d54780bf22e747ec74bc4d093aeaba357258d15fa805a398b4d2571e3e341b65

Analysis

max time kernel
149s
max time network
141s
platform
windows10-2004_x64
resource
win10v2004-20260911-en
resource tags

arch:x64arch:x86image:win10v2004-20260911-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
13/11/2026, 04:03

Target
YQArch_big5/sys/yqhelp.chm
Size 2.9MB
Sample261113-emb2vszw2k
SHA256 d54780bf22e747ec74bc4d093aeaba357258d15fa805a398b4d2571e3e341b65
MD5 316614277f5a6476cd9f781054e9a967
SHA1 425d5dcc09d5182544589b65a921ef6a98a5154d
SHA512 c1397d28db457e03a3f4dfec246891b2afed1f7dbad9e7ae172bd5981eaf9dbed6664d331d5680139283ee33da34d3820b4e2293991cb9a11d07999c753aa871
SSDEEP 49152:kNFvVVOGeRlRZ8BDFfaauDpVqJgfC1XqBIGcnTjl+QfGCXRP6m6JW9X73Xcqyu4G:w3Uvv8hQaYfC1XqWR/uKb6Q9X73sn59m
TLSH
T134E53316C8C29CF6CAC49CBBB8F1D06EF97E7698B13B80EC40B4599D176339C0579626
MD5 SHA1 SHA512 SSDEEP TLSH

Score

1^/10

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
3668	hh.exe
3668	hh.exe

C:\Windows\hh.exe
"C:\Windows\hh.exe" C:\Users\Admin\AppData\Local\Temp\YQArch_big5\sys\yqhelp.chm
1⤵
- Suspicious use of SetWindowsHookEx
PID:3668

hh.dat

Path C:\Users\Admin\AppData\Roaming\Microsoft\HTML Help\hh.dat
Size 8KB
SHA256 67f6c9f3267591d2e3e3c26ae939e0c64f47a3ad1aafa9f11f94b6302f3288d7
MD5 0695e0166a28a6e0a803a708e4159fbd
SHA1 b3a29f4a6422b317cbf805de78fcad9d9f364f17
SHA512 d9af131d556f4f5b5039881fe53e2d54a4464d72add099b9b85752270d883fcf2255529b1c56b63bb4bc4da69480902cbae9a59e24fdf7d6334ee76bd2959438
SSDEEP 12:M6m6ysNMqiNMvyc0Ke0l6eohI+KKe+KjK9zh+KlE/KlEvt+KlEvdX:zx5yc0JQ1V2FlEClEvt1lEvdX
TLSH
T163026D3072208120E00D8B37FFDA958B75247D42AE94851B300EF75E45B9E1E5BB05EE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download