yep! I've found out browsing hacking/spamming site and i've found something too good to be true, it downloaded archive nested inside other archive and in it was silngle .lnk file leading to "the resource". Peeking inside i've found powershell executing base64 (or base32?) encoded script (it's got commandline option for that. if you want to ask wtf ask microsoft, and tell me), it dl'd some exe from some site and ran it, site was down alredy.