File scan report
Verdict Safe
Is Muse
MuseHub installer with a valid MUSECY SM LTD signature, no detections from any of 75 engines, wide distribution and sandbox activity consistent with a normal software installer.
Read the whole reasonShow less
Strong evidence · A verified publisher signature, and no engine flags it.
This installer can be used normally; get it from the official MuseScore or MuseHub site and keep your antivirus enabled as usual.
Good practice2 tips
We found nothing harmful in this file.
Install it only if it came from the developer's own website or an official app store.
Keep your antivirus and Windows updates switched on.
No scanner can promise a file is 100% safe.
Antivirus results
0 of 69 flagged
- Flagged 0
- No detection 69
- No result 6
- Code signing MUSECY SM LTD
- Test run Completed
- First seen 10d ago
Chapter 02
Why we think so
2 points against it and 5 in its favour, checked against the scan evidence.
The reasoning behind this verdict
None of the 69 antivirus engines that checked it flagged this MuseHub installer, and it carries a valid code signature from MUSECY SM LTD. Over 480 distinct sources have submitted it, and its sandbox runs showed ordinary installer behaviour talking only to MuseHub and crash-reporting servers.
None of the 69 antivirus engines that checked it flagged the file, including all 18 major antivirus engines that reported on it. The signature from MUSECY SM LTD verifies, although this signer has no prior history with us. The file is widely distributed, with 481 distinct submitters since it was first seen on Oct 15, 2026. The sandbox runs produced a clean combined verdict, recorded no injection into other processes, and contacted only MuseHub, its download CDN and a crash-reporting service, none of which our host checks list as malicious. The services and startup entry it creates belong to MuseHub's own authentication and updater components.
What We Detected
None of the 69 antivirus engines that checked it flagged this installer. It carries a valid code signature from MUSECY SM LTD and has been submitted by 481 distinct sources since it was first seen on Oct 15, 2026. Public malware databases and community rule sets returned no matches.
Threat Behavior
In the sandbox runs the installer unpacked MuseHub into Program Files, wrote fonts and images, registered an uninstall entry, and created MuseHub authentication and updater services plus a startup entry. It contacted MuseHub's customer API, its content-delivery network and a crash-reporting service; none of these hosts is listed as malicious in our checks. No injection into other processes was recorded, and the combined sandbox verdict was clean.
What To Do Now
The file behaves like a normal MuseHub installer. Download it only from the official MuseScore or MuseHub website, and you can remove the background services later by uninstalling MuseHub if you no longer need it.
Where this verdict could be wrong2 caveats
- The signer has no history in our records and is not on our curated publisher list, so trust rests on detections, prevalence and behaviour rather than an established publisher record.
- The installer registers two services and a startup entry, which is normal for an updater but gives the software persistent background presence.
These are the assessment's weak points. If you believe one applies to your file, report the verdict and we'll re-review it.
- No detections from any of the 75 engines
- Valid code signature from MUSECY SM LTD
- Submitted by 481 distinct sources
- Sandbox runs produced a clean combined verdict with no process injection
- Contacted hosts are the product's own servers and a crash-reporting service, none listed as malicious
- The signing company has no prior history in our records.
- The installer adds background services and a startup entry for its updater.
6 sources checked · all complete. See every source
Chapter 03
What it did in our test
It ran in 3 isolated tests; no test environment rated what it did as risky.
Test run summary
Capture complete- 3isolated sandbox runs
- 41sandbox rule tags
- 3spawned processes
- 6network contacts
- 37filesystem & mutex artifacts
What this file did when executed
This file was detonated in 3 sandboxes and its runtime behaviour was observed.
Sandbox verdicts
1- VT: CLEANclean
Techniques observed in the sandbox
41MITRE ATT&CK techniques the sandbox mapped. Highlighted ones are rare in normal software; the others are common in legitimate programs too.
