File scan report
Verdict Malicious
Is Resetter
The filename mimics security software, but the major consensus overrides that false-positive pattern.
Strong evidence · Two or more major antivirus engines agree.
Treat the archive as malicious; delete it and do not execute any contents.
What to do now3 steps
This RAR archive is harmful. Don't open or extract it, and delete it.
If you haven't opened or extracted it
Don't open or extract this archive. Delete the archive and any files you extracted from it, then empty the Recycle Bin or Trash.
If you already opened or extracted it
If you already extracted it, delete the extracted files too and run a full antivirus scan.
If a page it opened asked for a password or card details and you entered them, change that password and call your bank.
If you opened or installed it
Avoid banking and sign-ins on that device until it is clean. These free MalwareTips guides walk you through it.
- Trojan removal guideClear steps for Windows, Mac and Android. (opens malwaretips.com in a new tab)
- Remove malware from WindowsStep-by-step cleanup with free tools. (opens malwaretips.com in a new tab)
- Ask for free help on the MalwareTips forumWindows malware removal help, answered by volunteers. (opens malwaretips.com in a new tab)
Paste this report's link in your topic so helpers can see what was found.
Reads the latest antivirus results for this file's hash. Nothing is uploaded.
Antivirus results
16 of 62 flagged
- Flagged 16
- No detection 46
- No result 14
- Code signing Not applicable
- Test run Completed
- First seen 3y ago
Chapter 02
Why we think so
3 points against it and 0 in its favour, checked against the scan evidence.
The reasoning behind this verdict
The engine block shows 16 detections out of 76 scanners, including a strong major consensus on the adjprog family. Although the filename triggers the AV-on-AV heuristic, the presence of three major antivirus engines agreeing on the same family outweighs that signal. No trusted signer, no clean RAG history, and no contradictory external-intel findings support the malicious classification.
What We Detected
16 of the 62 antivirus engines that checked it flagged the RAR, four of them major. Three major antivirus engines agreed on the adjprog family. Sandbox execution revealed AdjProg.exe writing printer-adjustment files and loading several DLLs via rundll32, mapping to MITRE T1055 and T1562.001.
Threat Behavior
No malicious files it created were found among the ten dropped artifacts, and no external control-server domains were observed in the single sandbox run.
What To Do Now
Do not open or extract the archive. Keep security software enabled and delete the file. If the file was already executed, scan the system with current signatures and monitor for unexpected printer-related processes.
Where this verdict could be wrong1 caveat
- filenameAnalysis.looksLikeSecuritySoftware=true and filename contains 'ResetterEpson' — classic AV-on-AV false-positive shape, but major consensus overrides it.
These are the assessment's weak points. If you believe one applies to your file, report the verdict and we'll re-review it.
- major family consensus on adjprog
- defense-evasion technique
- filename mimics security software
6 sources checked · 5 complete · 1 not needed or not applicable. See every source
Chapter 03
What it did in our test
It ran in our isolated test environment; no test environment rated what it did as risky.
Test run summary
Capture complete- 12sandbox rule tags
- 9spawned processes
- 0network contacts
- 24filesystem & mutex artifacts
What the test run showed
What the file did on a test computer
Confirmed in the test run
Moderate concern: Checked whether it was running on a test computer.
Note: Listed the programs running on the test computer.
Note: Read basic details of the test computer, such as its Windows version.
Note: Looked through folders on the test computer (most installers do this).
Note: Checked which security software was installed on the test computer.
Sandbox labels we could not confirm (common in safe files too)
Not confirmed: A sandbox rule tagged this run as code injection, but no injected program was recorded.
Not confirmed: A sandbox rule tagged this run as contacting a server, but no contacted host was recorded.
Not confirmed: A sandbox rule tagged this run as weakening security settings; no setting change was recorded.
Not confirmed: A sandbox rule tagged this run as changing how Windows loads code; nothing confirms it.
This file was run on a test computer (a sandbox), not on yours. Labels we could not confirm are listed so you can see them, but they are not treated as evidence against the file.
Threat context
How trojans work
A trojan pretends to be something useful or harmless so that you run it. Once open, it does its real job in the background, from stealing data to opening a back door or downloading more malware.
Bottom line:The disguise is the whole trick, so a trustworthy-looking name or icon means nothing.
