File scan report
Verdict Safe
Is dimmer_
Zero detections across 73 engines, long-established prevalence, and no malicious files it created or host contacts.
Read the whole reasonShow less
Strong evidence · Widely seen for a long time, and nothing harmful found.
The file shows no malicious indicators from engines or external sources; retain normal security settings and treat as safe.
Good practice2 tips
We found nothing harmful in this file.
Open it only if you trust the person or website you got it from.
Keep your security software and system updates switched on.
No scanner can promise a file is 100% safe.
Reads the latest antivirus results for this file's hash. Nothing is uploaded.
Antivirus results
0 of 66 flagged
- Flagged 0
- No detection 66
- No result 7
- Code signing Not applicable
- Test run Completed
- First seen 3y ago
Chapter 02
Why we think so
0 points against it and 4 in its favour, checked against the scan evidence.
The reasoning behind this verdict
All 66 antivirus engines that checked it returned clean results. The file is common and old with thousands of prior submissions.
The complete absence of malicious detections from every major and smaller engine outweighs the sandbox heuristics. Prevalence data shows the file has circulated for nearly four years without incident. No file it created or contacted host carries a malicious verdict. The two triggered rules map observed behaviour to offensive techniques, yet lack corroboration from any engine or external intelligence source.
What We Detected
73 engines scanned the ZIP; none flagged it malicious or suspicious. Sandbox execution produced MITRE mappings T1055 and T1562.001 plus access to the Windows password store, but returned no malicious verdict and no malicious files it created.
Threat Behavior
The observed process activity is consistent with the rules, yet the file has been submitted 3729 times over 1372 days with zero engine detections and no external-intel hits.
What To Do Now
Keep security software enabled. The file can be treated as benign based on current evidence, but monitor any new submissions or behaviour changes.
- 0/66 engines flagged the sample
- widely seen and long established prevalence with thousands of prior submissions
- no malicious files it created
- no external intelligence hits
6 sources checked · 5 complete · 1 not needed or not applicable. See every source
Chapter 03
What it did in our test
It ran in our isolated test environment; no test environment rated what it did as risky.
Test run summary
Capture complete- 8sandbox rule tags
- 8spawned processes
- 0network contacts
- 20filesystem & mutex artifacts
What this file did when executed
This file was run in a sandbox and its runtime behaviour was observed.
Techniques observed in the sandbox
8MITRE ATT&CK techniques the sandbox mapped. Highlighted ones are rare in normal software; the others are common in legitimate programs too.
- T1010
- T1055· Process injection
- T1070.006· Covers its tracks
- T1082· System recon
- T1083· Scans your files
- T1106
- T1497· Sandbox evasion
- T1562.001· Disables security
Observed activity
Processes started
8Programs the file ran, with their command lines.
Dimmer.exe"C:\Users\<USER>\AppData\Local\Temp\Dimmer.exe"unarchiver.exeC:\Windows\SysWOW64\unarchiver.exe" "C:\Users\user\Desktop\download.zip7za.exeC:\Windows\SysWOW64\7za.exe C:\Windows\System32\7za.exe" x -pinfected -y -o"C:\Users\user\AppData\Local\Temp\04x5hw5i.xla" "C:\Users\user\Desktop\download.zipcmd.exeC:\Windows\SysWOW64\cmd.exe cmd.exe" /C "C:\Users\user\AppData\Local\Temp\04x5hw5i.xla\Dimmer.exeDimmer.exeC:\Users\user\AppData\Local\Temp\04x5hw5i.xla\Dimmer.exeunarchiver.exeC:\Windows\SysWOW64\unarchiver.exe "C:\Windows\SysWow64\unarchiver.exe" "C:\Users\user\Desktop\sample.zip"
Show all 8 entries for processes started
7za.exeC:\Windows\SysWOW64\7za.exe "C:\Windows\System32\7za.exe" x -pinfected -y -o"C:\Users\user\AppData\Local\Temp\lse3vprh.4d3" "C:\Users\user\Desktop\sample.zip"cmd.exeC:\Windows\SysWOW64\cmd.exe "cmd.exe" /C "C:\Users\user\AppData\Local\Temp\lse3vprh.4d3\Dimmer.exe"
Files
15Files the file created, changed or deleted.