- T1003· Credential theft
- T1005
- T1012
- T1027· Obfuscated code
- T1027.002· Obfuscated code
- T1033· Reads user info
- T1036
- T1053· Scheduled task
- T1055· Process injection
- T1057· Lists programs
- T1059· Runs commands
- T1069
- T1070· Covers its tracks
- T1070.006· Covers its tracks
- T1071· Application protocol
- T1082· System recon
- T1083· Scans your files
- T1112
- T1129· Loads modules
- T1222
- T1485
- T1486· File encryption
- T1497· Sandbox evasion
- T1497.001· Sandbox evasion
- T1518· Checks your AV
- T1518.001· Checks your AV
- T1543· Service install
- T1543.003· Service install
- T1547· Auto-start
- T1547.001· Auto-start
- T1548
- T1552· Credential search
- +9 more
Observed activity
Processes started
3Programs the file ran, with their command lines.
MuseScore_Studio_Installer_via_MuseHub _1_.exe"C:\Users\<USER>\Desktop\MuseScore_Studio_Installer_via_MuseHub _1_.exe"MuseHub.exe"C:\Program Files\MuseHub\current\MuseHub.exe" "----ms-protocol:musehub://product/store?id=1afc2c26-93e3-4534-8af2-f91190db0faf&from=mh_installer_musescore_studio"MuseScore_Studio_Installer_via_MuseHub (1).exe"C:\Users\user\Desktop\MuseScore_Studio_Installer_via_MuseHub (1).exe"
Network contacts
66 hosts, listed as 3 domains, 3 addresses, 13 links. Links show the host and path only.
- Domain
o4507384982339584.ingest.de.sentry.io - Domain
customers-api.musehub.com - Domain
production-v2.muse-cdn.com - IP address
34.160.81.0 - IP address
172.66.162.82 - IP address
104.26.10.244
Show all 19 entries for network contacts
- URL
https://o4507384982339584.ingest.de.sentry.io/api/4509555756236880/envelope/ - URL
https://o4507384982339584.ingest.de.sentry.io/api/4507387001503824/envelope/ - URL
https://customers-api.musehub.com/graphql/v3 - URL
https://customers-api.musehub.com/instruments-map-beta - URL
https://customers-api.musehub.com/app-asset-download-url - URL
https://production-v2.muse-cdn.com/application-binaries/1fca0dc6-3b82-4b79-bc0e-80833de02042.zip - URL
https://production-v2.muse-cdn.com/application-binaries/310e51ed-09e8-4967-a0f0-bdf73fddc7c2.zip - URL
https://production-v2.muse-cdn.com/cdn-cgi/image/w=2048,fit=scale-down,dpr=1/product-page-images/6cbb3a79-aff0-485a-baea-1406cf8c6e8d.png - URL
https://production-v2.muse-cdn.com/cdn-cgi/image/w=360,fit=scale-down,dpr=1/application-icon-images/8f5f6d47-b69e-4c81-a7cb-bff60649b746.png - URL
https://production-v2.muse-cdn.com/cdn-cgi/image/w=2048,fit=scale-down,dpr=1/product-page-images/b0164949-ff12-4153-9772-968131c8564a.png - URL
https://production-v2.muse-cdn.com/cdn-cgi/image/w=360,fit=scale-down,dpr=1/effect-icon-images/8b4261a7-21a0-4a10-903e-799b9fc121e5.png - URL
https://production-v2.muse-cdn.com/cdn-cgi/image/w=360,fit=scale-down,dpr=1/effect-icon-images/403a893a-afa6-45a1-b292-8ef9111d6738.jpg - URL
https://production-v2.muse-cdn.com/cdn-cgi/image/w=360,fit=scale-down,dpr=1/effect-icon-images/4574eb67-7e02-47cc-8671-24f2885ca16e.png
Files
30Files the file created, changed or deleted.
