Usually contains an executable ( .exe ), a shortcut file ( .lnk ), or a heavily obfuscated PowerShell script.
If you are analyzing this in a sandbox, look for these specific markers: Zoliboys_New_Assistant.zip
Creation of a scheduled task named something generic like "AssistantUpdate." Usually contains an executable (