Cryptolaemus on Twitter: "#Emotet Update - Looks like Ivan has changed things again and @Max_Mal_ caught them. Now the LNKs are calling Powershell.exe directly in the normal location for a typical Windows install under system32. No more appended VBS appended to the end of the file. 1/x" / Twitter
https://twitter.com/Cryptolaemus1/status/1518757775081365504