The excerpt describes a malicious HWP/EPS document saved in October 2018 that used shellcode encoded with a 16-byte XOR key to download additional payloads. The delivery chain retrieved follow-on malicious code from WordPress plugin-themed paths on flydashi[.]com, including akism1[.]pgi and akism2[.]pgi. Additional callback or staging infrastructure is listed on theinspectionconsultant[.]com, danagloverinteriors[.]com, and as-brant[.]ru under plugin or theme-like PHP paths. The available evidence is sparse but provides hashes, payload filenames, and download URLs that can support detection and retrospective hunting for Manuscrypt-related activity if the source context supports that association.