- Written
C:\Users\<USER>\AppData\Local\Temp\MuseHub\Installer\Sentry\d64c5b7a-6ca2-413a-2fc4-92d9ac9d34d8.run.lock - Written
C:\Users\<USER>\AppData\Local\Temp\MuseHub\Installer\Sentry\d64c5b7a-6ca2-413a-2fc4-92d9ac9d34d8.run\session.json - Written
C:\Users\<USER>\AppData\Local\Temp\MuseHub\Installer\Installer_2026_10_15_21_57_59.log - Written
C:\Program Files\MuseHub\staging\.manifest - Written
C:\Program Files\MuseHub\staging\Assets\Fonts\MuseDisplay-Harmony.ttf - Written
C:\Program Files\MuseHub\staging\Assets\Fonts\MuseSansVF.ttf
Show all 30 entries for files
- Written
C:\Program Files\MuseHub\staging\Assets\Images\AppList.scale-100.png - Written
C:\Program Files\MuseHub\staging\Assets\Images\AppList.scale-200.png - Written
C:\Program Files\MuseHub\staging\Assets\Images\GrainTexture.png - Written
C:\Program Files\MuseHub\staging\Assets\Images\MuseLayer.scale-100.png - Written
C:\Program Files\MuseHub\staging\Assets\Images\MuseLayer.scale-200.png - Written
C:\Program Files\MuseHub\staging\Assets\Images\Platforms\Apple.scale-100.png - Written
C:\Program Files\MuseHub\staging\Assets\Images\Platforms\Apple.scale-150.png - Written
C:\Program Files\MuseHub\staging\Assets\Images\Platforms\Apple.scale-200.png - Written
C:\Program Files\MuseHub\staging\Assets\Images\Platforms\MuseScoreStudio.scale-100.png - Deleted
C:\Users\<USER>\AppData\Local\Temp\MuseHub\Installer\Sentry\d64c5b7a-6ca2-413a-2fc4-92d9ac9d34d8.run\session.json - Deleted
C:\Program Files\MuseHub\staging\ - Deleted
C:\Users\<USER>\AppData\Local\Temp\MuseHub\Installer\Installer_2026_10_15_21_57_59.log - Deleted
C:\Users\<USER>\AppData\Local\Temp\MuseHub\Installer\Sentry\d64c5b7a-6ca2-413a-2fc4-92d9ac9d34d8.run - Deleted
C:\Users\<USER>\AppData\Local\Temp\MuseHub\Installer\Sentry\d64c5b7a-6ca2-413a-2fc4-92d9ac9d34d8.run.lock - Deleted
C:\Users\<USER>\AppData\Local\Temp\MuseHub\Installer\Sentry - Deleted
C:\Users\<USER>\AppData\Local\Packages\Microsoft.XboxGamingOverlay_8wekyb3d8bbwe\LocalCache\KnownGameList.bin - Deleted
C:\Users\<USER>\AppData\Local\Muse Hub\cache\SentryNative\last_crash - Deleted
C:\Users\<USER>\AppData\Local\Muse Hub\cache\Sentry\5117DC15803DD54649B5BD2E3E61C26C878141D4\1792126713_9951__34070988.envelope - Deleted
C:\Users\<USER>\AppData\Local\Muse Hub\cache\Sentry\5117DC15803DD54649B5BD2E3E61C26C878141D4\__processing\1792126713_9951__34070988.envelope - Deleted
C:\Users\<USER>\AppData\Local\Muse Hub\.receipt.tmp-88800780900 - Deleted
C:\Users\<USER>\AppData\Local\Muse Hub\.rccache.tmp-88814481000 - Deleted
C:\Users\<USER>\AppData\Local\Muse Hub\.rccache.tmp-88824768300 - Deleted
C:\Users\<USER>\AppData\Local\Muse Hub\.receipt.tmp-89348137500 - Deleted
C:\Users\<USER>\AppData\Local\Muse Hub\.rccache.tmp-89369982900
Registry and auto-start
17Settings the file changed, including ways to start again after a restart.
