Technical Information
Malicious functions
Registers BHO
- [<HKLM>\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{db57894d-8ad1-4bd0-a930-a08ef15c4b84}]
Modifies file system
Creates the following files
- %TEMP%\7b8540af\iczpg2gv0th5ch8.dat
- C:\users\aspnet\appdata\local\torch\user data\default\extensions\phkcagmcmpdnhjhgkcaicaofigljoijo\5.2\izkb3xd.js
- C:\users\aspnet\appdata\local\torch\user data\default\extensions\phkcagmcmpdnhjhgkcaicaofigljoijo\5.2\lsdb.js
- C:\users\aspnet\appdata\local\torch\user data\default\extensions\phkcagmcmpdnhjhgkcaicaofigljoijo\5.2\manifest.json
- C:\users\guest\appdata\local\torch\user data\default\extensions\phkcagmcmpdnhjhgkcaicaofigljoijo\5.2\background.html
- C:\users\guest\appdata\local\torch\user data\default\extensions\phkcagmcmpdnhjhgkcaicaofigljoijo\5.2\content.js
- C:\users\guest\appdata\local\torch\user data\default\extensions\phkcagmcmpdnhjhgkcaicaofigljoijo\5.2\izkb3xd.js
- C:\users\guest\appdata\local\torch\user data\default\extensions\phkcagmcmpdnhjhgkcaicaofigljoijo\5.2\lsdb.js
- C:\users\guest\appdata\local\torch\user data\default\extensions\phkcagmcmpdnhjhgkcaicaofigljoijo\5.2\manifest.json
- C:\users\homegroupuser$\appdata\local\torch\user data\default\extensions\phkcagmcmpdnhjhgkcaicaofigljoijo\5.2\background.html
- C:\users\homegroupuser$\appdata\local\torch\user data\default\extensions\phkcagmcmpdnhjhgkcaicaofigljoijo\5.2\content.js
- C:\users\homegroupuser$\appdata\local\torch\user data\default\extensions\phkcagmcmpdnhjhgkcaicaofigljoijo\5.2\izkb3xd.js
- C:\users\homegroupuser$\appdata\local\torch\user data\default\extensions\phkcagmcmpdnhjhgkcaicaofigljoijo\5.2\lsdb.js
- C:\users\homegroupuser$\appdata\local\torch\user data\default\extensions\phkcagmcmpdnhjhgkcaicaofigljoijo\5.2\manifest.json
- %LOCALAPPDATA%\torch\user data\default\extensions\phkcagmcmpdnhjhgkcaicaofigljoijo\5.2\background.html
- %LOCALAPPDATA%\torch\user data\default\extensions\phkcagmcmpdnhjhgkcaicaofigljoijo\5.2\content.js
- C:\users\aspnet\appdata\local\torch\user data\default\extensions\phkcagmcmpdnhjhgkcaicaofigljoijo\5.2\content.js
- %LOCALAPPDATA%\torch\user data\default\extensions\phkcagmcmpdnhjhgkcaicaofigljoijo\5.2\izkb3xd.js
- C:\users\aspnet\appdata\local\torch\user data\default\extensions\phkcagmcmpdnhjhgkcaicaofigljoijo\5.2\background.html
- C:\users\administrator\appdata\local\torch\user data\default\extensions\phkcagmcmpdnhjhgkcaicaofigljoijo\5.2\lsdb.js
- C:\users\guest\appdata\local\google\chrome sxs\user data\default\extensions\phkcagmcmpdnhjhgkcaicaofigljoijo\5.2\lsdb.js
- C:\users\guest\appdata\local\google\chrome sxs\user data\default\extensions\phkcagmcmpdnhjhgkcaicaofigljoijo\5.2\manifest.json
- C:\users\homegroupuser$\appdata\local\google\chrome sxs\user data\default\extensions\phkcagmcmpdnhjhgkcaicaofigljoijo\5.2\background.html
- C:\users\homegroupuser$\appdata\local\google\chrome sxs\user data\default\extensions\phkcagmcmpdnhjhgkcaicaofigljoijo\5.2\content.js
- C:\users\homegroupuser$\appdata\local\google\chrome sxs\user data\default\extensions\phkcagmcmpdnhjhgkcaicaofigljoijo\5.2\izkb3xd.js
- C:\users\homegroupuser$\appdata\local\google\chrome sxs\user data\default\extensions\phkcagmcmpdnhjhgkcaicaofigljoijo\5.2\lsdb.js
