Word documents with the following classid: {EAB22AC3-30C1-11CF-A7EB-0000C05BAE0B} Related infrastructure: workaj[.]com wordzmncount[.]com Not all attacks require chaining multiple 0-day exploits to be successful.