File scan report
Verdict Safe
Is DS4
Only 2 of the 67 antivirus engines that checked it flagged this archive, both less reliable, while observations from the test run, host checks, and inspected files it created…
Read the whole reasonShow less
Moderate evidence · No engine flags it, but no publisher signature confirms who made it.
Good practice2 tips
We found nothing harmful in this file.
Open it only if you trust the person or website you got it from.
Keep your security software and system updates switched on.
No scanner can promise a file is 100% safe.
Antivirus results
2 of 67 flagged
- Flagged 2
- No detection 65
- No result 8
- Code signing Not applicable
- Test run Completed
- First seen 8d ago
Chapter 02
Why we think so
3 points against it and 5 in its favour, checked against the scan evidence.
The reasoning behind this verdict
The two generic Trojan detections come exclusively from less reliable engines; none of the higher-trust engines flagged the archive. Completed observations from the test run found no malicious sandbox result or named injection target, and the comprehensive check of observed contacts found no malicious or suspicious host.
Two of the 67 antivirus engines that checked it flagged the archive, and both detections came from less reliable scanners using generic Trojan labels. None of the higher-trust engines supplied supporting detections or a named malware family. The sandbox runs produced no malicious result, and the mapping had no named injection target, so it does not demonstrate process injection. All four observed domain and IP contacts were covered by the reputation check, which found no malicious or suspicious host; the domains were also identified as analysis-environment background traffic. No malicious child, malware-specific community rule, or public sample-database listing corroborated the detections. Because the archive is and rare, obtaining it from the project's verified release channel remains prudent.
What We Detected
Only 2 of the 67 antivirus engines that checked it flagged the archive: MaxSecure and VBA32. Both are less reliable detections with generic Trojan wording, while none of the higher-trust engines identified malware or agreed on a real family.
Threat Behavior
The completed sandbox runs produced no malicious result. A T1055 mapping appeared without any named process receiving injected code, so it does not establish process injection. The host-reputation check covered all four observed domain and IP contacts and found none malicious or suspicious; the two domains were attributed to analysis-environment background activity. No malicious file it created or persistence indicator was recorded.
What To Do Now
The evidence strongly favors false-positive detections. Because this exact archive is and has little prevalence, download a fresh copy from the project's verified release channel and keep security software enabled when extracting and running it.
Where this verdict could be wrong3 caveats
- The archive was first observed on the analysis date and had only one submitter, so it lacks established prevalence.
- MaxSecure and VBA32 applied generic Trojan labels, although neither detection is supported by a higher-trust engine.
- Direct traffic to two IP addresses was recorded, but the complete host-reputation check found neither address malicious or suspicious.
These are the assessment's weak points. If you believe one applies to your file, report the verdict and we'll re-review it.
- None of the higher-trust antivirus engines flagged the archive.
- Completed observations from the test run produced no malicious sandbox result and no named injection target.
- The complete reputation check of all observed contacts found no malicious or suspicious host.
- No inspected child was malicious; three matched known-software reference records.
- No malware-specific rule or public malware-sample listing matched the hash.
- The exact archive is and has only one recorded submitter.
- MaxSecure and VBA32 applied generic Trojan detections.
- The sandbox summary recorded direct-IP traffic, although the covered addresses had no malicious or suspicious reputation.
6 sources checked · all complete. See every source
Chapter 03
What it did in our test
It ran in 3 isolated tests; no test environment rated what it did as risky.
Test run summary
Capture complete- 3isolated sandbox runs
- 13sandbox rule tags
- 15spawned processes
- 2network contacts
- 15filesystem & mutex artifacts
What this file did when executed
This file was detonated in 3 sandboxes and its runtime behaviour was observed.
Sandbox verdicts
1- VT: CLEANclean
Techniques observed in the sandbox
13MITRE ATT&CK techniques the sandbox mapped. Highlighted ones are rare in normal software; the others are common in legitimate programs too.
- T1027· Obfuscated code
- T1033· Reads user info
- T1055· Process injection
- T1057· Lists programs
- T1059· Runs commands
- T1064
- T1071· Application protocol
- T1082· System recon
- T1106
- T1129· Loads modules
- T1497· Sandbox evasion
- T1562· Disables security
- T1574· Execution hijack
Observed activity
Processes started
15Programs the file ran, with their command lines.