- C:\users\homegroupuser$\appdata\local\google\chrome sxs\user data\default\extensions\phkcagmcmpdnhjhgkcaicaofigljoijo\5.2\manifest.json
- %LOCALAPPDATA%\google\chrome sxs\user data\default\extensions\phkcagmcmpdnhjhgkcaicaofigljoijo\5.2\background.html
- %LOCALAPPDATA%\google\chrome sxs\user data\default\extensions\phkcagmcmpdnhjhgkcaicaofigljoijo\5.2\content.js
- %LOCALAPPDATA%\google\chrome sxs\user data\default\extensions\phkcagmcmpdnhjhgkcaicaofigljoijo\5.2\izkb3xd.js
- %LOCALAPPDATA%\google\chrome sxs\user data\default\extensions\phkcagmcmpdnhjhgkcaicaofigljoijo\5.2\lsdb.js
- %LOCALAPPDATA%\google\chrome sxs\user data\default\extensions\phkcagmcmpdnhjhgkcaicaofigljoijo\5.2\manifest.json
- C:\users\administrator\appdata\local\torch\user data\default\extensions\phkcagmcmpdnhjhgkcaicaofigljoijo\5.2\background.html
- C:\users\administrator\appdata\local\torch\user data\default\extensions\phkcagmcmpdnhjhgkcaicaofigljoijo\5.2\content.js
- C:\users\administrator\appdata\local\torch\user data\default\extensions\phkcagmcmpdnhjhgkcaicaofigljoijo\5.2\izkb3xd.js
- C:\users\administrator\appdata\local\torch\user data\default\extensions\phkcagmcmpdnhjhgkcaicaofigljoijo\5.2\manifest.json
- C:\users\homegroupuser$\appdata\local\chromatic browser\user data\default\extensions\phkcagmcmpdnhjhgkcaicaofigljoijo\5.2\izkb3xd.js
- %ALLUSERSPROFILE%\priceless\iczpg2gv0th5ch8.dat
- C:\users\administrator\appdata\local\chromatic browser\user data\default\extensions\phkcagmcmpdnhjhgkcaicaofigljoijo\5.2\background.html
- %LOCALAPPDATA%\chromatic browser\user data\default\extensions\phkcagmcmpdnhjhgkcaicaofigljoijo\5.2\background.html
- %LOCALAPPDATA%\chromatic browser\user data\default\extensions\phkcagmcmpdnhjhgkcaicaofigljoijo\5.2\content.js
- %LOCALAPPDATA%\chromatic browser\user data\default\extensions\phkcagmcmpdnhjhgkcaicaofigljoijo\5.2\izkb3xd.js
- %LOCALAPPDATA%\chromatic browser\user data\default\extensions\phkcagmcmpdnhjhgkcaicaofigljoijo\5.2\lsdb.js
- %LOCALAPPDATA%\chromatic browser\user data\default\extensions\phkcagmcmpdnhjhgkcaicaofigljoijo\5.2\manifest.json
- %WINDIR%\syswow64\grouppolicy\gpt.ini
- %APPDATA%\mozilla\firefox\profiles\gn7ryp3k.default\extensions\staged\rp@wvfb.edu\bootstrap.js
- %APPDATA%\mozilla\firefox\profiles\gn7ryp3k.default\extensions\staged\rp@wvfb.edu\chrome.manifest
- %APPDATA%\mozilla\firefox\profiles\gn7ryp3k.default\extensions\staged\rp@wvfb.edu\content\bg.js
- %APPDATA%\mozilla\firefox\profiles\gn7ryp3k.default\extensions\staged\rp@wvfb.edu\install.rdf
- %ProgramFiles(x86)%\priceless\2sp13hyvj47cfl.dll
- %ProgramFiles(x86)%\priceless\2sp13hyvj47cfl.tlb
- %ProgramFiles(x86)%\priceless\2sp13hyvj47cfl.dat
- %ProgramFiles(x86)%\priceless\2sp13hyvj47cfl.x64.dll
- %ALLUSERSPROFILE%\priceless\iczpg2gv0th5ch8.exe
- C:\users\homegroupuser$\appdata\local\chromatic browser\user data\default\extensions\phkcagmcmpdnhjhgkcaicaofigljoijo\5.2\manifest.json
- C:\users\guest\appdata\local\google\chrome sxs\user data\default\extensions\phkcagmcmpdnhjhgkcaicaofigljoijo\5.2\izkb3xd.js
- C:\users\homegroupuser$\appdata\local\chromatic browser\user data\default\extensions\phkcagmcmpdnhjhgkcaicaofigljoijo\5.2\lsdb.js
- C:\users\homegroupuser$\appdata\local\chromatic browser\user data\default\extensions\phkcagmcmpdnhjhgkcaicaofigljoijo\5.2\content.js