- Auto-start
MuseAuthService - Auto-start
MuseHubUpdaterService - Auto-start
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\MuseHub - Set
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\MuseHub\DisplayName - Set
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\MuseHub\DisplayVersion - Set
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\MuseHub\DisplayIcon
Show all 17 entries for registry and auto-start
- Set
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\MuseHub\Publisher - Set
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\MuseHub\InstallLocation - Set
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\MuseHub\UninstallString - Set
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\MuseHub\QuietUninstallString - Set
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\MuseHub\InstallDate - Set
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\MuseHub\HelpLink - Set
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\MuseHub\URLUpdateInfo - Set
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\MuseHub\URLInfoAbout - Set
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\MuseHub\VersionMajor - Set
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\MuseHub\VersionMinor - Set
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\MuseHub\NoModify
Mutexes
7Named locks a program uses so only one copy runs; malware families often reuse them.
Global\MuseHub_Installer_Mutexcversions.3.mLocal\MuseHub_SingleInstance_MutexLocal\SessionImmersiveColorMutexApp.9224e941c860138a_5900_Mutexbipc_gmap_sem_lock_5900_13436600307.696932
Show all 7 entries for mutexes
\Sessions\1\BaseNamedObjects\Global\MuseHub_Installer_Mutex
Sandbox background — not the file
6The analysis machine's own processes and connections, recorded in every run.
- VM process
Explorer.EXEC:\Windows\Explorer.EXE - VM process
services.exeC:\Windows\system32\services.exe - VM process
svchost.exeC:\Windows\System32\svchost.exe -k NetworkService -p - VM process
svchost.exeC:\Windows\system32\svchost.exe -k UnistackSvcGroup - VM process
svchost.exeC:\Windows\system32\svchost.exe -k LocalService -s W32Time - VM process
lsass.exeC:\Windows\system32\lsass.exe
Files this sample writes at runtime
This file drops 10 children at runtime. None are currently flagged malicious in our cache. 10 have no saved verdict and were not checked; that is missing coverage, not a finding.
- 4a0ac37bf39b938ea96d…b14dacNot checkedno saved verdict
- 0e14d6349b47f606c6a3…e5d91bNot checkedno saved verdict
- 278f5e950f764dee4435…80641cNot checkedno saved verdict
- 5adcba3282bbdbf8a840…6ce23eNot checkedno saved verdict
- fd6acfb6847fef3966db…3545e2Not checkedno saved verdict
- 010b2980a2b102451364…788683Not checkedno saved verdict
- 8fcf7f7d37aac35c29e0…76aca8Not checkedno saved verdict
- 9c9dad99b0848bc6fa19…1eb4d0Not checkedno saved verdict
- da3831c72fb5b8200315…31e727Not checkedno saved verdict
- b32cac894da2c60fe955…25b625Not checkedno saved verdict
Chapter 04
Technical details
None of the 69 antivirus engines that checked it flag it; signed by MUSECY SM LTD.
Sources checked
Every check behind this verdict
6 sources checked · all complete. Complete means the check returned a usable result; it does not mean the file is safe.
File fingerprint
- Last analyzed
- Oct 23, 2026, 6:25 PM UTC
- SHA-256
dedc8c3638db76d8d8b18ef37205d3609eaf5034171cd67c717d9e8df2cde4e2- SHA-1
ff457110cd5de935a0f6f7d1c634937148ccd013- MD5
b0b2c4d0c1865b4892c8400a20a99c03
About this file
MuseHub.Installer.exe is a Win32 EXE file of 36.2 MB.
- Claims to be
- MuseHub InstallerFrom the file's own version information, written by whoever built it.
- Original name
- MuseHub.Installer.exeMatches the shared file name.
- Type and size
- Win32 EXE · 36.2 MB
- Signer
- MUSECY SM LTDValid code signature.
- First seen
- Oct 15, 2026On VirusTotal.
