Suspicious
Unsigned Windows utility exhibits process injection (T1055) and LSASS access in analysis but clean across our antivirus network.
462971f3f033dadff6…4902870efeThe reasoning behind this verdict
The MT AI Engine weighs every signal from this scan — antivirus detections, sandbox behaviour, code signing, prevalence and historical matches — to reach a single, evidence-based verdict.
Strong behavioural signals from sandbox analysis indicate offensive techniques typically seen in hacktools or trojans, including injection and privilege manipulation. The file's unsigned status and DLL-misnamed EXE format add concern, but perfect clean scan results from high-coverage engines weigh against immediate malice. Embedded Costura .NET assemblies and GUI-related artifacts point to a legitimate utility like a context menu manager. Absent engine consensus or bad network/drops, this remains borderline warranting caution.
Each signal cites a concrete token from the evidence the arbiter saw — engine name, MITRE technique, signer string, or an exact count.
triggeredHeuristics[0].rule='MalwareTips.Synth.ProcessInjection' fired=true severity=high evidence='C:\Windows\System32\svchost.exe -k NetworkService -p'
triggeredHeuristics[1].rule='MalwareTips.Synth.CredentialDumper' fired=true severity=medium evidence='C:\Windows\system32\lsass.exe'
behaviour.offensiveCount=2 (T1055, T1134); sandboxCount=1 but hasMaliciousSandboxVerdict=false
engines.reporting=71/76 total with 0 malicious across all tiers
mutexesCreated includes 'CosturaEE69E02B32099E67E2834169649026A6' confirming .NET Costura embedding
- Undetected by 71/76 engines incl. tier1 (Kaspersky, ESET, BitDefender)
- No malicious sandbox verdict
- No malicious dropped children or contacted hosts
- Costura .NET embedding with graphics libs (SkiaSharp)
- Unsigned PE executable
- Process injection (T1055, svchost.exe)
- LSASS access (credential dumper shape)
- Access token manipulation (T1134)
- DLL filename on EXE fileType
- Recent file (29 days old)
Treat as suspicious and isolate immediately. Monitor system for unusual process injection or credential access; consider full scan and removal if not a trusted utility.
What this file does
What it attempted when executed in an isolated sandbox
High concern: Hides inside another running program to evade antivirus.
Moderate concern: Obfuscates or packs its code to avoid detection.
Moderate concern: Scans through your files and folders.
Moderate concern: Checks whether it's being watched in a sandbox before acting.
Note: Collects details about your system.
Note: Loads extra code modules while running.
Translated from the file's technical behaviour during analysis. It never ran on your device.
What to do now
We couldn't fully clear this file. Treat it with caution.
Don't run it unless you're certain it came from a source you trust.
Check where you got it — an email attachment or a random download link is a red flag.
If you're unsure, delete it. You can always re-download a clean copy from the official source.
If you're still unsure, scan it again in a day or two — detections often catch up on newer files.
What this file did when executed
This file was detonated in 1 sandbox and its runtime behaviour was observed.
Adversary techniques mapped to the MITRE ATT&CK framework.
- C:\Users\<USER>\AppData\Local\Temp\Costura\EE69E02B32099E67E2834169649026A6\64\av_libglesv2.dll
- C:\Users\<USER>\AppData\Local\Temp\Costura\EE69E02B32099E67E2834169649026A6\64\libharfbuzzsharp.dll
- C:\Users\<USER>\AppData\Local\Temp\Costura\EE69E02B32099E67E2834169649026A6\64\libskiasharp.dll
- C:\Users\user\AppData\Local\Microsoft\Windows\Caches
- C:\Users\user\AppData\Local\Temp\Costura
- CosturaEE69E02B32099E67E2834169649026A6
- Local\SessionImmersiveColorMutex
- Global\OneSettingQueryMutex+compat+encapsulation
- \Sessions\1\BaseNamedObjects\CosturaEE69E02B32099E67E2834169649026A6
- \Sessions\1\BaseNamedObjects\DBWinMutex
Files this sample writes at runtime
This file drops 3 children at runtime. None are currently flagged malicious in our cache.
- f13d0dae00a598620a43…cd996cNever scannednever seen before
- 85b3aee47c0e0eaf3a5e…7695aeNever scannednever seen before
- 3268b1b2de384d00ed77…d63b52Never scannednever seen before
YARA & heuristic rule matches
A researcher-curated or high-severity heuristic rule matched this sample. These rules target specific malware families and are near-definitive.
