File scan report
Verdict Safe
Is myr-
A lone generic DeepInstinct detection is outweighed by silent major antivirus engines, a clean sandbox outcome, and fully checked contacts with no threat-cache matches.
Read the whole reasonShow less
Moderate evidence · No engine flags it, but no publisher signature confirms who made it.
Good practice2 tips
We found nothing harmful in this file.
Open it only if you trust the person or website you got it from.
Keep your security software and system updates switched on.
No scanner can promise a file is 100% safe.
Antivirus results
1 of 68 flagged
- Flagged 1
- No detection 67
- No result 7
- Code signing Not applicable
- Test run Completed
- First seen 9d ago
Chapter 02
Why we think so
4 points against it and 4 in its favour, checked against the scan evidence.
The reasoning behind this verdict
Only 1 of the 68 antivirus engines that checked it flagged this archive, using a generic result, while none of the 17 major antivirus engines did. One sandbox completed without a malicious result, and all four observed network hosts were checked without threat-cache matches; however, the mapping and very limited prevalence justify normal caution.
The antivirus pattern is weak: DeepInstinct supplied the only detection among 75 engines, and it did not identify a malware family. None of the 17 major antivirus engines flagged the archive. The completed sandbox did not return a malicious outcome, although it mapped possible process injection to without recording an injected target or method. All two domains and two IP addresses observed during execution were covered by the host-reputation check, with no malicious or suspicious matches. Malware-specific research rules, a known malicious child, and family-level external corroboration were also absent. Because the archive is with only two submissions, confidence remains moderate rather than high.
What We Detected
DeepInstinct was the only engine among 75 to flag the archive, and its generic “MALICIOUS” result did not name a threat family. None of the 17 major antivirus engines flagged it, and no malware-specific research rule or known malware repository match corroborated the alert.
Threat Behavior
One sandbox run completed without a malicious outcome. It mapped possible process injection to MITRE T1055, but captured no injected process, target, or exact technique, so that mapping is not conclusive by itself. The host-reputation check covered both contacted domains and both contacted IP addresses; none matched the malicious or suspicious cache. Ten extracted children were inspected, but none has a saved child verdict, so they provide no affirmative evidence either way.
What To Do Now
The evidence favors a false positive, but the archive is and lacks established reputation. Obtain it only from the expected developer or distribution channel, keep security software enabled, and verify the archive hash before running the included installer.
Where this verdict could be wrong3 caveats
- DeepInstinct flagged the archive, and that smaller detection cannot be dismissed solely because the 17 major antivirus engines did not flag it.
- Evidence from the test run maps activity to T1055, but no injected process, target, or exact method was captured.
- The archive is and rare, so its limited history leaves more uncertainty than an established download would.
These are the assessment's weak points. If you believe one applies to your file, report the verdict and we'll re-review it.
- None of the 17 major antivirus engines flagged the archive.
- The completed sandbox run did not return a malicious outcome.
- All four observed network hosts were checked and had no malicious or suspicious cache matches.
- No malware-specific research rules or known malicious extracted child corroborated the lone alert.
- The archive is with only two submissions from one source.
- DeepInstinct produced one generic malicious detection.
- The sandbox mapped possible process injection behavior to MITRE T1055, although no target or method was identified.
- The ten extracted files do not yet have saved individual verdicts.
6 sources checked · all complete. See every source
Chapter 03
What it did in our test
It ran in our isolated test environment; no test environment rated what it did as risky.
Test run summary
Capture complete- 10sandbox rule tags
- 5spawned processes
- 2network contacts
- 15filesystem & mutex artifacts
What this file did when executed
This file was run in a sandbox and its runtime behaviour was observed.
Sandbox verdicts
1- VT: CLEANclean
Techniques observed in the sandbox
10MITRE ATT&CK techniques the sandbox mapped. Highlighted ones are rare in normal software; the others are common in legitimate programs too.
- T1033· Reads user info
- T1036
- T1055· Process injection
- T1070· Covers its tracks
- T1071· Application protocol
- T1082· System recon
- T1083· Scans your files
- T1129· Loads modules
- T1497· Sandbox evasion
- T1574· Execution hijack
Observed activity
Processes started
5Programs the file ran, with their command lines.
