hh.exe

Microsoft HTML Help Executable file version info (xCyclopedia)

LOLBAS Download, Execute 10 Sigma rules name it 12 ATT&CK techniques 3 documented commands 12 known copies with hashes

How hh.exe is abused

documented by LOLBAS

Download T1105 Ingress Tool Transfer

Execute T1218.001 System Binary Proxy Execution: Compiled HTML File

Each abuse is LOLBAS's category and the options and words it uses; the full write-up is on LOLBAS's page for hh.exe.

3 documented commands

from LOLBAS, each read by the identifier

Download T1105 Ingress Tool Transfer User privileges

Open the target batch script with HTML Help.

HH.exe {REMOTEURL:.bat}

Identify

Trips 1 Sigma rule: highRemote CHM File Download/Execution Via HH.EXE by Nasreddine Bencherchali (Nextron Systems)

Execute T1218.001 System Binary Proxy Execution: Compiled HTML File User privileges

Executes specified executable with HTML Help.

HH.exe {PATH_ABSOLUTE:.exe}

Identify

Trips no Sigma process-creation rule.

Execute T1218.001 System Binary Proxy Execution: Compiled HTML File User privileges

Executes a remote .chm file which can contain commands.

HH.exe {REMOTEURL:.chm}

Identify

Trips 2 Sigma rules: highRemote CHM File Download/Execution Via HH.EXE by Nasreddine Bencherchali (Nextron Systems); lowHH.EXE Execution by E.M. Anhaus (originally from Atomic Blue Detections, Dan Beavin), oscd.community

2 of the 3 commands the identifier reads trip a Sigma process-creation rule; 1 trips none. These commands and their descriptions are from LOLBAS’s entry for hh.exe, by Oddvar Moe, at commit 2056cb766250 of 2026-09-26, under the GPL-3.0 and LOLBAS’s notice, with no warranty. Changed: Markdown is shown formatted. The source is in lolbas-gtfobins-commands.json.gz, and the full entry is on LOLBAS’s page for hh.exe. The identifier reads each with LOLBAS’s placeholders filled in: a URL as https://example.com/file, a share as \\192.0.2.10\share\file, a path as C:\Data\file and a command as calc.exe.

What detects it

Sigma process creation rules

highRemote CHM File Download/Execution Via HH.EXENasreddine Bencherchali (Nextron Systems)

highSuspicious HH.EXE ExecutionMaxim Pavlunin

lowHH.EXE ExecutionE.M. Anhaus (originally from Atomic Blue Detections, Dan Beavin), oscd.community

highSuspicious Shells Spawn by Java Utility KeytoolAndreas Hunkeler (@Karneades)

highSuspicious Processes Spawned by Java.EXEAndreas Hunkeler (@Karneades), Florian Roth

highSuspicious Microsoft OneNote Child ProcessTim Rauch (Nextron Systems), Nasreddine Bencherchali (Nextron Systems), Elastic (idea)

highSuspicious Outlook Child ProcessMichael Haag, Florian Roth (Nextron Systems), Markus Neis, Elastic, FPT.EagleEye Team

highSuspicious Microsoft Office Child ProcessFlorian Roth (Nextron Systems), Markus Neis, FPT.EagleEye Team, Vadim Khrykov, Cyb3rEng, Michael Haag, Christopher Peacock @securepeacock, @scythe_io

highSuspicious SYSTEM User Process CreationFlorian Roth (Nextron Systems), David ANDRE (additional keywords)

mediumPotentially Suspicious PowerShell Child ProcessesFlorian Roth (Nextron Systems), Tim Shelton

T1047Windows Management Instrumentation

T1059.001Command and Scripting Interpreter: PowerShell

T1059.003Command and Scripting Interpreter: Windows Command Shell

T1059.005Command and Scripting Interpreter: Visual Basic

T1059.007Command and Scripting Interpreter: JavaScript

T1105Ingress Tool Transfer

T1218System Binary Proxy Execution

T1218.001System Binary Proxy Execution: Compiled HTML File

T1218.010System Binary Proxy Execution: Regsvr32

T1218.011System Binary Proxy Execution: Rundll32

T1566Phishing

T1566.001Phishing: Spearphishing Attachment

Is it the real hh.exe?

file version info and known copies

Installed inC:\Windows\
C:\Windows\SysWOW64\

Signed byMicrosoft Windows

ProductHTML Help, Microsoft Corporation

DescriptionMicrosoft HTML Help Executable

12 known copies

10.0.22000.1 (WinBuild.160101.0800) · C:\WINDOWS\SysWOW64\hh.exe · signed by Microsoft Windows

84034424e42017cf34897659e698c402fc42bf3339c1b3c3afe06fed54286820

10.0.22000.1 (WinBuild.160101.0800) · C:\WINDOWS\hh.exe · signed by Microsoft Windows

ae52df2a8d4cbeae82e2311edcfe035de28df126e962b10009c4ae133818a846

10.0.19041.1 (WinBuild.160101.0800) · C:\Windows\SysWOW64\hh.exe · signed by Microsoft Windows

a83add413df07efb9a6609f1b2d677521b5060e2d01678b3cdbf6b805592efd5

10.0.19041.1 (WinBuild.160101.0800) · C:\Windows\hh.exe · signed by Microsoft Windows

eb63fd45ed7ec773eccaf0f20d44bc9b4ed0a3e01779d62321b1da954a0f6eb8

10.0.18362.1 (WinBuild.160101.0800) · C:\WINDOWS\SysWOW64\hh.exe · signed by Microsoft Windows

14d84e388e265ab531320ed11fb386249b0e4de5d1075c525470304e1cd125a0

10.0.18362.1 (WinBuild.160101.0800) · C:\WINDOWS\hh.exe · signed by Microsoft Windows

85518d00317a597dc83ee3fb78743538b9444664273bd592df16603d2c3e4c28

10.0.17763.1 (WinBuild.160101.0800) · C:\Windows\hh.exe · signed by Microsoft Windows

8ab2f9a4ca87575f03f554aeed6c5e0d7692fa9b5d420008a1521f7f7bd2d0a5

10.0.17763.1 (WinBuild.160101.0800) · C:\Windows\SysWOW64\hh.exe · signed by Microsoft Windows

974c70fa3cafb802cca0a4d2d01a84facb9cf66c8edfc5f69d3514bb5488783d

10.0.14393.0 (rs1_release.160715-1616) · C:\Windows\hh.exe · signed by Microsoft Windows

9823d79e936b57c94bfb84383cc708bfc15d1d16e67f6cb119b60f28b01bfa63

10.0.14393.0 (rs1_release.160715-1616) · C:\Windows\SysWOW64\hh.exe · signed by Microsoft Windows

9d3a1f81f652524c9e7eed7ae6548fa43963715355720195c2f9be8766e20508

6.3.9600.16384 (winblue_rtm.130821-1623) · C:\windows\SysWOW64\hh.exe · not signed

bee011f3fe9711abf80f4fff607b5e1809ef62f0430985bf0ec96ec83f20151d

6.3.9600.16384 (winblue_rtm.130821-1623) · C:\windows\hh.exe · not signed

d0ca9a2d7968065ffc93d10b6848fe05df5dfa59d4f0a4b3083a95f46e9cb5f2

From the file’s version info and the copies recorded by xCyclopedia (MIT). A copy in another folder, signed by someone else or with another hash is not necessarily malicious, but it is worth a closer look. In Ceplin, "<sha256>".whatis() says which known copy a hash is.

hh.exe

How hh.exe is abused

3 documented commands

What detects it

Is it the real hh.exe?

12 known copies

Other programs abused for Download