- Submitted by
- 481 distinct sources
- Packer
- None detected
- Entropy
- 7.96 of 8
First scanned
Antivirus consensus
0 of 69 engines flagged this file
6 of the 75 engines returned no result for this file (file type not supported, or the scan did not finish), so they did not check it.
- Tier-118 engines0flagged
- Tier-234 engines0flagged
- Low-trust17 engines0flagged
View all 75 engine results
- AcronisClean
- AhnLab-V3Clean
- AlibabaClean
- alibabacloudClean
- ALYacClean
- Antiy-AVLClean
- APEXClean
- ArcabitClean
- AvastClean
- Avast-MobileNo result
- AVGClean
- AviraClean
- BitDefenderClean
- BitDefenderFalxNo result
- BkavClean
- CAT-QuickHealClean
- ClamAVClean
- CMCClean
- CrowdStrikeClean
- CTXClean
- CylanceClean
- CynetClean
- DeepInstinctClean
- DrWebClean
- ElasticClean
- EmsisoftClean
- ESET-NOD32Clean
- F-SecureClean
- FortinetClean
- GDataClean
- GoogleNo result
- GridinsoftClean
- huorongClean
- IkarusClean
- JiangminClean
- K7AntiVirusClean
- K7GWClean
- KasperskyClean
- KingsoftClean
- LionicClean
- MalwarebytesClean
- MaxSecureClean
- McAfeeDClean
- MicrosoftClean
- MicroWorld-eScanClean
- NANO-AntivirusClean
- PaloaltoClean
- PandaClean
- RisingClean
- SangforClean
- SentinelOneClean
- SkyhighClean
- SophosClean
- SUPERAntiSpywareClean
- SymantecClean
- SymantecMobileInsightNo result
- TACHYONClean
- tehtrisNo result
- TencentClean
- TrapmineClean
- TrellixENSClean
- TrendMicroClean
- TrendMicro-HouseCallClean
- TrustlookNo result
- VaristClean
- VBA32Clean
- VIPREClean
- VirITClean
- ViRobotClean
- WebrootClean
- XcitiumClean
- YandexClean
- ZillyaClean
- ZoneAlarmClean
- ZonerClean
Signatures and behavior heuristics
Behavioral heuristics matched patterns associated with malware. Corroborating evidence determines how much weight they carry.
The sandbox recorded persistence through a Windows service, a Run key or Startup-folder entry. Installers set these up legitimately for their own updaters and services, so this is context, not proof of malicious intent.
EvidenceMuseAuthService · MuseHubUpdaterService · HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\MuseHubVirusTotal's sandbox summary maps this run to MITRE T1055 (Process Injection), but no injected process of the sample's own was recorded (the analysis VM's own WMI adapter, crash handlers and Chrome updater are not counted). VirusTotal maps T1055 on about half of all files no engine flags, so the mapping alone is not evidence of injection.
EvidenceT1055 (sandbox MITRE mapping)VirusTotal's sandbox summary maps this run to MITRE T1003 (OS Credential Dumping), but no process targeting LSASS or another credential store was recorded. VirusTotal maps T1003 on clean files more often than on detected ones, so the mapping alone is not evidence of credential theft.
EvidenceT1003 (sandbox MITRE mapping)
Section entropy & packers
No high-entropy executable section or known packer signature was detected. Data and resource sections can still have high entropy without indicating packed code.
How widely this file has been seen
Lots of people are uploading this but it's recent — typical of newly-released legitimate software. Low prior for malware.
Chapter 05
Questions & answers
Short answers to the 7 questions people ask most about this file.
Is MuseHub.Installer.exe safe?
What is MuseHub.Installer.exe?
How many antivirus engines detected MuseHub.Installer.exe?
Is MuseHub.Installer.exe digitally signed?
What is the SHA-256 hash of MuseHub.Installer.exe?
Is it safe to install MuseHub.Installer.exe?
How up to date is this analysis of MuseHub.Installer.exe?
Community
Member reviews and reports for this exact file hash.