File scan report
Verdict Safe
Is LYNX-
Only 1 of the 42 antivirus engines that checked it flagged this installer generically, while higher-confidence engines and completed observations from the test run provided no…
Read the whole reasonShow less
Moderate evidence · No engine flags it, but no publisher signature confirms who made it.
Good practice2 tips
We found nothing harmful in this file.
Install it only if it came from the developer's own website or an official app store.
Keep your antivirus and Windows updates switched on.
No scanner can promise a file is 100% safe.
Antivirus results
1 of 42 flagged
- Flagged 1
- No detection 41
- No result 33
- Code signing Unsigned
- Test run Completed
- First seen Today
Chapter 02
Why we think so
3 points against it and 4 in its favour, checked against the scan evidence.
The reasoning behind this verdict
Trapmine alone flagged the executable with a generic machine-learning label; no higher-confidence engine identified malware or a family. Three completed observations from the test run produced a combined clean label and recorded no high-risk technique with supporting evidence, making the lone detection likely erroneous, though the unsigned file has little distribution history.
Only 1 of the 42 antivirus engines that checked it flagged the file, and that result came from Trapmine using a generic machine-learning label. No higher-confidence engine detected it, and no malware family was identified. Three completed observations from the test run produced a combined clean label, with no named injection target, malicious host, or corroborated high-risk technique. Confidence is moderated because the executable is unsigned, was first seen on Oct 27, 2026, and has only four distinct submitters.
What We Detected
Only 1 of the 42 antivirus engines that checked it flagged the executable. Trapmine supplied a generic machine-learning label, while no higher-confidence engine detected malware and no specific family was identified.
Threat Behavior
Three completed observations from the test run produced a combined clean label. The only recorded contact was identified as analysis-environment background traffic, and the complete host check found no malicious or suspicious destination.
What To Do Now
The lone detection is most consistent with an erroneous alert. Because the installer is unsigned and has limited distribution history, obtain it from the publisher's official release channel, verify any published checksum, and keep security software enabled while installing.
Where this verdict could be wrong3 caveats
- The executable is unsigned and had only four distinct submitters, so its publisher identity and wider reputation are not established.
- The file was first seen on Oct 27, 2026, and our static analysis of its bytes was not available.
- Trapmine produced one generic machine-learning detection, although no higher-confidence engine corroborated it.
These are the assessment's weak points. If you believe one applies to your file, report the verdict and we'll re-review it.
- No higher-confidence antivirus engine flagged the file.
- Three completed observations from the test run produced a combined clean label and recorded no corroborated high-risk technique.
- The complete reputation check for the sole recorded contact found no malicious or suspicious host; that contact was also identified as analysis-environment background traffic.
- No packer or high-entropy code section was identified.
- The Windows executable is unsigned, so its publisher cannot be authenticated through code signing.
- It had only four distinct submitters and was first seen on Oct 27, 2026.
- Trapmine reported one generic machine-learning detection.
6 sources checked · all complete. See every source
Chapter 03
What it did in our test
It ran in 3 isolated tests; no test environment rated what it did as risky.
Test run summary
Capture complete- 3isolated sandbox runs
- 31sandbox rule tags
- 3spawned processes
- 0network contacts
- 28filesystem & mutex artifacts
What this file did when executed
This file was detonated in 3 sandboxes and its runtime behaviour was observed.
Sandbox verdicts
1- VT: CLEANclean
Techniques observed in the sandbox
31MITRE ATT&CK techniques the sandbox mapped. Highlighted ones are rare in normal software; the others are common in legitimate programs too.
