Troj/EyeStye-M exhibits the following characteristics:
File Information
- Size
- 196K
- SHA-1
- f8a82cb251b4c2fa7dc122bb904deb631ae628ba
- MD5
- 48af07650f386844d1a41782b32a74af
- CRC-32
- 39f857c9
- File type
- Windows executable
- First seen
- 2011-09-21
Runtime Analysis
Registry Keys Created
- HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\3
- 1409
- 0x00000003
- HKCU\Software\Microsoft\Internet Explorer\Recovery
- ClearBrowsingHistoryOnExit
- 0x00000000
- HKEY_USERS\.DEFAULT\Software\Microsoft Windows
- 00000056655C5082
- □□□□r□□h□□h□□o□□l□□l□□n□□n□0c□0c□px□□,□□/□0&□`T□□A□□□□ □□□□□□□□□r□□i□`Q□@M□□)□□2□0-□□)□□)□□X□□:□□<□□K□□J□05□@@□□□□P□□□□□□□□@□□P□□@□□p□□□□□□□□0□□□□□P□□□□□@□□□□□□□□□□□□□□□□□□□□□□□P□□P□□□□□□□□□□□□□□`□□@□□ □□0□□□□□□□□□□□p□□□□□□□□P□□□□□□□□□□□□□□□,□□□□P%□ V□`V□□□□□y□□□□□v□`□□ s□0□□□e□PE□P□□□x□□□□Pp□□□□□□□□□□□□□p)□□□□□□□□□□□W□PQ□ B□ B□□^□□□□P□□□d□p□□□□□□g□`h□□z□□|□□F□□K□□y□□|□□K□□K□□Z□□Z□
- HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings
- WarnOnIntranet
- 0x00000000
- HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\2
- 1409
- 0x00000003
- HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\1
- 1409
- 0x00000003
- HKEY_USERS\S-1-5-18\Software\Microsoft Windows
- 00000056655C5082
- □□□□r□□h□□h□□o□□l□□l□□n□□n□0c□0c□px□□,□□/□0&□`T□□A□□□□ □□□□□□□□□r□□i□`Q□@M□□)□□2□0-□□)□□)□□X□□:□□<□□K□□J□05□@@□□□□P□□□□□□□□@□□P□□@□□p□□□□□□□□0□□□□□P□□□□□@□□□□□□□□□□□□□□□□□□□□□□□P□□P□□□□□□□□□□□□□□`□□@□□ □□0□□□□□□□□□□□p□□□□□□□□P□□□□□□□□□□□□□□□,□□□□P%□ V□`V□□□□□y□□□□□v□`□□ s□0□□□e□PE□P□□□x□□□□Pp□□□□□□□□□□□□□p)□□□□□□□□□□□W□PQ□ B□ B□□^□□□□P□□□d□p□□□□□□g□`h□□z□□|□□F□□K□□y□□|□□K□□K□□Z□□Z□
- HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\4
- 1409
- 0x00000003
- HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\0
- 1409
- 0x00000003
- HKCU\Software\Microsoft\Internet Explorer\PhishingFilter
- ShownServiceDownBalloon
- 0x00000000
Registry Keys Modified
- HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Lockdown_Zones\4
- 1406
- 0x00000000
- HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\4
- 1609
- 0x00000000
- HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Lockdown_Zones\1
- 1406
- 0x00000000
- HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Lockdown_Zones\3
- 1406
- 0x00000000
- HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\0
- 1609
- 0x00000000
- HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\1
- 1609
- 0x00000000
- HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\2
- 1609
- 0x00000000
- HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings
- WarnOnPost
- 00 00 00 00
Processes Created
- c:\svchost\3d1a3642448.exe
IP Connections
DNS Requests