Recorded behavior
What happened in the test
Grouped by step. The order is not a timeline.
- 1
Input file
The submitted object
- Evidence 1 of 5: FileSeen in the test run
ResetterEpson.L800.NesabaMedia.rar
5752576ca33125e31460cf6d8f9a7a10905d5b99b65c8bb493308e1fd6110cfa
Uploaded file
- 2
Processes
What ran
- Evidence 2 of 5: ProcessSeen in the test run
AdjProg.exe
"C:\Users\<USER>\AppData\Local\Temp\Epson.L800.NesabaMedia/AdjProg.exe"
Test run - Evidence 3 of 5: ProcessSeen in the test run
rundll32.exe
"C:\Windows\system32\rundll32.exe" "C:\Users\<USER>\AppData\Local\Temp\Epson.L800.NesabaMedia/apdadrv.dll",#1
Test run - +1 more recorded observation
- 2
Files
Created or changed
- Evidence 4 of 5: Written fileSeen in the test run
ZSRG_LOC_CHECK.DAT
C:\Adjustment Program\Epson L800\BRS\ZSRG_LOC_CHECK.DAT
Test run - Evidence 5 of 5: Written fileSeen in the test run
ZSRG_LOC_CORRECT.DAT
C:\Adjustment Program\Epson L800\BRS\ZSRG_LOC_CORRECT.DAT
Test run - +1 more recorded observation
5 facts from the test run. See the full activity list.
What this file did when executed
This file was run in a sandbox and its runtime behaviour was observed.
Techniques observed in the sandbox
12MITRE ATT&CK techniques the sandbox mapped. Highlighted ones are rare in normal software; the others are common in legitimate programs too.
- T1010
- T1012
- T1047
- T1055· Process injection
- T1057· Lists programs
- T1071· Application protocol
- T1082· System recon
- T1083· Scans your files
- T1497· Sandbox evasion
- T1518.001· Checks your AV
- T1562.001· Disables security
- T1574.002· Execution hijack
Observed activity
Processes started
9Programs the file ran, with their command lines.
AdjProg.exe"C:\Users\<USER>\AppData\Local\Temp\Epson.L800.NesabaMedia/AdjProg.exe"rundll32.exe"C:\Windows\system32\rundll32.exe" "C:\Users\<USER>\AppData\Local\Temp\Epson.L800.NesabaMedia/apdadrv.dll",#1rundll32.exe"C:\Windows\system32\rundll32.exe" "C:\Users\<USER>\AppData\Local\Temp\Epson.L800.NesabaMedia/APIDI0.dll",#1rundll32.exe"C:\Windows\system32\rundll32.exe" "C:\Users\<USER>\AppData\Local\Temp\Epson.L800.NesabaMedia/DataServiceLapper.dll",#1rundll32.exe"C:\Windows\system32\rundll32.exe" "C:\Users\<USER>\AppData\Local\Temp\Epson.L800.NesabaMedia/StrGene.dll",#1unarchiver.exe"C:\Windows\SysWOW64\unarchiver.exe" "C:\Users\user\Desktop\ResetterEpson.L800.NesabaMedia.rar"
Show all 9 entries for processes started
7za.exeC:\Windows\SysWOW64\7za.exe "C:\Windows\System32\7za.exe" x -pinfected -y -o"C:\Users\user\AppData\Local\Temp\mveiu3bc.iym" "C:\Users\user\Desktop\ResetterEpson.L800.NesabaMedia.rar"cmd.exeC:\Windows\SysWOW64\cmd.exe "cmd.exe" /C "C:\Users\user\AppData\Local\Temp\mveiu3bc.iym\Epson.L800.NesabaMedia\AdjProg.exe"AdjProg.exeC:\Users\user\AppData\Local\Temp\mveiu3bc.iym\Epson.L800.NesabaMedia\AdjProg.exe
Files
21Files the file created, changed or deleted.