- T1003· Credential theft
- T1005
- T1010
- T1012
- T1027· Obfuscated code
- T1027.002· Obfuscated code
- T1033· Reads user info
- T1036
- T1055· Process injection
- T1059· Runs commands
- T1069
- T1071· Application protocol
- T1082· System recon
- T1083· Scans your files
- T1112
- T1114
- T1115
- T1125
- T1129· Loads modules
- T1134
- T1222
- T1485
- T1497· Sandbox evasion
- T1497.001· Sandbox evasion
- T1529
- T1547.009· Auto-start
- T1552· Credential search
- T1552.001· Credential search
- T1553
- T1553.002
- T1574· Execution hijack
Observed activity
Processes started
3Programs the file ran, with their command lines.
LYNX-0.1.19-alpha-setup-x64.exe"C:\Users\<USER>\Desktop\LYNX-0.1.19-alpha-setup-x64.exe"LYNX.exe"C:\Users\<USER>\AppData\Local\Programs\LYNX\LYNX.exe"LYNX-0.1.19-alpha-setup-x64.exe"C:\Users\user\Desktop\LYNX-0.1.19-alpha-setup-x64.exe"
Files
25Files the file created, changed or deleted.
- Written
C:\Users\<USER>\AppData\Local\Temp\nsi37D5.tmp - Written
C:\Users\<USER>\AppData\Local\Temp\nsx3833.tmp\System.dll - Written
C:\Users\<USER>\AppData\Local\Temp\nsx3833.tmp\modern-wizard.bmp - Written
C:\Users\<USER>\AppData\Local\Temp\nsx3833.tmp\nsDialogs.dll - Written
C:\Users\<USER>\AppData\Local\Programs\LYNX\LYNX.exe - Written
C:\Users\<USER>\AppData\Local\Programs\LYNX\LICENSE
Show all 25 entries for files
- Written
C:\Users\<USER>\AppData\Local\Programs\LYNX\THIRD_PARTY.md - Written
C:\Users\<USER>\AppData\Local\Programs\LYNX\PRIVACY.md - Written
C:\Users\<USER>\AppData\Local\Programs\LYNX\Demo.lynx - Written
C:\Users\<USER>\AppData\Local\Programs\LYNX\lynx-asio.dll - Written
C:\Users\<USER>\AppData\Local\Programs\LYNX\lynx-asio32.dll - Written
C:\Users\<USER>\AppData\Local\Programs\LYNX\Register LYNX ASIO.bat - Written
C:\Users\<USER>\AppData\Local\Programs\LYNX\Unregister LYNX ASIO.bat - Written
C:\Users\<USER>\AppData\Local\Programs\LYNX\Uninstall.exe - Written
C:\Users\<USER>\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\LYNX.lnk - Deleted
C:\Users\<USER>\AppData\Local\Temp\nsx3833.tmp\modern-wizard.bmp - Deleted
C:\Users\<USER>\AppData\Local\Temp\nsx3833.tmp\nsDialogs.dll - Deleted
C:\Users\<USER>\AppData\Local\Temp\nsx3833.tmp\System.dll - Deleted
C:\Users\<USER>\AppData\Local\Temp\nsx3833.tmp\ - Deleted
C:\Users\<USER>\AppData\Roaming\LYNX\.scan-retry_tempbc231988.txt - Deleted
C:\Users\<USER>\AppData\Roaming\LYNX\.session-running_temp7b35cccb.txt - Deleted
C:\Users\<USER>\AppData\Roaming\LYNX\.browser-index.txt_tempaf717194.tmp - Deleted
C:\Users\<USER>\AppData\Roaming\LYNX\browser-index.txt.tmp - Deleted
C:\Users\user\AppData\Local\Temp\nsm293C.tmp - Deleted
C:\Users\user\AppData\Local\Temp\nsw2840.tmp
Registry and auto-start
15Settings the file changed, including ways to start again after a restart.
