File scan report
Verdict Safe
Is Mini
Zero engine detections, verified signature, and five prior safe import-table fingerprint matches outweigh the sandbox credential-access flags.
Read the whole reasonShow less
Strong evidence · A verified publisher signature, and no engine flags it.
The evidence supports treating the file as safe; install only from the vendor's official site and keep security software active.
Good practice2 tips
We found nothing harmful in this file.
Install it only if it came from the developer's own website or an official app store.
Keep your antivirus and Windows updates switched on.
No scanner can promise a file is 100% safe.
Reads the latest antivirus results for this file's hash. Nothing is uploaded.
Antivirus results
0 of 69 flagged
- Flagged 0
- No detection 69
- No result 6
- Code signing Joseph Lyncheski
- Test run Completed
- First seen 7mo ago
Chapter 02
Why we think so
0 points against it and 4 in its favour, checked against the scan evidence.
The reasoning behind this verdict
All 69 antivirus engines that checked it returned clean. The installer is signed and matches five previously safe import-table fingerprint samples.
The complete absence of malicious detections across 75 engines, including 17 major antivirus engines, is the strongest signal. The file is signed and the import-table fingerprint has five prior safe verdicts. Medium prevalence and installer filename patterns further support a benign classification.
What We Detected
Zero detections from 75 engines; file signed by Joseph Lyncheski.
Threat Behavior
no complete contacted-host reputation result was available, no malicious files it created, and no external-intel hits. The observed MITRE techniques are consistent with installer frameworks that spawn helper processes and register VST3 plug-ins.
What To Do Now
Keep Windows Defender and other security software enabled. The file can be installed if obtained from the official minimeters.app site; verify the download hash if possible.
- 0/69 engines flagged malicious
- Verified digital signature
- 5 prior safe import-table fingerprint matches
- Medium prevalence, installer filename
6 sources checked · 5 complete · 1 partial. See every source
Chapter 03
What it did in our test
It ran in our isolated test environment; no test environment rated what it did as risky.
Test run summary
Capture complete- 29sandbox rule tags
- 5spawned processes
- 7network contacts
- 30filesystem & mutex artifacts
What this file did when executed
This file was run in a sandbox and its runtime behaviour was observed.
Techniques observed in the sandbox
29MITRE ATT&CK techniques the sandbox mapped. Highlighted ones are rare in normal software; the others are common in legitimate programs too.
- T1003· Credential theft
- T1005
- T1010
- T1012
- T1027· Obfuscated code
- T1036
- T1055· Process injection
- T1059· Runs commands
- T1071· Application protocol
- T1082· System recon
- T1083· Scans your files
- T1112
- T1115
- T1125
- T1129· Loads modules
- T1134
- T1222
- T1485
- T1497· Sandbox evasion
- T1497.001· Sandbox evasion
- T1529
- T1539
- T1547.009· Auto-start
- T1548
- T1552· Credential search
- T1552.001· Credential search
- T1555· Password stealing
- T1555.003· Password stealing
- T1573
Observed activity
Processes started
5Programs the file ran, with their command lines.
MiniMeters v1.0.28.233 Installer.exe"C:\Users\<USER>\Desktop\MiniMeters v1.0.28.233 Installer.exe"MiniMeters.exe"C:\Program Files\MiniMeters\MiniMeters.exe"msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://minimeters.app/helpmsedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --flag-switches-begin --flag-switches-end --do-not-de-elevate --single-argument https://minimeters.app/helpmsedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --no-appcompat-clear --mojo-platform-channel-handle=6908 --field-trial-handle=2040,i,5591390846642144927,10720064033166477823,262144 --variations-seed-version /prefetch:8
Network contacts
77 hosts, listed as 6 addresses, 1 link. Links show the host and path only.
- IP address
143.198.25.84 - IP address
13.107.246.38 - IP address
198.51.233.1 - IP address
150.171.73.13 - IP address
13.107.213.38 - IP address
150.171.74.13
Show all 7 entries for network contacts
- URL
https://account.minimeters.app/api/version/MiniMeters
Files
27Files the file created, changed or deleted.
