Either via the LNK after startup, or directly via the VBS, the command line “wscript.exe //B //E:vbs C:\Users\Public\Favorites\desktop.ini” is executed, referencing the helper file dropped by the sample mentioned above. Finally, the file C:\Users\Public\ignit.vbs is deleted after execution.