- Set
HKEY_CURRENT_USER\Software\Classes\.lynx\(Default) - Set
HKEY_CURRENT_USER\Software\Classes\.lynx\Content Type - Set
HKEY_CURRENT_USER\Software\Classes\LYNX.Project\(Default) - Set
HKEY_CURRENT_USER\Software\Classes\LYNX.Project\DefaultIcon\(Default) - Set
HKEY_CURRENT_USER\Software\Classes\LYNX.Project\shell\open\command\(Default) - Set
HKEY_CURRENT_USER\Software\Classes\Applications\LYNX.exe\FriendlyAppName
Show all 15 entries for registry and auto-start
- Set
HKEY_CURRENT_USER\Software\Classes\Applications\LYNX.exe\shell\open\command\(Default) - Set
HKEY_CURRENT_USER\SOFTWARE\LYNX\InstallDir - Set
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\LYNX\DisplayName - Set
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\LYNX\DisplayVersion - Set
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\LYNX\Publisher - Set
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\LYNX\URLInfoAbout - Set
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\LYNX\DisplayIcon - Set
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\LYNX\InstallLocation - Set
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\LYNX\UninstallString
Mutexes
3Named locks a program uses so only one copy runs; malware families often reuse them.
cversions.3.mGlobal\LYNX-ui-sessionGlobal\OneSettingQueryMutex+compat+encapsulation
Sandbox background — not the file
9The analysis machine's own processes and connections, recorded in every run.
- VM process
Explorer.EXEC:\Windows\Explorer.EXE - VM process
services.exeC:\Windows\system32\services.exe - VM process
svchost.exeC:\Windows\System32\svchost.exe -k NetworkService -p - VM process
svchost.exeC:\Windows\system32\svchost.exe -k UnistackSvcGroup - VM process
svchost.exeC:\Windows\system32\svchost.exe -k LocalService -s W32Time - VM process
svchost.exeC:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted -p -s WdiSystemHost
Show all 9 entries for sandbox background — not the file
- VM process
lsass.exeC:\Windows\system32\lsass.exe - VM process
svchost.exeC:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p - VM host
atm.teams.mira.tm.svc.cloud.microsoft
Files this sample writes at runtime
This file drops 10 children at runtime. None are currently flagged malicious in our cache. 10 have no saved verdict and were not checked; that is missing coverage, not a finding.
- 88891b5d4cdb26cc4321…327ca2Not checkedno saved verdict
- 27c2eb991341a23e450b…b67bf6Not checkedno saved verdict
- 9c76f4d53ceee2a471c9…d114cbNot checkedno saved verdict
- e3e321f13fc2bbb2692e…7ebbc9Not checkedno saved verdict
- c920332cc0c84bc18f44…a85e29Not checkedno saved verdict
- a01c7d13ab5b88263415…b13e29Not checkedno saved verdict
- 9420ac7aeb43419960cd…588130Not checkedno saved verdict
- afe032f942e2ed0bf749…894432Not checkedno saved verdict
- 14073f3fd9829fc6dc8b…f4bf69Not checkedno saved verdict
- fad494f942e3b34283b2…80154aNot checkedno saved verdict
Chapter 04
Technical details
1 of the 42 antivirus engines that checked it flags it; no publisher signature.
Sources checked
Every check behind this verdict
6 sources checked · all complete. Complete means the check returned a usable result; it does not mean the file is safe.
Engines that flagged it 1
The saved verdict treats these detections as likely false positives.
- Trapminesuspicious.low.ml.score
File fingerprint
- Last analyzed
- Oct 28, 2026, 2:15 AM UTC
- SHA-256
2df466d2ce05cdff14dda4f030b734b7b6045e96e80712b296b602ae2d057418- SHA-1
3795194d368ffaff43377fbfae1f67fc29047e1f- MD5
308cca7023a617fd14ec1d840cc289af
About this file
LYNX-0.1.19-alpha-setup-x64.exe says it is LYNX installer (LYNX), 9.1 MB.
- Claims to be
- LYNX installer (LYNX)From the file's own version information, written by whoever built it.
- Type and size
- Win32 EXE · 9.1 MB
- Signer
- UnsignedNo code signature.
- First seen
- Oct 27, 2026On VirusTotal.