MYR-Installer-0.5.0.exe"C:\Users\<USER>\AppData\Local\Temp\MYR Plugins 0.5.0 Gￇ Windows/MYR-Installer-0.5.0.exe"MYR-Installer-0.5.0.tmp"C:\Users\<USER>\AppData\Local\Temp\is-DIZC2VES5L.tmp\MYR-Installer-0.5.0.tmp" /SL5="$4006A,5037095,893952,C:\Users\<USER>\AppData\Local\Temp\MYR Plugins 0.5.0 Gￇ Windows\MYR-Installer-0.5.0.exe"msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" "C:\Users\<USER>\AppData\Local\Temp\MYR Plugins 0.5.0 Gￇ Windows/Presets.html"unarchiver.exe"C:\Windows\System32\unarchiver.exe" "C:\Users\user\Desktop\myr-plugins-windows.zip"7za.exeC:\Windows\SysWOW64\7za.exe "C:\Windows\System32\7za.exe" x -pinfected -y -o"C:\Users\user\AppData\Local\Temp\cl2uy50t.fvi" "C:\Users\user\Desktop\myr-plugins-windows.zip"
Network contacts
22 hosts, listed as 2 addresses. Links show the host and path only.
- IP address
150.171.110.3 - IP address
150.171.73.13
Files
15Files the file created, changed or deleted.
- Written
C:\Users\<USER>\AppData\Local\Temp\is-DIZC2VES5L.tmp\MYR-Installer-0.5.0.tmp - Written
C:\ProgramData\Microsoft\Windows\WER\Temp - Written
C:\ProgramData\Microsoft\Windows\WER\Temp\4c3995bb-8c22-475c-b0bb-92260a7b778a - Written
C:\ProgramData\Microsoft\Windows\WER\ReportQueue - Written
C:\ProgramData\Microsoft\Windows\WER\Temp\4ddc6861-3044-440d-aed2-2dd945203495 - Written
C:\ProgramData\Microsoft\Windows\WER\ReportArchive
Show all 15 entries for files
- Written
C:\Windows\ServiceProfiles\LocalService\AppData\Local\FontCache\Fonts\Download-1.tmp - Written
C:\Users\user\AppData\Local\Temp\cl2uy50t.fvi - Written
C:\Users\user\AppData\Local\Temp\cl2uy50t.fvi\MYR Plugins 0.5.0 Windows - Written
C:\Users\user\AppData\Local\Temp\cl2uy50t.fvi\MYR Plugins 0.5.0 Windows\MYR Plugins Tutorial (Deutsch).pdf - Written
C:\Users\user\AppData\Local\Temp\cl2uy50t.fvi\MYR Plugins 0.5.0 Windows\MYR Plugins Tutorial (English).pdf - Written
C:\Users\user\AppData\Local\Temp\cl2uy50t.fvi\MYR Plugins 0.5.0 Windows\MYR-Installer-0.5.0.exe - Written
C:\Users\user\AppData\Local\Temp\cl2uy50t.fvi\MYR Plugins 0.5.0 Windows\Manuelle Installation - Written
C:\Users\user\AppData\Local\Temp\cl2uy50t.fvi\MYR Plugins 0.5.0 Windows\Manuelle Installation\MYR Prism.vst3 - Written
C:\Users\user\AppData\Local\Temp\cl2uy50t.fvi\MYR Plugins 0.5.0 Windows\Manuelle Installation\MYR Prism.vst3\Contents
Sandbox background — not the file
9The analysis machine's own processes and connections, recorded in every run.
- VM process
WerFault.exeC:\Windows\system32\WerFault.exe -u -p 5916 -s 3380 - VM process
services.exeC:\Windows\system32\services.exe - VM process
svchost.exeC:\Windows\System32\svchost.exe -k NetworkService -p - VM process
svchost.exeC:\Windows\system32\svchost.exe -k UnistackSvcGroup - VM process
svchost.exeC:\Windows\system32\svchost.exe -k LocalService -s W32Time - VM process
lsass.exeC:\Windows\system32\lsass.exe
Show all 9 entries for sandbox background — not the file
- VM process
conhost.exeC:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 - VM host
edge-mobile-static.azureedge.net - VM host
business.bing.com
Files this sample writes at runtime
This file drops 10 children at runtime. None are currently flagged malicious in our cache. 10 have no saved verdict and were not checked; that is missing coverage, not a finding.
- 5174c0b57f5daa0c257e…caa950Not checkedno saved verdict
- 7014ea64f2fdbe3dde0f…09180bNot checkedno saved verdict
- 7ac92a951c54a9fbdca6…7bfd61Not checkedno saved verdict
- 80a25d36e6c78261164c…aac1f9Not checkedno saved verdict
- 1edc62fd9798b5503dcd…c924f2Not checkedno saved verdict
- a18e6eb48528dc3248cf…a52f2eNot checkedno saved verdict
- 6399a43120f3f26bd85c…9bac0aNot checkedno saved verdict
- 04c67a653719b64855ff…ca90b2Not checkedno saved verdict
- 52a763ea65e5d1a26df3…4b5e79Not checkedno saved verdict
- 456e6a0a51377f5814c8…ebbc49Not checkedno saved verdict
Chapter 04
Technical details
1 of the 68 antivirus engines that checked it flags it.