- C:\users\administrator\appdata\local\chromatic browser\user data\default\extensions\phkcagmcmpdnhjhgkcaicaofigljoijo\5.2\content.js
- C:\users\administrator\appdata\local\chromatic browser\user data\default\extensions\phkcagmcmpdnhjhgkcaicaofigljoijo\5.2\izkb3xd.js
- C:\users\administrator\appdata\local\chromatic browser\user data\default\extensions\phkcagmcmpdnhjhgkcaicaofigljoijo\5.2\lsdb.js
- C:\users\administrator\appdata\local\chromatic browser\user data\default\extensions\phkcagmcmpdnhjhgkcaicaofigljoijo\5.2\manifest.json
- C:\users\aspnet\appdata\local\chromatic browser\user data\default\extensions\phkcagmcmpdnhjhgkcaicaofigljoijo\5.2\background.html
- C:\users\aspnet\appdata\local\chromatic browser\user data\default\extensions\phkcagmcmpdnhjhgkcaicaofigljoijo\5.2\content.js
- C:\users\aspnet\appdata\local\chromatic browser\user data\default\extensions\phkcagmcmpdnhjhgkcaicaofigljoijo\5.2\izkb3xd.js
- C:\users\aspnet\appdata\local\chromatic browser\user data\default\extensions\phkcagmcmpdnhjhgkcaicaofigljoijo\5.2\lsdb.js
- C:\users\aspnet\appdata\local\chromatic browser\user data\default\extensions\phkcagmcmpdnhjhgkcaicaofigljoijo\5.2\manifest.json
- C:\users\guest\appdata\local\chromatic browser\user data\default\extensions\phkcagmcmpdnhjhgkcaicaofigljoijo\5.2\background.html
- C:\users\guest\appdata\local\chromatic browser\user data\default\extensions\phkcagmcmpdnhjhgkcaicaofigljoijo\5.2\content.js
- C:\users\guest\appdata\local\chromatic browser\user data\default\extensions\phkcagmcmpdnhjhgkcaicaofigljoijo\5.2\izkb3xd.js
- C:\users\guest\appdata\local\chromatic browser\user data\default\extensions\phkcagmcmpdnhjhgkcaicaofigljoijo\5.2\lsdb.js
- C:\users\guest\appdata\local\chromatic browser\user data\default\extensions\phkcagmcmpdnhjhgkcaicaofigljoijo\5.2\manifest.json
- C:\users\homegroupuser$\appdata\local\chromatic browser\user data\default\extensions\phkcagmcmpdnhjhgkcaicaofigljoijo\5.2\background.html
- %LOCALAPPDATA%\torch\user data\default\extensions\phkcagmcmpdnhjhgkcaicaofigljoijo\5.2\lsdb.js
- %LOCALAPPDATA%\torch\user data\default\extensions\phkcagmcmpdnhjhgkcaicaofigljoijo\5.2\manifest.json
- C:\users\guest\appdata\local\google\chrome sxs\user data\default\extensions\phkcagmcmpdnhjhgkcaicaofigljoijo\5.2\content.js
- %LOCALAPPDATA%\google\chrome\user data\default\extensions\phkcagmcmpdnhjhgkcaicaofigljoijo\5.2\lsdb.js
- C:\users\aspnet\appdata\local\google\chrome\user data\default\extensions\phkcagmcmpdnhjhgkcaicaofigljoijo\5.2\content.js
- C:\users\aspnet\appdata\local\google\chrome\user data\default\extensions\phkcagmcmpdnhjhgkcaicaofigljoijo\5.2\izkb3xd.js
- C:\users\aspnet\appdata\local\google\chrome\user data\default\extensions\phkcagmcmpdnhjhgkcaicaofigljoijo\5.2\lsdb.js
- C:\users\aspnet\appdata\local\google\chrome\user data\default\extensions\phkcagmcmpdnhjhgkcaicaofigljoijo\5.2\manifest.json
- C:\users\guest\appdata\local\google\chrome\user data\default\extensions\phkcagmcmpdnhjhgkcaicaofigljoijo\5.2\background.html
- C:\users\guest\appdata\local\google\chrome\user data\default\extensions\phkcagmcmpdnhjhgkcaicaofigljoijo\5.2\content.js
- C:\users\guest\appdata\local\google\chrome\user data\default\extensions\phkcagmcmpdnhjhgkcaicaofigljoijo\5.2\izkb3xd.js
- C:\users\guest\appdata\local\google\chrome\user data\default\extensions\phkcagmcmpdnhjhgkcaicaofigljoijo\5.2\lsdb.js