- Submitted by
- 4 distinct sourcesRarely seen: few people have submitted this exact file.
- Packer
- None detected
- Entropy
- 7.47 of 8
First scanned
Antivirus consensus
1 of 42 engines flagged this file
33 of the 75 engines returned no result for this file (file type not supported, or the scan did not finish), so they did not check it.
- Tier-19 engines0flagged
- Tier-221 engines0flagged
- Low-trust12 engines1flagged
View all 75 engine results
- TrapmineMalicious: suspicious.low.ml.score
- AcronisNo result
- AhnLab-V3Clean
- AlibabaClean
- alibabacloudNo result
- ALYacNo result
- Antiy-AVLClean
- APEXClean
- ArcabitNo result
- AvastNo result
- Avast-MobileNo result
- AVGNo result
- AviraClean
- BitDefenderNo result
- BitDefenderFalxNo result
- BkavClean
- CAT-QuickHealNo result
- ClamAVClean
- CMCNo result
- CrowdStrikeClean
- CTXNo result
- CylanceClean
- CynetClean
- DeepInstinctNo result
- DrWebNo result
- ElasticClean
- EmsisoftNo result
- ESET-NOD32No result
- F-SecureClean
- FortinetClean
- GDataClean
- GoogleNo result
- GridinsoftClean
- huorongClean
- IkarusClean
- JiangminNo result
- K7AntiVirusClean
- K7GWClean
- KasperskyNo result
- KingsoftClean
- LionicClean
- MalwarebytesClean
- MaxSecureClean
- McAfeeDClean
- MicrosoftClean
- MicroWorld-eScanClean
- NANO-AntivirusNo result
- PaloaltoClean
- PandaNo result
- RisingNo result
- SangforNo result
- SentinelOneClean
- SkyhighNo result
- SophosNo result
- SUPERAntiSpywareClean
- SymantecClean
- SymantecMobileInsightNo result
- TACHYONClean
- tehtrisClean
- TencentClean
- TrellixENSNo result
- TrendMicroClean
- TrendMicro-HouseCallClean
- TrustlookNo result
- VaristNo result
- VBA32No result
- VIPREClean
- VirITClean
- ViRobotClean
- WebrootClean
- XcitiumNo result
- YandexNo result
- ZillyaNo result
- ZoneAlarmClean
- ZonerClean
Signatures and behavior heuristics
Low-severity pattern matches — worth noting but not on their own cause for alarm.
VirusTotal's sandbox summary maps this run to MITRE T1055 (Process Injection), but no injected process of the sample's own was recorded (the analysis VM's own WMI adapter, crash handlers and Chrome updater are not counted). VirusTotal maps T1055 on about half of all files no engine flags, so the mapping alone is not evidence of injection.
EvidenceT1055 (sandbox MITRE mapping)VirusTotal's sandbox summary maps this run to MITRE T1003 (OS Credential Dumping), but no process targeting LSASS or another credential store was recorded. VirusTotal maps T1003 on clean files more often than on detected ones, so the mapping alone is not evidence of credential theft.
EvidenceT1003 (sandbox MITRE mapping)
Section entropy & packers
No high-entropy executable section or known packer signature was detected. Data and resource sections can still have high entropy without indicating packed code.
How widely this file has been seen
Moderate prevalence — neither rare nor common. No strong prior applies.
Chapter 05
Questions & answers
Short answers to the 6 questions people ask most about this file.
Is LYNX-0.1.19-alpha-setup-x64.exe safe?
What is LYNX-0.1.19-alpha-setup-x64.exe?
How many antivirus engines detected LYNX-0.1.19-alpha-setup-x64.exe?
What is the SHA-256 hash of LYNX-0.1.19-alpha-setup-x64.exe?
Is it safe to install LYNX-0.1.19-alpha-setup-x64.exe?
How up to date is this analysis of LYNX-0.1.19-alpha-setup-x64.exe?
Community
Member reviews and reports for this exact file hash.