Technical Information
- whqna.exe
- %APPDATA%\whqna.exe
- %APPDATA%\install\host.exe
- http://do##a.games/19.exe
- DNS ASK do##a.games
- '%APPDATA%\whqna.exe'
- '%APPDATA%\whqna.exe' 2 1364 1132921
- '%APPDATA%\install\host.exe'
- '%WINDIR%\syswow64\windowspowershell\v1.0\powershell.exe' -ExecutionPolicy bypass -WindowStyle hidden -nologo $kMfLnTnVDLqQpks = [System.Environment]::OSVersion.Version | Select -Expand Major;$AMrxOauF = [System.Environment]::OSVersion.Version | Selec...' (with hidden window)