or the scan did not finish), so they did not check it.
- Tier-118 engines0flagged
- Tier-237 engines0flagged
- Low-trust13 engines0flagged
View all 75 engine results
- AcronisClean
- AhnLab-V3Clean
- AlibabaClean
- alibabacloudClean
- ALYacClean
- Antiy-AVLClean
- APEXNo result
- ArcabitClean
- AvastClean
- Avast-MobileClean
- AVGClean
- AviraClean
- BitDefenderClean
- BitDefenderFalxNo result
- BkavClean
- CAT-QuickHealClean
- ClamAVClean
- CMCClean
- CrowdStrikeClean
- CTXClean
- CylanceNo result
- CynetClean
- DeepInstinctClean
- DrWebClean
- ElasticClean
- EmsisoftClean
- ESET-NOD32Clean
- F-SecureClean
- FortinetClean
- GDataClean
- GoogleClean
- GridinsoftClean
- huorongClean
- IkarusClean
- JiangminClean
- K7AntiVirusClean
- K7GWClean
- KasperskyClean
- KingsoftClean
- LionicClean
- MalwarebytesClean
- MaxSecureClean
- McAfeeDClean
- MicrosoftClean
- MicroWorld-eScanClean
- NANO-AntivirusClean
- PaloaltoNo result
- PandaClean
- RisingClean
- SangforClean
- SentinelOneClean
- SkyhighClean
- SophosClean
- SUPERAntiSpywareClean
- SymantecClean
- SymantecMobileInsightNo result
- TACHYONClean
- tehtrisNo result
- TencentClean
- TrapmineNo result
- TrellixENSClean
- TrendMicroClean
- TrendMicro-HouseCallClean
- TrustlookClean
- VaristClean
- VBA32Clean
- VIPREClean
- VirITClean
- ViRobotClean
- WebrootClean
- XcitiumClean
- YandexClean
- ZillyaClean
- ZoneAlarmClean
- ZonerClean
Signatures and behavior heuristics
Low-severity pattern matches — worth noting but not on their own cause for alarm.
VirusTotal's sandbox summary maps this run to MITRE T1055 (Process Injection), but no injected process of the sample's own was recorded (the analysis VM's own WMI adapter, crash handlers and Chrome updater are not counted). VirusTotal maps T1055 on about half of all files no engine flags, so the mapping alone is not evidence of injection.
EvidenceT1055 (sandbox MITRE mapping)
How widely this file has been seen
Widely seen in the wild for a long time. High prior this is legitimate; isolated detections on common-old files are usually false positives.
Chapter 05
Questions & answers
Short answers to the 6 questions people ask most about this file.
Is ModManager (x64) 1.0.0.59.zip safe?
What is ModManager (x64) 1.0.0.59.zip?
How many antivirus engines detected ModManager (x64) 1.0.0.59.zip?
What is the SHA-256 hash of ModManager (x64) 1.0.0.59.zip?
Is it safe to open or extract ModManager (x64) 1.0.0.59.zip?
How up to date is this analysis of ModManager (x64) 1.0.0.59.zip?
Community
Member reviews and reports for this exact file hash.