Sources checked
Every check behind this verdict
6 sources checked · all complete. Complete means the check returned a usable result; it does not mean the file is safe.
Engines that flagged it 1
The saved verdict treats these detections as likely false positives.
- DeepInstinctMALICIOUS
File fingerprint
- Last analyzed
- Oct 17, 2026, 2:21 PM UTC
- SHA-256
780f9dd41ac172348cfaf6bc5209f0c7b7aa30890edf36cfbcb7bab3ca8bc757- SHA-1
b8830ef89e8a20a2d6460aa06f2edf341504af33- MD5
0f89bad3c49f146e0a1979a0e54431c0
About this file
myr-plugins-windows.zip is a ZIP file of 31.2 MB.
- Type and size
- ZIP · 31.2 MB
- Signer
- Not applicable
- First seen
- Oct 17, 2026On VirusTotal.
- Submitted by
- 1 sourceRarely seen: few people have submitted this exact file.
First scanned
Antivirus consensus
1 of 68 engines flagged this file
7 of the 75 engines returned no result for this file (file type not supported, or the scan did not finish), so they did not check it.
- Tier-118 engines0flagged
- Tier-237 engines1flagged
- Low-trust13 engines0flagged
View all 75 engine results
- DeepInstinctMalicious: MALICIOUS
- AcronisClean
- AhnLab-V3Clean
- AlibabaClean
- alibabacloudClean
- ALYacClean
- Antiy-AVLClean
- APEXNo result
- ArcabitClean
- AvastClean
- Avast-MobileClean
- AVGClean
- AviraClean
- BitDefenderClean
- BitDefenderFalxNo result
- BkavClean
- CAT-QuickHealClean
- ClamAVClean
- CMCClean
- CrowdStrikeClean
- CTXClean
- CylanceNo result
- CynetClean
- DrWebClean
- ElasticClean
- EmsisoftClean
- ESET-NOD32Clean
- F-SecureClean
- FortinetClean
- GDataClean
- GoogleClean
- GridinsoftClean
- huorongClean
- IkarusClean
- JiangminClean
- K7AntiVirusClean
- K7GWClean
- KasperskyClean
- KingsoftClean
- LionicClean
- MalwarebytesClean
- MaxSecureClean
- McAfeeDClean
- MicrosoftClean
- MicroWorld-eScanClean
- NANO-AntivirusClean
- PaloaltoNo result
- PandaClean
- RisingClean
- SangforClean
- SentinelOneClean
- SkyhighClean
- SophosClean
- SUPERAntiSpywareClean
- SymantecClean
- SymantecMobileInsightNo result
- TACHYONClean
- tehtrisNo result
- TencentClean
- TrapmineNo result
- TrellixENSClean
- TrendMicroClean
- TrendMicro-HouseCallClean
- TrustlookClean
- VaristClean
- VBA32Clean
- VIPREClean
- VirITClean
- ViRobotClean
- WebrootClean
- XcitiumClean
- YandexClean
- ZillyaClean
- ZoneAlarmClean
- ZonerClean
Signatures and behavior heuristics
Low-severity pattern matches — worth noting but not on their own cause for alarm.
VirusTotal's sandbox summary maps this run to MITRE T1055 (Process Injection), but no injected process of the sample's own was recorded (the analysis VM's own WMI adapter, crash handlers and Chrome updater are not counted). VirusTotal maps T1055 on about half of all files no engine flags, so the mapping alone is not evidence of injection.
EvidenceT1055 (sandbox MITRE mapping)
How widely this file has been seen
Barely seen in the wild and first surfaced recently. 1 antivirus detection make that low prevalence materially relevant, but rarity alone is not proof of malware.
Chapter 05
Questions & answers
Short answers to the 6 questions people ask most about this file.
Is myr-plugins-windows.zip safe?
What is myr-plugins-windows.zip?
How many antivirus engines detected myr-plugins-windows.zip?
What is the SHA-256 hash of myr-plugins-windows.zip?
Is it safe to open or extract myr-plugins-windows.zip?
How up to date is this analysis of myr-plugins-windows.zip?
Community
Member reviews and reports for this exact file hash.