51f88806eb56e2cbd527c3ecd484f575aad9a3daf4bf1c8543274e5c93096d11

Analysis

max time kernel
149s
max time network
145s
platform
windows10-2004_x64
resource
win10v2004-20260911-en
resource tags

arch:x64arch:x86image:win10v2004-20260911-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
13/11/2026, 04:03

Target
YQArch_big5/sys/donate.chm
Size 97KB
Sample261113-emb2vszw2k
SHA256 51f88806eb56e2cbd527c3ecd484f575aad9a3daf4bf1c8543274e5c93096d11
MD5 ceb906780bd3e0e04c4af21dbc272618
SHA1 a73185fd4ede484456fff2d92b011d33196692cb
SHA512 13c146e78a8f551e52122474368621a670f9414ce2e250e64056a911c491c32eae7b69c89770f74689a4616aefeeeec1e154f9f23aaff490d8c06b05976df539
SSDEEP 3072:xyZQjgWA9O7C++ZSY9hKQs6TDYs1+cACtaIYz4qx:xyGjPA0W++aeQAq48
TLSH
T19BA3021962FFD369C37D0972AA0F7682E3E2AE2211151FFA1BC1573E1DBC409DB64660
MD5 SHA1 SHA512 SSDEEP TLSH

Score

1^/10

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
4052	hh.exe
4052	hh.exe

C:\Windows\hh.exe
"C:\Windows\hh.exe" C:\Users\Admin\AppData\Local\Temp\YQArch_big5\sys\donate.chm
1⤵
- Suspicious use of SetWindowsHookEx
PID:4052

hh.dat

Path C:\Users\Admin\AppData\Roaming\Microsoft\HTML Help\hh.dat
Size 8KB
SHA256 038ae5b81d1f0d9e2226ac82280e6737550563705edc0a70f9cea28673506350
MD5 671e5e24b08008bdc473ef10a70464bf
SHA1 adf6ea6298556140f9bc383c8a9bb5daa1f2867e
SHA512 c4c17811fd48b73a61252f7c22e3ef7464e273ed7dd2ef022530010e96b3dbca95f212696818e58df1822893e1b7b37215276ce798c611f4c6d88d473f7cb931
SSDEEP 12:pm6ysNMqiNMvyc0Ke0l6eohI+KKe+KjK9zh+KlE/KlEvt+KlEvdX:Tx5yc0JQ1V2FlEClEvt1lEvdX
TLSH
T12A02493072208120E00D8B37BFDA958B75257D42AE94855B300EF75E45B9E1E5BB09EE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download