- Written
C:\Adjustment Program\Epson L800\BRS\ZSRG_LOC_CHECK.DAT - Written
C:\Adjustment Program\Epson L800\BRS\ZSRG_LOC_CORRECT.DAT - Written
C:\Adjustment Program\Epson L800\BRS\ZeroCheck_D.def - Written
C:\Adjustment Program\Epson L800\BRS\ZeroCheck_P.def - Written
C:\Adjustment Program\Epson L800\BRS\ZeroGetID_ASP.def - Written
C:\Adjustment Program\Epson L800\BRS\ZeroGetID_D.def
Show all 21 entries for files
- Written
C:\Adjustment Program\Epson L800\BRS\ZeroGetID_P.def - Written
C:\Adjustment Program\Epson L800\BRS\ZeroTest_D.def - Written
C:\Adjustment Program\Epson L800\BRS\ZeroTest_P.def - Written
C:\Adjustment Program\Epson L800\BRS\LFBMP12N.DLL - Written
C:\Adjustment Program\Epson L800\BRS\LFCMP12n.DLL - Written
C:\Adjustment Program\Epson L800\BRS\LFFAX12N.DLL - Written
C:\Adjustment Program\Epson L800\BRS\LFLMB12N.DLL - Written
C:\Adjustment Program\Epson L800\BRS\LFPCX12N.DLL - Written
C:\Adjustment Program\Epson L800\BRS\LFTIF12N.DLL - Deleted
C:\ProgramData\Microsoft\Windows\WER\Temp\WERD82F.tmp - Deleted
C:\ProgramData\Microsoft\Windows\WER\Temp\WERDC18.tmp - Deleted
C:\ProgramData\Microsoft\Windows\WER\Temp\WERDE2D.tmp - Deleted
C:\ProgramData\Microsoft\Windows\WER\Temp\WERD82F.tmp.dmp - Deleted
C:\ProgramData\Microsoft\Windows\WER\Temp\WERDC18.tmp.WERInternalMetadata.xml - Deleted
C:\ProgramData\Microsoft\Windows\WER\Temp\WERDE2D.tmp.xml
Mutexes
3Named locks a program uses so only one copy runs; malware families often reuse them.
Local\WERReportingForProcess5340Global\AmiProviderMutex_InventoryApplicationFileGlobal\2eb05a57-8932-4bde-bc10-fe53cec91114
Sandbox background — not the file
2The analysis machine's own processes and connections, recorded in every run.
- VM process
WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 5340 -s 684 - VM process
conhost.exeC:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Files this sample writes at runtime
This file drops 10 children at runtime. None are currently flagged malicious in our cache. 10 have no saved verdict and were not checked; that is missing coverage, not a finding.
- 057336ef31abf2573e42…9ed022Not checkedno saved verdict
- 75098d55c8435b4fa332…48a567Not checkedno saved verdict
- 6d468ed2ef32d8f7486d…0344c7Not checkedno saved verdict
- 5f0e69859996a538863e…a31e64Not checkedno saved verdict
- d9461c3292a2283eadc7…6f3893Not checkedno saved verdict
- 54a7e1d1bdf0f265c69e…9e95acNot checkedno saved verdict
- b50d32c94df4edb3c2d1…dc532cNot checkedno saved verdict
- e3472eced8e369969f96…28950bNot checkedno saved verdict
- a22c91e80c2f66326021…0e7a55Not checkedno saved verdict
- ae44cb51306b285c69d9…3abce2Not checkedno saved verdict
Chapter 04
Technical details
16 of the 62 antivirus engines that checked it flag it.
Sources checked
Every check behind this verdict
6 sources checked · 5 complete · 1 not needed or not applicable. Complete means the check returned a usable result; it does not mean the file is safe.
Engines that flagged it 16
- ESET-NOD32 (major engine)Win32/AdjProg.A potentially unsafe
- Fortinet (major engine)Riskware/Adjprog
- Ikarus (major engine)PUA.AdjProg
- Sophos (major engine)Generic Reputation PUA (PUA)
- Antiy-AVLTrojan/Win32.Generic
- CAT-QuickHealTrojan.Ghanarava.1743155637be79f1
- CTXrar.trojan.adjprog
- DeepInstinctMALICIOUS
File fingerprint
- Last analyzed
- Sep 1, 2026, 8:32 PM UTC
- SHA-256
5752576ca33125e31460cf6d8f9a7a10905d5b99b65c8bb493308e1fd6110cfa- SHA-1
92a80ccd4a4fd309f9eec6ae7615a6a6f3871d17- MD5
974f7e4976fbeb0df9cec4b543d55119
About this file
ResetterEpson.L800.NesabaMedia.rar is an RAR file of 1.2 MB.