- C:\users\guest\appdata\local\google\chrome\user data\default\extensions\phkcagmcmpdnhjhgkcaicaofigljoijo\5.2\manifest.json
- C:\users\homegroupuser$\appdata\local\google\chrome\user data\default\extensions\phkcagmcmpdnhjhgkcaicaofigljoijo\5.2\background.html
- C:\users\homegroupuser$\appdata\local\google\chrome\user data\default\extensions\phkcagmcmpdnhjhgkcaicaofigljoijo\5.2\content.js
- C:\users\homegroupuser$\appdata\local\google\chrome\user data\default\extensions\phkcagmcmpdnhjhgkcaicaofigljoijo\5.2\izkb3xd.js
- C:\users\homegroupuser$\appdata\local\google\chrome\user data\default\extensions\phkcagmcmpdnhjhgkcaicaofigljoijo\5.2\lsdb.js
- C:\users\homegroupuser$\appdata\local\google\chrome\user data\default\extensions\phkcagmcmpdnhjhgkcaicaofigljoijo\5.2\manifest.json
- %LOCALAPPDATA%\google\chrome\user data\default\extensions\phkcagmcmpdnhjhgkcaicaofigljoijo\5.2\background.html
- C:\users\aspnet\appdata\local\google\chrome\user data\default\extensions\phkcagmcmpdnhjhgkcaicaofigljoijo\5.2\background.html
- %LOCALAPPDATA%\google\chrome\user data\default\extensions\phkcagmcmpdnhjhgkcaicaofigljoijo\5.2\content.js
- C:\users\administrator\appdata\local\google\chrome\user data\default\extensions\phkcagmcmpdnhjhgkcaicaofigljoijo\5.2\manifest.json
- C:\users\administrator\appdata\local\google\chrome\user data\default\extensions\phkcagmcmpdnhjhgkcaicaofigljoijo\5.2\izkb3xd.js
- %TEMP%\7b8540af\2sp13hyvj47cfl.dll
- %TEMP%\7b8540af\2sp13hyvj47cfl.tlb
- %TEMP%\7b8540af\2sp13hyvj47cfl.x64.dll
- %TEMP%\7b8540af\rp@wvfb.edu\content\bg.js
- %TEMP%\7b8540af\rp@wvfb.edu\bootstrap.js
- %TEMP%\7b8540af\rp@wvfb.edu\chrome.manifest
- %TEMP%\7b8540af\rp@wvfb.edu\install.rdf
- %TEMP%\7b8540af\phkcagmcmpdnhjhgkcaicaofigljoijo\izkb3xd.js
- %TEMP%\7b8540af\phkcagmcmpdnhjhgkcaicaofigljoijo\background.html
- %TEMP%\7b8540af\phkcagmcmpdnhjhgkcaicaofigljoijo\manifest.json
- %TEMP%\7b8540af\phkcagmcmpdnhjhgkcaicaofigljoijo\content.js
- %TEMP%\7b8540af\phkcagmcmpdnhjhgkcaicaofigljoijo\lsdb.js
- %LOCALAPPDATA%\google\chrome\user data\default\preferences__.tmp
- C:\users\administrator\appdata\local\google\chrome\user data\default\extensions\phkcagmcmpdnhjhgkcaicaofigljoijo\5.2\background.html
- C:\users\administrator\appdata\local\google\chrome\user data\default\extensions\phkcagmcmpdnhjhgkcaicaofigljoijo\5.2\content.js
- C:\users\administrator\appdata\local\google\chrome\user data\default\extensions\phkcagmcmpdnhjhgkcaicaofigljoijo\5.2\lsdb.js
- C:\users\homegroupuser$\appdata\local\comodo\dragon\user data\default\extensions\phkcagmcmpdnhjhgkcaicaofigljoijo\5.2\content.js
- C:\users\aspnet\appdata\local\google\chrome sxs\user data\default\extensions\phkcagmcmpdnhjhgkcaicaofigljoijo\5.2\manifest.json
- %LOCALAPPDATA%\google\chrome\user data\default\extensions\phkcagmcmpdnhjhgkcaicaofigljoijo\5.2\manifest.json
- C:\users\homegroupuser$\appdata\local\comodo\dragon\user data\default\extensions\phkcagmcmpdnhjhgkcaicaofigljoijo\5.2\manifest.json
- %LOCALAPPDATA%\comodo\dragon\user data\default\extensions\phkcagmcmpdnhjhgkcaicaofigljoijo\5.2\background.html
- %LOCALAPPDATA%\comodo\dragon\user data\default\extensions\phkcagmcmpdnhjhgkcaicaofigljoijo\5.2\content.js
- %LOCALAPPDATA%\comodo\dragon\user data\default\extensions\phkcagmcmpdnhjhgkcaicaofigljoijo\5.2\izkb3xd.js