- Written
C:\Users\<USER>\AppData\Local\Temp\Dimmer.ini - Written
C:\Windows\ServiceProfiles\LocalService\AppData\Local\FontCache\Fonts\Download-1.tmp - Written
C:\Users\<USER>\Downloads\Dimmer.ini - Written
C:\Windows\System32\Tasks\Microsoft\Windows\Application Experience\Microsoft Compatibility Appraiser - Written
C:\Users\user\AppData\Local\Temp\04x5hw5i.xla - Written
C:\Users\user\AppData\Local\Temp\04x5hw5i.xla\Dimmer.exe
Show all 15 entries for files
- Written
C:\Users\user\AppData\Local\Temp\04x5hw5i.xla\Dimmer.ini - Written
C:\Users\user\AppData\Local\Temp\04x5hw5i.xla\Readme.txt - Written
C:\Users\user\AppData\Local\Temp\04x5hw5i.xla\Whatsnew.txt - Written
C:\Users\user\AppData\Local\Temp\unarchiver.log - Written
C:\Users\user\AppData\Roaming - Written
\Device\ConDrv\\Connect - Written
C:\Users\user\AppData\Local\Temp\lse3vprh.4d3 - Written
C:\Users\user\AppData\Local\Temp\lse3vprh.4d3\Dimmer.exe - Written
C:\Users\user\AppData\Local\Temp\lse3vprh.4d3\Dimmer.ini
Mutexes
5Named locks a program uses so only one copy runs; malware families often reuse them.
DimmerLocal\__DDrawCheckExclMode__\Sessions\1\BaseNamedObjects\Dimmer\Sessions\1\BaseNamedObjects\Local\__DDrawExclMode__\Sessions\1\BaseNamedObjects\Local\__DDrawCheckExclMode__
Sandbox background — not the file
7The analysis machine's own processes and connections, recorded in every run.
- VM process
services.exeC:\Windows\system32\services.exe - VM process
svchost.exeC:\Windows\System32\svchost.exe -k NetworkService -p - VM process
svchost.exeC:\Windows\system32\svchost.exe -k UnistackSvcGroup - VM process
svchost.exeC:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted -p -s StorSvc - VM process
lsass.exeC:\Windows\system32\lsass.exe - VM process
svchost.exeC:\Windows\system32\svchost.exe -k LocalService -s W32Time
Show all 7 entries for sandbox background — not the file
- VM process
conhost.exeC:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Files this sample writes at runtime
This file drops 10 children at runtime. None are currently flagged malicious in our cache. 10 have no saved verdict and were not checked; that is missing coverage, not a finding.
- deef1f698aa1dcea70d7…7eacb5Not checkedno saved verdict
- 3251630556d4979d5126…07d504Not checkedno saved verdict
- 7e19b6d0ff27ae200ebb…d215c2Not checkedno saved verdict
- 39d5127d3a79ca48c9ed…404b83Not checkedno saved verdict
- 23c960bed0677e68962e…e401d7Not checkedno saved verdict
- b7ba91f84e9c9ba9b498…43e887Not checkedno saved verdict
- 42dba24c92021b8ee37d…757736Not checkedno saved verdict
- 6da58632c733da5f9fb4…b93b5cNot checkedno saved verdict
- c7a9a74533116e6c21d1…334f30Not checkedno saved verdict
- 974bfd7772adb82ad155…ca9613Not checkedno saved verdict
Chapter 04
Technical details
None of the 66 antivirus engines that checked it flag it.