rundll32.exe"C:\Windows\system32\rundll32.exe" "C:\Users\<USER>\AppData\Local\Temp\DS4Windows/Lang/zh-CN/Microsoft.Win32.TaskScheduler.resources.dll",#1rundll32.exe"C:\Windows\system32\rundll32.exe" "C:\Users\<USER>\AppData\Local\Temp\DS4Windows/Lang/zh-Hans/DS4Windows.resources.dll",#1rundll32.exe"C:\Windows\system32\rundll32.exe" "C:\Users\<USER>\AppData\Local\Temp\DS4Windows/Lang/zh-Hant/DS4Windows.resources.dll",#1rundll32.exe"C:\Windows\system32\rundll32.exe" "C:\Users\<USER>\AppData\Local\Temp\DS4Windows/Lang/zh-Hant/Microsoft.Win32.TaskScheduler.resources.dll",#1rundll32.exe"C:\Windows\system32\rundll32.exe" "C:\Users\<USER>\AppData\Local\Temp\DS4Windows/MdXaml.dll",#1rundll32.exe"C:\Windows\system32\rundll32.exe" "C:\Users\<USER>\AppData\Local\Temp\DS4Windows/MdXaml.Plugins.dll",#1
Show all 15 entries for processes started
rundll32.exe"C:\Windows\system32\rundll32.exe" "C:\Users\<USER>\AppData\Local\Temp\DS4Windows/Microsoft.Win32.TaskScheduler.dll",#1rundll32.exe"C:\Windows\system32\rundll32.exe" "C:\Users\<USER>\AppData\Local\Temp\DS4Windows/Nefarius.ViGEm.Client.dll",#1rundll32.exe"C:\Windows\system32\rundll32.exe" "C:\Users\<USER>\AppData\Local\Temp\DS4Windows/NLog.dll",#1rundll32.exe"C:\Windows\system32\rundll32.exe" "C:\Users\<USER>\AppData\Local\Temp\DS4Windows/Ookii.Dialogs.Wpf.dll",#1rundll32.exe"C:\Windows\system32\rundll32.exe" "C:\Users\<USER>\AppData\Local\Temp\DS4Windows/runtimes/win/lib/net7.0/System.Management.dll",#1rundll32.exe"C:\Windows\system32\rundll32.exe" "C:\Users\<USER>\AppData\Local\Temp\DS4Windows/SharpOSC.dll",#1rundll32.exe"C:\Windows\system32\rundll32.exe" "C:\Users\<USER>\AppData\Local\Temp\DS4Windows/System.Management.dll",#1rundll32.exe"C:\Windows\system32\rundll32.exe" "C:\Users\<USER>\AppData\Local\Temp\DS4Windows/WPFLocalizeExtension.dll",#1rundll32.exe"C:\Windows\system32\rundll32.exe" "C:\Users\<USER>\AppData\Local\Temp\DS4Windows/WpfScreenHelper.dll",#1
Network contacts
22 hosts, listed as 2 addresses. Links show the host and path only.
- IP address
150.171.109.116 - IP address
150.171.74.13
Files
15Files the file created, changed or deleted.
- Written
C:\ProgramData\Microsoft\Windows\WER\Temp - Written
C:\ProgramData\Microsoft\Windows\WER\Temp\4dea0cf8-38e1-4ebc-be14-dfa7e1d57d67 - Written
C:\ProgramData\Microsoft\Windows\WER\ReportQueue - Written
C:\ProgramData\Microsoft\Windows\WER\Temp\8a6a006d-f39c-4999-8391-540d05596302 - Written
C:\ProgramData\Microsoft\Windows\WER\ReportArchive - Written
C:\ProgramData\Microsoft\Windows\WER\Temp\822cb3dc-9c25-4153-8672-320c60a995c1
Show all 15 entries for files
- Written
C:\ProgramData\Microsoft\Windows\WER\Temp\5f4c5aab-32ce-48f5-be9b-6f2142bb8b49 - Written
C:\Users\user\AppData\Local\Temp\ffrbd44q.zsc - Written
C:\Users\user\AppData\Local\Temp\ffrbd44q.zsc\DS4Windows - Written
C:\Users\user\AppData\Local\Temp\ffrbd44q.zsc\DS4Windows\BezierCurveEditor - Written
C:\Users\user\AppData\Local\Temp\ffrbd44q.zsc\DS4Windows\BezierCurveEditor\build.js - Written
C:\Users\user\AppData\Local\Temp\ffrbd44q.zsc\DS4Windows\BezierCurveEditor\index.html - Written
C:\Users\user\AppData\Local\Temp\ffrbd44q.zsc\DS4Windows\DS4Windows.deps.json - Written
C:\Users\user\AppData\Local\Temp\ffrbd44q.zsc\DS4Windows\DS4Windows.dll - Written
C:\Users\user\AppData\Local\Temp\ffrbd44q.zsc\DS4Windows\DS4Windows.exe
Sandbox background — not the file
2The analysis machine's own processes and connections, recorded in every run.
- VM host
edge-mobile-static.azureedge.net - VM host
business.bing.com
Files this sample writes at runtime
This file drops 10 children at runtime. None are currently flagged malicious in our cache. 7 have no saved verdict and were not checked; that is missing coverage, not a finding.
