Technical Information
- [<HKLM>\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run] 'Google updater' = '%LOCALAPPDATA%\Google\Chrome\chromeupdater.exe /instlRef=cm9qb3wxMDI3ODgzYTA0MzgyY2U2MmExZGRjOTU1OGJjOGI= ...
- [<HKLM>\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\RunOnce] 'MSSE' = '%LOCALAPPDATA%\mysocialcolor.exe /S /rvt /uninstallAll /mds /enblChx /aflt=14396 /instlRef=cm9qb3wxMDI3ODgzYTA0M...
- %TEMP%\is-2fhir.tmp\<File name>.tmp
- %TEMP%\is-dg6tp.tmp\_isetup\_setup64.tmp
- %TEMP%\is-dg6tp.tmp\_isetup\_shfoldr.dll
- %TEMP%\is-dg6tp.tmp\itdownload.dll
- %TEMP%\is-dg6tp.tmp\chromeupdater.exe
- %LOCALAPPDATA%\google\chrome\chromeupdater.exe
- %LOCALAPPDATA%\mysocialcolor.exe
- 'vf####.earching.info':80
- http://vf####.earching.info/toolbar
- DNS ASK vf####.earching.info
- '%TEMP%\is-2fhir.tmp\<File name>.tmp' /SL5="$B0236,646957,56832,<Full path to file>"