If HWP.exe is found running on the system, the malware finds the currently open file in HWP by extracting the file path from the command-line argument passed to HWP.exe This word file (usually named *.hwp) is copied into the temporary file path  C:\DOCUME~1\<username>\LOCALS~1\Temp\2.hwp  hwp is an exact copy of the file loaded into HWP.exe The malware reads the contents of 2.hwp and finds an “MZ magic marker” in the file indicated by the string “JOYBERTM”   Checking for the MZ marker in the HWP file