hwdoor is an antivirus detection label applied to Windows malware delivered through Korean HWP and Excel documents, not a clearly bounded family. COVID-19-themed lures used embedded DLLs, fileless XSL execution through WMIC, scheduled tasks, and additional payload downloads. Another chain used curl, certutil, and rundll32 to retrieve, decode, and launch a DLL. An earlier HWP sample dropped a downloader and installed a UPX-packed executable named alibaba.exe in the Startup folder; that payload created a mutex, contacted a PHP command-and-control endpoint, and downloaded further HWP files.