This marker indicates the presence of an encrypted MZ marker in the .hwp file and is decrypted by the malware and written to the Startup folder for the user:  C:\Documents and Settings\<username>\Start Menu\Programs\Startup\viso.exe  This step establishes the persistence of the malware across reboots on the endpoint Once the decrypted MZ marker is written to the Startup folder, the 2.hwp is deleted from the endpoint  The malware might perform this activity for a couple of reasons:  Establish persistence for itself on the endpoint Establish persistence of another component of the malware on the endpoint Update itself on endpoint after a separate updater component downloads the update from the control server  The malware has limited reconnaissance and data-gathering capabilities and is not full-fledged spyware