- Written
C:\Users\<USER>\AppData\Local\Temp\nspF146.tmp\modern-wizard.bmp - Written
C:\Users\<USER>\AppData\Local\Temp\nspF146.tmp\nsDialogs.dll - Written
C:\Users\<USER>\AppData\Local\Temp\nspF146.tmp\System.dll - Written
C:\Program Files\MiniMeters\MiniMeters.exe - Written
C:\Program Files\MiniMeters\UninstallMiniMeters.exe - Written
C:\ProgramData\Microsoft\Windows\Start Menu\Programs\MiniMeters.lnk
Show all 27 entries for files
- Written
C:\Users\<USER>\AppData\Roaming\MiniMetersSupplemental\NotoSansTC-Medium.ttf - Written
C:\Users\<USER>\AppData\Roaming\MiniMetersSupplemental\NotoSansJP-Medium.ttf - Written
C:\Program Files\Common Files\VST3\MiniMeters\MiniMeters - Audio-Server.vst3 - Written
C:\Program Files\Common Files\VST3\MiniMeters\MiniMeters - Loudness.vst3 - Written
C:\Program Files\Common Files\VST3\MiniMeters\MiniMeters - Oscilloscope.vst3 - Written
C:\Program Files\Common Files\VST3\MiniMeters\MiniMeters - Spectrogram.vst3 - Written
C:\Program Files\Common Files\VST3\MiniMeters\MiniMeters - Spectrum.vst3 - Written
C:\Program Files\Common Files\VST3\MiniMeters\MiniMeters - Stereometer.vst3 - Written
C:\Program Files\Common Files\VST3\MiniMeters\MiniMeters - VU.vst3 - Deleted
C:\Users\<USER>\AppData\Local\Temp\nspF146.tmp\modern-wizard.bmp - Deleted
C:\Users\<USER>\AppData\Local\Temp\nspF146.tmp\nsDialogs.dll - Deleted
C:\Users\<USER>\AppData\Local\Temp\nspF146.tmp\System.dll - Deleted
C:\Users\<USER>\AppData\Local\Temp\nspF146.tmp\ - Deleted
C:\Users\<USER>\AppData\Roaming\MiniMeters\Presets\Current Preset.mms - Deleted
C:\Users\<USER>\AppData\Roaming\MiniMeters\Presets\Current Preset_temp.mms - Deleted
C:\Users\<USER>\AppData\Roaming\MiniMeters\settings.mms - Deleted
C:\Users\<USER>\AppData\Roaming\MiniMeters\settings_temp.mms - Deleted
C:\Users\<USER>\AppData\Local\Temp\nszA903.tmp - Deleted
C:\Users\<USER>\AppData\Local\Temp\nszA9EE.tmp - Deleted
C:\Users\user\AppData\Local\Temp\nsfCCAC.tmp - Deleted
C:\Users\user\AppData\Local\Temp\nsy63EE.tmp
Mutexes
3Named locks a program uses so only one copy runs; malware families often reuse them.
cversions.3.mMiniMeters_SingleInstance_MutexGlobal\OneSettingQueryMutex+compat+encapsulation
Sandbox background — not the file
11The analysis machine's own processes and connections, recorded in every run.
- VM process
svchost.exeC:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted -p -s WdiSystemHost - VM process
RuntimeBroker.exeC:\Windows\System32\RuntimeBroker.exe -Embedding - VM process
Explorer.EXEC:\Windows\Explorer.EXE - VM process
services.exeC:\Windows\system32\services.exe - VM process
svchost.exeC:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p - VM process
svchost.exeC:\Windows\System32\svchost.exe -k NetworkService -p
Show all 11 entries for sandbox background — not the file
- VM process
svchost.exeC:\Windows\system32\svchost.exe -k UnistackSvcGroup - VM process
svchost.exeC:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted -p -s StorSvc - VM process
lsass.exeC:\Windows\system32\lsass.exe - VM process
svchost.exeC:\Windows\system32\svchost.exe -k LocalService -s W32Time - VM host
162.159.36.2
Files this sample writes at runtime
This file drops 10 children at runtime. None are currently flagged malicious in our cache. 10 have no saved verdict and were not checked; that is missing coverage, not a finding.
- 315a106d835d1115652d…4937daNot checkedno saved verdict
- 4d05ed4d1a51df3b4652…c68ffbNot checkedno saved verdict
- e393f3d5b9882e261da8…b1a494Not checkedno saved verdict
- 4ca34aec9a2642f78c72…08d72dNot checkedno saved verdict
- 41e2f409e6229471fdad…c575fdNot checkedno saved verdict
- e6d99ce8e7c9063cc71d…3beea4Not checkedno saved verdict
- 36c3c25de8c5458eab81…bb5c8dNot checkedno saved verdict
- fc19f55c41d08943c6c5…ecfddaNot checkedno saved verdict
- b7fb566563e1388ca969…f8d369Not checkedno saved verdict
- a4a92f402830e569f0f3…c981b9Not checkedno saved verdict
Chapter 04
Technical details
None of the 69 antivirus engines that checked it flag it; signed by Joseph Lyncheski.
