If a malicious file is opened, a script will install the malware as a .exe file in a temporary folder, alongside a .jpg file containing LokiBot source code.