Actor
Threat actors, including APT41, abuse the native Windows HTML Help application (hh.exe) to decompile CHM files for staging malicious payloads or bypassing security controls.