- 3c44a7a65310bdee9be9…9d797bNot checkedno saved verdict
- 0b849a11ae23e36d70a0…aa2da8Cleantrust 85known-software reference set · not scanned here
- 65bf44ba535e1efd5ba3…19f73dCleantrust 85known-software reference set · not scanned here
- b5e5c1ed3a7ef03a22d7…b77942Not checkedno saved verdict
- a99e488f71aea6bc212d…b46ae9Not checkedno saved verdict
- 5575fa3fdeeedcdce87b…8a0621Not checkedno saved verdict
- fce907cf01187e1ca0af…d71348Cleantrust 85known-software reference set · not scanned here
- 385be3a87d90a064c1f2…bbea22Not checkedno saved verdict
- 7e3d67a3e6b4ef2aba03…7d1a50Not checkedno saved verdict
- 588e8c0f4eb24788073f…560a6dNot checkedno saved verdict
Chapter 04
Technical details
2 of the 67 antivirus engines that checked it flag it.
Sources checked
Every check behind this verdict
6 sources checked · all complete. Complete means the check returned a usable result; it does not mean the file is safe.
Engines that flagged it 2
The saved verdict treats these detections as likely false positives.
- MaxSecureTrojan.Malware.300983.susgen
- VBA32TScope.Trojan.MSIL
File fingerprint
- Last analyzed
- Oct 18, 2026, 6:36 PM UTC
- SHA-256
9e7d5fd265e73b6de78a74564d33987fbd88ee2ea2665b5447b8a9baf6ec809b- SHA-1
81c2c06bbd5146411839ef2bd1eaff106b2f115d- MD5
02f5097de90d23fdb4976a5360b7df89
About this file
DS4Windows.zip is a ZIP file of 4.3 MB.
- Type and size
- ZIP · 4.3 MB
- Signer
- Not applicable
- First seen
- Oct 18, 2026On VirusTotal.
- Submitted by
- 1 sourceRarely seen: few people have submitted this exact file.
First scanned
Antivirus consensus
2 of 67 engines flagged this file
8 of the 75 engines returned no result for this file (file type not supported, or the scan did not finish), so they did not check it.
- Tier-118 engines0flagged
- Tier-236 engines0flagged
- Low-trust13 engines2flagged
View all 75 engine results
- MaxSecureMalicious: Trojan.Malware.300983.susgen
- VBA32Malicious: TScope.Trojan.MSIL
- AcronisClean
- AhnLab-V3Clean
- AlibabaClean
- alibabacloudClean
- ALYacClean
- Antiy-AVLClean
- APEXNo result
- ArcabitClean
- AvastClean
- Avast-MobileClean
- AVGClean
- AviraClean
- BitDefenderClean
- BitDefenderFalxNo result
- BkavClean
- CAT-QuickHealClean
- ClamAVClean
- CMCClean
- CrowdStrikeClean
- CTXClean
- CylanceNo result
- CynetClean
- DeepInstinctClean
- DrWebClean
- ElasticClean
- EmsisoftClean
- ESET-NOD32Clean
- F-SecureClean
- FortinetClean
- GDataClean
- GoogleClean
- GridinsoftClean
- huorongClean
- IkarusClean
- JiangminClean
- K7AntiVirusClean
- K7GWClean
- KasperskyClean
- KingsoftClean
- LionicClean
- MalwarebytesClean
- McAfeeDClean
- MicrosoftClean
- MicroWorld-eScanClean
- NANO-AntivirusClean
- PaloaltoNo result
- PandaClean
- RisingClean
- SangforClean
- SentinelOneClean
- SkyhighClean
- SophosClean
- SUPERAntiSpywareClean
- SymantecClean
- SymantecMobileInsightNo result
- TACHYONClean
- tehtrisNo result
- TencentClean
- TrapmineNo result
- TrellixENSClean
- TrendMicroClean
- TrendMicro-HouseCallClean
- TrustlookNo result
- VaristClean
- VIPREClean
- VirITClean
- ViRobotClean
- WebrootClean
- XcitiumClean
- YandexClean
- ZillyaClean
- ZoneAlarmClean
- ZonerClean
Signatures and behavior heuristics
Low-severity pattern matches — worth noting but not on their own cause for alarm.
VirusTotal's sandbox summary maps this run to MITRE T1055 (Process Injection), but no injected process of the sample's own was recorded (the analysis VM's own WMI adapter, crash handlers and Chrome updater are not counted). VirusTotal maps T1055 on about half of all files no engine flags, so the mapping alone is not evidence of injection.
EvidenceT1055 (sandbox MITRE mapping)
How widely this file has been seen
Barely seen in the wild and first surfaced recently. 2 antivirus detections make that low prevalence materially relevant, but rarity alone is not proof of malware.
Chapter 05
Questions & answers
Short answers to the 6 questions people ask most about this file.
Is DS4Windows.zip safe?
What is DS4Windows.zip?
How many antivirus engines detected DS4Windows.zip?
What is the SHA-256 hash of DS4Windows.zip?
Is it safe to open or extract DS4Windows.zip?
How up to date is this analysis of DS4Windows.zip?
Community
Member reviews and reports for this exact file hash.