Sources checked
Every check behind this verdict
6 sources checked · 5 complete · 1 partial. Complete means the check returned a usable result; it does not mean the file is safe.
File fingerprint
- Last analyzed
- Sep 6, 2026, 2:18 PM UTC
- SHA-256
a4814c53277b47e50766d4ae73273c407c216c37f7487b7f4db32d0f62cfd6f1- SHA-1
e8aa0444afe762074c396ecee1109aaf47ab54c1- MD5
8055cf75ccb884e2113564d324dc2ca9
About this file
MiniMeters v1.0.28.233 Installer.exe is a Win32 EXE file of 44.9 MB.
- Type and size
- Win32 EXE · 44.9 MB
- Signer
- Joseph LyncheskiValid code signature.
- First seen
- Mar 16, 2026On VirusTotal.
- Submitted by
- 85 distinct sources
- Packer
- None detected
- Entropy
- 8.00 of 8
First scanned Updated
Antivirus consensus
0 of 69 engines flagged this file
6 of the 75 engines returned no result for this file (file type not supported, or the scan did not finish), so they did not check it.
- Tier-118 engines0flagged
- Tier-235 engines0flagged
- Low-trust16 engines0flagged
View all 75 engine results
- AcronisClean
- AhnLab-V3Clean
- AlibabaClean
- alibabacloudClean
- ALYacClean
- Antiy-AVLClean
- APEXClean
- ArcabitClean
- AvastClean
- Avast-MobileNo result
- AVGClean
- AviraClean
- BitDefenderClean
- BitDefenderFalxNo result
- BkavClean
- CAT-QuickHealClean
- ClamAVNo result
- CMCClean
- CrowdStrikeClean
- CTXClean
- CylanceClean
- CynetNo result
- DeepInstinctClean
- DrWebClean
- ElasticClean
- EmsisoftClean
- ESET-NOD32Clean
- F-SecureClean
- FortinetClean
- GDataClean
- GoogleClean
- GridinsoftClean
- huorongClean
- IkarusClean
- JiangminClean
- K7AntiVirusClean
- K7GWClean
- KasperskyClean
- KingsoftClean
- LionicClean
- MalwarebytesClean
- MaxSecureClean
- McAfeeDClean
- MicrosoftClean
- MicroWorld-eScanClean
- NANO-AntivirusClean
- PaloaltoClean
- PandaClean
- RisingClean
- SangforClean
- SentinelOneClean
- SkyhighClean
- SophosClean
- SUPERAntiSpywareClean
- SymantecClean
- SymantecMobileInsightNo result
- TACHYONClean
- tehtrisClean
- TencentClean
- TrapmineClean
- TrellixENSClean
- TrendMicroClean
- TrendMicro-HouseCallClean
- TrustlookNo result
- VaristClean
- VBA32Clean
- VIPREClean
- VirITClean
- ViRobotClean
- WebrootClean
- XcitiumClean
- YandexClean
- ZillyaClean
- ZoneAlarmClean
- ZonerClean
Signatures and behavior heuristics
Low-severity pattern matches — worth noting but not on their own cause for alarm.
VirusTotal's sandbox summary maps this run to MITRE T1055 (Process Injection), but no injected process of the sample's own was recorded (the analysis VM's own WMI adapter, crash handlers and Chrome updater are not counted). VirusTotal maps T1055 on about half of all files no engine flags, so the mapping alone is not evidence of injection.
EvidenceT1055 (sandbox MITRE mapping)VirusTotal's sandbox summary maps this run to MITRE T1003 (OS Credential Dumping), but no process targeting LSASS or another credential store was recorded. VirusTotal maps T1003 on clean files more often than on detected ones, so the mapping alone is not evidence of credential theft.
EvidenceT1003 (sandbox MITRE mapping)
Section entropy & packers
No high-entropy executable section or known packer signature was detected. Data and resource sections can still have high entropy without indicating packed code.
How widely this file has been seen
Moderate prevalence — neither rare nor common. No strong prior applies.
Chapter 05
Questions & answers
Short answers to the 7 questions people ask most about this file.
Is MiniMeters v1.0.28.233 Installer.exe safe?
What is MiniMeters v1.0.28.233 Installer.exe?
How many antivirus engines detected MiniMeters v1.0.28.233 Installer.exe?
Is MiniMeters v1.0.28.233 Installer.exe digitally signed?
What is the SHA-256 hash of MiniMeters v1.0.28.233 Installer.exe?
Is it safe to install MiniMeters v1.0.28.233 Installer.exe?
How up to date is this analysis of MiniMeters v1.0.28.233 Installer.exe?
Community
Member reviews and reports for this exact file hash.