MITRE T1055 (Process Injection) observed — CreateRemoteThread / APC / reflective-DLL injection. The payload is being smuggled into a legitimate process to bypass AV hooks.
EvidenceC:\Windows\System32\svchost.exe -k NetworkService -pSandbox observed process activity targeting LSASS (Windows credential store). Legitimate software has no business reading LSASS memory — this is Mimikatz-shape behaviour.
EvidenceC:\Windows\system32\lsass.exe
0 detections across 76 engines
Section entropy & packers
Section-level entropy and packer detection from the PE header. Nothing suspicious here — entropy is within the normal range for unpacked code.
How widely this file has been seen
Moderate prevalence — neither rare nor common. No strong prior applies.
Forensic fingerprint
- File name
- Windows11ContextMenuManager.dll
- Size
- 27.26 MB
- MIME type
- (unknown)
- Detected type
- Win32 EXE
- SHA-256
- 462971f3f033dadff698db140d9c55bb09e1e786f0ae9b228f99e84902870efe
- MD5
- c8c86135a9fc0907ac4da01f395720e8
- SHA-1
- 4ad91c75278a10ffd7dbdaead22785722161948a
- PE imphash
- e556870483f021b664787e6000df12c5
- First seen (VT)
- 3/26/2026, 5:58:23 AM
- Last analysis (VT)
- 4/18/2026, 7:39:10 AM
- First scan (MalwareTips)
- 4/24/2026, 6:15:01 AM
- Last scan (MalwareTips)
- 4/24/2026, 6:15:01 AM
Safety FAQ
Common questions about Windows11ContextMenuManager.dll, answered from the scan data above.
- Windows11ContextMenuManager.dll is suspicious — treat it as unsafe until you're sure. 0 of 76 antivirus engines flag it, which isn't a strong consensus but is enough to be cautious. Don't run it unless you fully trust where it came from, and prefer downloading the software fresh from its official site.
- Windows11ContextMenuManager.dll is a Windows executable program, about 27.3 MB. We identify a file by its cryptographic hash rather than its name, because the same filename can be reused by completely different files — the hash below is the reliable fingerprint.
- None — all 76 antivirus engines we queried report Windows11ContextMenuManager.dll as clean. That's reassuring, though brand-new malware can briefly evade detection before vendors add signatures, so we also weigh the file's behaviour and reputation.
- Act quickly. 1) Disconnect the device from the internet to stop the malware communicating or spreading. 2) Run a full scan with reputable anti-malware software (such as Malwarebytes) and quarantine everything it finds. 3) Change your important passwords from a DIFFERENT, clean device — many threats log keystrokes or steal saved credentials. 4) If you bank or shop on this device, watch closely for fraud and alert your bank. 5) For a confirmed infection, the most reliable fix is to back up your personal files and reinstall the operating system for a clean start.
- To remove Windows11ContextMenuManager.dll: 1) restart into Safe Mode (Safe Mode with Networking if you need to download a tool) so the malware doesn't auto-start. 2) Run a full scan with reputable anti-malware software and let it quarantine or delete the detections. 3) Delete the original Windows11ContextMenuManager.dll file and empty the Recycle Bin/Trash. 4) Check your browser extensions, startup items, and scheduled tasks for anything unfamiliar. 5) Reboot and scan again to confirm it's gone. If detections keep coming back, a clean operating-system reinstall is the most dependable cure.
- Windows11ContextMenuManager.dll is classified as a hacktool — dual-use offensive tooling that is dangerous regardless of intent. Knowing the family matters because it tells you the likely impact — data theft, remote control, file encryption, or unwanted ads — and guides the cleanup.
- The SHA-256 hash of Windows11ContextMenuManager.dll is 462971f3f033dadff698db140d9c55bb09e1e786f0ae9b228f99e84902870efe, and its MD5 is c8c86135a9fc0907ac4da01f395720e8. This hash is the file's unique fingerprint — two files with the same SHA-256 are identical. Use it to confirm you're looking at exactly this file (not just one with the same name) when comparing against antivirus databases or a download's published checksum.
- This report reflects the scan run on April 24, 2026. Because a file's hash never changes, the identity of Windows11ContextMenuManager.dll is fixed — but antivirus coverage improves over time, so a file that looks clean today can pick up detections later (and vice-versa). If you need the latest picture, MalwareTips staff can re-run the analysis from scratch.
Reviews & malware reports(0)
Tell the community what you saw. Tag the sample — Trojan, Adware, False Positive — and share what the file did on your system. Your report helps confirm or dispute the AV verdict.