Technical Information
- [<HKCU>\Software\Microsoft\Windows NT\CurrentVersion\Winlogon] 'Shell' = 'explorer.exe,"%APPDATA%\extrac32.exe",'
- regasm.exe
- %APPDATA%\extrac32.exe
- %TEMP%\regasm.exe
- '%TEMP%\regasm.exe'
- '%WINDIR%\syswow64\windowspowershell\v1.0\powershell.exe' Start-Sleep -s 5; Remove-Item -Path "<Full path to file>" -Force' (with hidden window)
- '%WINDIR%\syswow64\windowspowershell\v1.0\powershell.exe' Start-Sleep -s 5; Remove-Item -Path "<Full path to file>" -Force