hh.exe 打开chm文件的sysmon数据采集

hh.exe是微软windows系统程序，.chm扩展名的帮助文件默认是用hh.exe打开。如果用户此时并没有查看chm格式的电子书文件或帮助文件，hh.exe又在进程中反复出现，则可能中了hh.exe病毒。在正常情况下不建议用户对该类文件（hh.exe）进行随意的修改。它的存在对维护计算机系统的稳定具有重要作用。

直接双击打开：python395.chm，从下面sysmon日志看，其实和后面cmd里去打开没有什么区别。

FileVersion: 10.0.19041.1 (WinBuild.160101.0800)
Description: Microsoft® HTML Help Executable
Product: HTML Help
Company: Microsoft Corporation
OriginalFileName: HH.exe
CommandLine: "C:\Windows\hh.exe" C:\Users\bonel\Desktop\python395.chm
CurrentDirectory: C:\Users\bonel\Desktop\
User: DESKTOP-CIBNM6P\bonel
LogonGuid: {d418462b-b8ad-6268-818c-030000000000}
LogonId: 0x38C81
TerminalSessionId: 1
IntegrityLevel: Medium
Hashes: MD5=2C8FE78D53C8CA27523A71DFD2938241,SHA256=EB63FD45ED7EC773ECCAF0F20D44BC9B4ED0A3E01779D62321B1DA954A0F6EB8,IMPHASH=D3D9C3E81A404E7F5C5302429636F04C
ParentProcessGuid: {d418462b-b8b5-6268-3f00-000000000a00}
ParentProcessId: 1960
ParentImage: C:\Windows\explorer.exe
ParentCommandLine: C:\Windows\Explorer.EXE
ParentUser: DESKTOP-CIBNM6P\bonel

 通过cmd里去运行:hh python395.chm

Process Create:
RuleName: -
UtcTime: 2022-04-27 07:09:28.863
ProcessGuid: {d418462b-ec28-6268-f209-000000000a00}
ProcessId: 2168
Image: C:\Windows\hh.exe
FileVersion: 10.0.19041.1 (WinBuild.160101.0800)
Description: Microsoft® HTML Help Executable
Product: HTML Help
Company: Microsoft Corporation
OriginalFileName: HH.exe
CommandLine: hh  python395.chm
CurrentDirectory: C:\Users\bonel\Desktop\
User: DESKTOP-CIBNM6P\bonel
LogonGuid: {d418462b-b8ad-6268-818c-030000000000}
LogonId: 0x38C81
TerminalSessionId: 1
IntegrityLevel: Medium
Hashes: MD5=2C8FE78D53C8CA27523A71DFD2938241,SHA256=EB63FD45ED7EC773ECCAF0F20D44BC9B4ED0A3E01779D62321B1DA954A0F6EB8,IMPHASH=D3D9C3E81A404E7F5C5302429636F04C
ParentProcessGuid: {d418462b-e0f9-6268-7809-000000000a00}
ParentProcessId: 6008
ParentImage: C:\Windows\System32\cmd.exe
ParentCommandLine: "C:\Windows\system32\cmd.exe" 
ParentUser: DESKTOP-CIBNM6P\bonel