PowerShell malware hides XMRig payloads in the Registry, PNGs, and WAV files, enabling stealthy cryptomining and memory-only execution.