Technical Information
Modifies file system
Sets the 'hidden' attribute to the following files
- C:\users\default\appdata\msge.exe
Moves itself
- from <Full path to file> to C:\users\default\appdata\msge.exe
Network activity
Connects to
- '<LOCALNET>.85.62':0
Miscellaneous
Creates and executes the following
- '%WINDIR%\syswow64\cmd.exe' /c attrib +h +s +r C:\Users\Default\AppData\MsgE.exe' (with hidden window)
Executes the following
- '%WINDIR%\syswow64\cmd.exe' /c attrib +h +s +r C:\Users\Default\AppData\MsgE.exe
- '%WINDIR%\syswow64\attrib.exe' +h +s +r C:\Users\Default\AppData\MsgE.exe