Sources checked
Every check behind this verdict
6 sources checked · 5 complete · 1 not needed or not applicable. Complete means the check returned a usable result; it does not mean the file is safe.
File fingerprint
- Last analyzed
- Sep 3, 2026, 2:22 AM UTC
- SHA-256
93e88dc2781adaf0c3be9ebe4395d45c42ca96df5d433bdd6ecc8cd31a4187b9- SHA-1
41618398cebbf29a2b2178241b08ef4de7608250- MD5
8cf7e53b603a186ba4c0133f24045355
About this file
dimmer_v2.0.1.zip is a ZIP file of 56.7 kB.
- Type and size
- ZIP · 56.7 kB
- Signer
- Not applicable
- First seen
- Dec 1, 2022On VirusTotal.
- Submitted by
- 2,900 distinct sources
First scanned
Antivirus consensus
0 of 66 engines flagged this file
7 of the 73 engines returned no result for this file (file type not supported, or the scan did not finish), so they did not check it.
- Tier-117 engines0flagged
- Tier-236 engines0flagged
- Low-trust13 engines0flagged
View all 73 engine results
- AcronisClean
- AhnLab-V3Clean
- AlibabaClean
- alibabacloudClean
- ALYacClean
- Antiy-AVLClean
- APEXNo result
- ArcabitClean
- AvastClean
- Avast-MobileClean
- AVGClean
- AviraClean
- BitDefenderClean
- BitDefenderFalxNo result
- BkavClean
- CAT-QuickHealClean
- ClamAVClean
- CMCClean
- CrowdStrikeClean
- CTXClean
- CylanceNo result
- CynetClean
- DeepInstinctClean
- DrWebClean
- ElasticClean
- EmsisoftClean
- ESET-NOD32Clean
- F-SecureClean
- FortinetClean
- GDataClean
- GridinsoftClean
- huorongClean
- JiangminClean
- K7AntiVirusClean
- K7GWClean
- KasperskyClean
- KingsoftClean
- LionicClean
- MalwarebytesClean
- MaxSecureClean
- McAfeeDClean
- MicrosoftClean
- MicroWorld-eScanClean
- NANO-AntivirusClean
- PaloaltoNo result
- PandaClean
- RisingClean
- SangforClean
- SentinelOneClean
- SkyhighClean
- SophosClean
- SUPERAntiSpywareClean
- SymantecClean
- SymantecMobileInsightNo result
- TACHYONClean
- tehtrisNo result
- TencentClean
- TrapmineNo result
- TrellixENSClean
- TrendMicroClean
- TrendMicro-HouseCallClean
- TrustlookClean
- VaristClean
- VBA32Clean
- VIPREClean
- VirITClean
- ViRobotClean
- WebrootClean
- XcitiumClean
- YandexClean
- ZillyaClean
- ZoneAlarmClean
- ZonerClean
Signatures and behavior heuristics
Low-severity pattern matches — worth noting but not on their own cause for alarm.
VirusTotal's sandbox summary maps this run to MITRE T1055 (Process Injection), but no injected process of the sample's own was recorded (the analysis VM's own WMI adapter, crash handlers and Chrome updater are not counted). VirusTotal maps T1055 on about half of all files no engine flags, so the mapping alone is not evidence of injection.
EvidenceT1055 (sandbox MITRE mapping)
How widely this file has been seen
Widely seen in the wild for a long time. High prior this is legitimate; isolated detections on common-old files are usually false positives.
Chapter 05
Questions & answers
Short answers to the 6 questions people ask most about this file.
Is dimmer_v2.0.1.zip safe?
What is dimmer_v2.0.1.zip?
How many antivirus engines detected dimmer_v2.0.1.zip?
What is the SHA-256 hash of dimmer_v2.0.1.zip?
Is it safe to open or extract dimmer_v2.0.1.zip?
How up to date is this analysis of dimmer_v2.0.1.zip?
Community
Member reviews and reports for this exact file hash.