Post2.7z

Common files found inside post2.7z might include: .vbs or .js scripts (obfuscated).

The malware may copy itself to %APPDATA% or create a Scheduled Task. post2.7z

If the contents are executed in a sandbox, the typical lifecycle of a "post2" style artifact is: The user extracts post2.7z . Common files found inside post2

the execution of Windows Script Host ( .vbs , .js ) and .lnk files from non-standard directories. post2.7z