Threat Feed
Microsoft Search Host.exe
2026-10-21T19:54:47.400
malicious
Windows Exe (x86-32)
Close
Microsoft Search Host.exe
malicious
SHA256:
5fe9b84be0ee6ebbe98e555da19e5ea13a452b3339a825ea12bf2d4165f599f2
VMRay Threat Identifiers
Close
Severity
Operation
4/5
Malicious host or URL detected via reputation
4/5
Malicious file detected via reputation
4/5
Event Triggered Execution
4/5
Loads a dropped DLL into a system binary
3/5
Modifies native system functions
3/5
Tries to detect the presence of antivirus software
2/5
Queries OS info via WMI
2/5
Collects hardware properties
2/5
Creates a new process from a system binary
2/5
Makes direct system call to possibly evade hooking based monitoring
2/5
Signed executable failed signature validation
2/5
Schedules task
2/5
Tries to detect kernel debugger
1/5
Overwrites code
1/5
Creates mutex
1/5
Tries to detect virtual machine
1/5
Query OS Information
1/5
Connects to remote host
1/5
Drops PE file
1/5
Loads a dropped DLL
1/5
Performs DNS request
1/5
Modifies operating system directory
1/5
Queries system time
1/5
Enables process privileges
1/5
Modifies application directory
1/5
Creates process with hidden window
1/5
Installs system startup script or application
1/5
Enumerates running processes
1/5
Checks external IP address
1/5
Content matched by YARA rules
1/5
Tries to connect using an uncommon port
1/5
Resolves API functions dynamically
FlashUtil.exe
2026-10-21T19:52:11.177
malicious
Windows Exe (x86-32)
Close
FlashUtil.exe
malicious
SHA256:
423fc201cc522eb2038c2be872c95b1c337cf6eda012d1d3c1f13f73740d4f4e
VMRay Threat Identifiers
Close
Severity
Operation
5/5
Malicious content matched by YARA rules
4/5
Malicious file detected via reputation
2/5
Deletes file after execution
1/5
Installs system startup script or application
1/5
Executes dropped PE file
1/5
Drops PE file
1/5
Queries system time
app.exe
2026-10-21T19:48:26.569
malicious
Windows Exe (x86-64)
Close
app.exe
malicious
SHA256:
5985fcec2610d75409a71aed31a423c71cd247bf5a885b58eaf2dbb33d99880c
VMRay Threat Identifiers
Close
Severity
Operation
5/5
Combination of other detections shows configuration discovery
4/5
Malicious content matched by YARA rules
3/5
Suspicious content matched by YARA rules
3/5
Uses HTTP to upload a large amount of data
2/5
Peripheral Device Discovery
2/5
Tries to detect kernel debugger
2/5
Accesses physical drive
2/5
Sends control codes to a driver
2/5
Query Firmware Information
2/5
Tries to detect virtual machine
2/5
Tries to detect application sandbox
2/5
Queries a host's domain name
2/5
Reads network adapter information
2/5
Reads installed applications
2/5
Makes direct system call to possibly evade hooking based monitoring
1/5
Query CPU Properties
1/5
Accesses volumes directly
1/5
Tries to connect using an uncommon port
1/5
Reads system data
1/5
Creates mutex
1/5
Query OS Information
1/5
Enables process privileges
1/5
Creates process with hidden window
1/5
Tries to detect application sandbox
1/5
Tries to detect debugger
1/5
Enumerates running processes
1/5
Performs DNS request
1/5
Connects to remote host
1/5
Queries system time
1/5
Content matched by YARA rules
1/5
Resolves API functions dynamically
1/5
Tries to detect virtual machine
a2scan.exe
2026-10-21T19:45:46.776
malicious
Windows Exe (x86-32)
Close
a2scan.exe
malicious
SHA256:
e49fc7730543215680c1327fe39fa874241f35265ba38a771420fb6228de1ecf
VMRay Threat Identifiers
Close
Severity
Operation
5/5
Adds a hook to a web browser
5/5
Malicious content matched by YARA rules
4/5
Malicious host or URL detected via reputation
4/5
Modifies control flow of another process
4/5
Malicious file detected via reputation
4/5
Writes into the memory of another process
3/5
Event Triggered Execution
2/5
Tries to detect debugger
2/5
Tries to detect application sandbox
1/5
Performs DNS request
1/5
Downloads file
1/5
Resolves API functions dynamically
1/5
Overwrites code
1/5
A monitored process crashed
1/5
Drops PE file
1/5
Executes dropped PE file
1/5
Timestamp manipulation
1/5
Checks Internet connection
1/5
Modifies operating system directory
1/5
Creates process with hidden window
1/5
Tries to detect debugger
1/5
Creates a page with write and execute permissions
1/5
Installs system startup script or application
1/5
Enumerates running processes
1/5
Query OS Information
1/5
Reads system data
1/5
Queries system time
1/5
Creates mutex
1/5
Modifies application directory
1/5
Opens mutex
Spyware
Downloader
Injector
92tkzr9b4.exe
2026-10-21T19:44:37.656
malicious
Windows Exe (x86-64)
Close
92tkzr9b4.exe
malicious
SHA256:
e0ad46e3dfe7b0ab77c99829205cfbb745f5356b2c0178ed06b5f3779af3221a
VMRay Threat Identifiers
Close
Severity
Operation
5/5
Combination of other detections shows configuration discovery
4/5
Malicious file detected via reputation
3/5
Takes screenshot
2/5
Searches for cryptocurrency wallet locations
2/5
Peripheral Device Discovery
2/5
Searches for sensitive remote access configuration data
2/5
Reads network adapter information
2/5
Searches for sensitive password manager data
2/5
Tries to detect analyzer sandbox
2/5
Reads installed applications
2/5
Searches for sensitive browser data
2/5
Searches for sensitive mail data
2/5
Searches for sensitive application data
2/5
Suspicious content matched by YARA rules
2/5
Reads sensitive mail data
1/5
Query CPU Properties
1/5
Creates mutex
1/5
Possibly does reconnaissance
1/5
Enumerates running processes
1/5
Queries system time
1/5
Tries to connect using an uncommon port
1/5
Content matched by YARA rules
1/5
Resolves API functions dynamically
1/5
Tries to detect virtual machine
1/5
Downloads executable
1/5
Reads system data
1/5
Query OS Information
Downloader