- Type and size
- RAR · 1.2 MB
- Signer
- Not applicable
- First seen
- Feb 8, 2023On VirusTotal.
- Submitted by
- 4 distinct sourcesRarely seen: few people have submitted this exact file.
First scanned
Antivirus consensus
16 of 62 engines flagged this file
14 of the 76 engines returned no result for this file (file type not supported, or the scan did not finish), so they did not check it.
- Tier-118 engines4flagged
- Tier-232 engines8flagged
- Low-trust12 engines4flagged
View all 76 engine results
- Antiy-AVLMalicious: Trojan/Win32.Generic
- CAT-QuickHealMalicious: Trojan.Ghanarava.1743155637be79f1
- CTXMalicious: rar.trojan.adjprog
- DeepInstinctMalicious: MALICIOUS
- ESET-NOD32Malicious: Win32/AdjProg.A potentially unsafe
- FortinetMalicious: Riskware/Adjprog
- GoogleMalicious: Detected
- GridinsoftMalicious: Trojan.Win32.Downloader.sa
- IkarusMalicious: PUA.AdjProg
- LionicMalicious: Trojan.Win32.AdjProg.4!c
- MaxSecureMalicious: Trojan.Malware.300983.susgen
- RisingMalicious: PUA.AdjProg!8.1407C (CLOUD)
- SophosMalicious: Generic Reputation PUA (PUA)
- VaristMalicious: W32/ABRisk.NQEQ-1724
- VBA32Malicious: BScope.Trojan.Downloader
- YandexMalicious: Trojan.Igent.b3rDVt.1
- AcronisClean
- AhnLab-V3Clean
- AlibabaNo result
- alibabacloudClean
- ALYacClean
- APEXNo result
- ArcabitClean
- AvastClean
- Avast-MobileNo result
- AVGClean
- AviraClean
- BaiduClean
- BitDefenderClean
- BitDefenderFalxNo result
- BkavClean
- ClamAVNo result
- CMCClean
- CrowdStrikeClean
- CylanceNo result
- CynetClean
- DrWebClean
- ElasticNo result
- EmsisoftClean
- F-SecureClean
- GDataClean
- huorongClean
- JiangminClean
- K7AntiVirusClean
- K7GWClean
- KasperskyClean
- KingsoftClean
- MalwarebytesClean
- McAfeeClean
- McAfeeDNo result
- MicrosoftClean
- MicroWorld-eScanClean
- NANO-AntivirusClean
- PaloaltoNo result
- PandaClean
- SangforClean
- SentinelOneClean
- SkyhighNo result
- SUPERAntiSpywareClean
- SymantecClean
- SymantecMobileInsightNo result
- TACHYONClean
- tehtrisNo result
- TencentClean
- TrapmineNo result
- TrendMicroClean
- TrendMicro-HouseCallClean
- TrustlookNo result
- VIPREClean
- VirITClean
- ViRobotClean
- WebrootClean
- XcitiumClean
- ZillyaClean
- ZoneAlarmClean
- ZonerClean
Signatures and behavior heuristics
Low-severity pattern matches — worth noting but not on their own cause for alarm.
VirusTotal's sandbox summary maps this run to MITRE T1055 (Process Injection), but no injected process of the sample's own was recorded (the analysis VM's own WMI adapter, crash handlers and Chrome updater are not counted). VirusTotal maps T1055 on about half of all files no engine flags, so the mapping alone is not evidence of injection.
EvidenceT1055 (sandbox MITRE mapping)
How widely this file has been seen
Moderate prevalence — neither rare nor common. No strong prior applies.
Chapter 05
Questions & answers
Short answers to the 8 questions people ask most about this file.
Is ResetterEpson.L800.NesabaMedia.rar a virus?
What is ResetterEpson.L800.NesabaMedia.rar?
How many antivirus engines detected ResetterEpson.L800.NesabaMedia.rar?
What should I do if I already opened or extracted ResetterEpson.L800.NesabaMedia.rar?
How do I remove ResetterEpson.L800.NesabaMedia.rar?
What kind of malware is ResetterEpson.L800.NesabaMedia.rar?
What is the SHA-256 hash of ResetterEpson.L800.NesabaMedia.rar?
How up to date is this analysis of ResetterEpson.L800.NesabaMedia.rar?
Community
Member reviews and reports for this exact file hash.