CHM denotes malicious Windows Compiled HTML Help files used as initial-stage containers rather than one discrete malware family. Kimsuky-linked samples displayed Korean-language decoys while embedded HTML, JavaScript, or ActiveX shortcuts launched hidden PowerShell, wrote encoded data, used certutil to decode VBScript, and executed it with wscript. Subsequent stages profiled hosts, enumerated processes and directories, established scheduled-task persistence, exfiltrated inventories, and retrieved payloads such as BabyShark or a PowerShell keylogger.