A suspicious HWP/OLE file contained shellcode that decoded an embedded payload and downloaded additional malware from a server at 211.218.126.236. The downloaded component was identified as a hwdoor downloader that saved svrc.exe under a temporary path and retrieved both alibaba.exe and another HWP-themed file. The excerpt says alibaba.exe was UPX-packed malware that created mutexes and communicated with the C2 path youngs.dgweb.kr/skin15/include/bin/forlab.php to perform malicious activity. The record provides concrete URLs and file hashes for defenders to triage, but it does not state a threat actor or DPRK attribution.