fb17f6bd188428ec7e445e493309efd128fa625529a3166b058a5f53331c0a39

Analysis

max time kernel
149s
max time network
157s
platform
windows10-2004_x64
resource
win10v2004-20260911-en
resource tags

arch:x64arch:x86image:win10v2004-20260911-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
16/10/2026, 21:30

Target
About/Teka/Help/en-US/Help/mui/0409/cliconf.chm
Size 92KB
Sample261016-1cs4aaxt7j
SHA256 fb17f6bd188428ec7e445e493309efd128fa625529a3166b058a5f53331c0a39
MD5 c15c2d987ac0936962cffc215ed54318
SHA1 8022fee5e72f50f88fc1a9ec9d50e60508518bdc
SHA512 ddd0fcf90673d5e00db0408d1dad5ed792d19d4139cf29ea73dc65ee02ba847ed56219fbc1e680283c44754917c9527b66298cd5c2d34126aa2088f01c74541c
SSDEEP 1536:P8CziCngtVu9AyMdvd6C/22JWBs4zw0DBSC:kCziCYVut4l64f4EsBSC
TLSH
T16593F1B0E5B68473D347CA3AB70196EBD42D2E4EDD23C2E4F2D50561B631308E5D8A76
MD5 SHA1 SHA512 SSDEEP TLSH

Score

1^/10

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
820	hh.exe
820	hh.exe

C:\Windows\hh.exe
"C:\Windows\hh.exe" C:\Users\Admin\AppData\Local\Temp\About\Teka\Help\en-US\Help\mui\0409\cliconf.chm
1⤵
- Suspicious use of SetWindowsHookEx
PID:820

hh.dat

Path C:\Users\Admin\AppData\Roaming\Microsoft\HTML Help\hh.dat
Size 8KB
SHA256 a8077f1061de1025f27dea373c078ea3beccf67f03ddf9c81fe1f258e0c70eef
MD5 3830c444137920250c8078c4dbd96a80
SHA1 27bfe1100d4f13a241ee68c577e4284da8f3f526
SHA512 d7b7bb8f6710ec475fc6571526d2535929638f3b6ddf08da73a7c79985681dc5c55507c1ee9e74c4ceb6681c251baf9be957c36cf80eb607a90a69335d62f4a1
SSDEEP 12:jCm6ysNMqiNMvyc0Ke0l6eohI+KKe+KjK9zh+KlE/KlEvt+KlEvdX:Ex5yc0JQ1V2FlEClEvt1lEvdX
TLSH
T1E7026D3072208120E01D8B37FFDA958B75247D42BE94851B300EF75E45B9E0E6BB05EE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download