- %LOCALAPPDATA%\comodo\dragon\user data\default\extensions\phkcagmcmpdnhjhgkcaicaofigljoijo\5.2\lsdb.js
- %LOCALAPPDATA%\comodo\dragon\user data\default\extensions\phkcagmcmpdnhjhgkcaicaofigljoijo\5.2\manifest.json
- C:\users\administrator\appdata\local\google\chrome sxs\user data\default\extensions\phkcagmcmpdnhjhgkcaicaofigljoijo\5.2\background.html
- C:\users\administrator\appdata\local\google\chrome sxs\user data\default\extensions\phkcagmcmpdnhjhgkcaicaofigljoijo\5.2\content.js
- C:\users\administrator\appdata\local\google\chrome sxs\user data\default\extensions\phkcagmcmpdnhjhgkcaicaofigljoijo\5.2\izkb3xd.js
- C:\users\administrator\appdata\local\google\chrome sxs\user data\default\extensions\phkcagmcmpdnhjhgkcaicaofigljoijo\5.2\lsdb.js
- C:\users\administrator\appdata\local\google\chrome sxs\user data\default\extensions\phkcagmcmpdnhjhgkcaicaofigljoijo\5.2\manifest.json
- C:\users\aspnet\appdata\local\google\chrome sxs\user data\default\extensions\phkcagmcmpdnhjhgkcaicaofigljoijo\5.2\background.html
- C:\users\aspnet\appdata\local\google\chrome sxs\user data\default\extensions\phkcagmcmpdnhjhgkcaicaofigljoijo\5.2\content.js
- C:\users\aspnet\appdata\local\google\chrome sxs\user data\default\extensions\phkcagmcmpdnhjhgkcaicaofigljoijo\5.2\izkb3xd.js
- C:\users\aspnet\appdata\local\google\chrome sxs\user data\default\extensions\phkcagmcmpdnhjhgkcaicaofigljoijo\5.2\lsdb.js
- C:\users\homegroupuser$\appdata\local\comodo\dragon\user data\default\extensions\phkcagmcmpdnhjhgkcaicaofigljoijo\5.2\lsdb.js
- C:\users\guest\appdata\local\google\chrome sxs\user data\default\extensions\phkcagmcmpdnhjhgkcaicaofigljoijo\5.2\background.html
- C:\users\homegroupuser$\appdata\local\comodo\dragon\user data\default\extensions\phkcagmcmpdnhjhgkcaicaofigljoijo\5.2\izkb3xd.js
- C:\users\homegroupuser$\appdata\local\comodo\dragon\user data\default\extensions\phkcagmcmpdnhjhgkcaicaofigljoijo\5.2\background.html
- C:\users\administrator\appdata\local\comodo\dragon\user data\default\extensions\phkcagmcmpdnhjhgkcaicaofigljoijo\5.2\background.html
- C:\users\administrator\appdata\local\comodo\dragon\user data\default\extensions\phkcagmcmpdnhjhgkcaicaofigljoijo\5.2\content.js
- C:\users\administrator\appdata\local\comodo\dragon\user data\default\extensions\phkcagmcmpdnhjhgkcaicaofigljoijo\5.2\izkb3xd.js
- C:\users\administrator\appdata\local\comodo\dragon\user data\default\extensions\phkcagmcmpdnhjhgkcaicaofigljoijo\5.2\lsdb.js
- C:\users\administrator\appdata\local\comodo\dragon\user data\default\extensions\phkcagmcmpdnhjhgkcaicaofigljoijo\5.2\manifest.json
- C:\users\aspnet\appdata\local\comodo\dragon\user data\default\extensions\phkcagmcmpdnhjhgkcaicaofigljoijo\5.2\background.html
- C:\users\aspnet\appdata\local\comodo\dragon\user data\default\extensions\phkcagmcmpdnhjhgkcaicaofigljoijo\5.2\content.js
- C:\users\aspnet\appdata\local\comodo\dragon\user data\default\extensions\phkcagmcmpdnhjhgkcaicaofigljoijo\5.2\izkb3xd.js
- C:\users\aspnet\appdata\local\comodo\dragon\user data\default\extensions\phkcagmcmpdnhjhgkcaicaofigljoijo\5.2\lsdb.js
- C:\users\aspnet\appdata\local\comodo\dragon\user data\default\extensions\phkcagmcmpdnhjhgkcaicaofigljoijo\5.2\manifest.json
- C:\users\guest\appdata\local\comodo\dragon\user data\default\extensions\phkcagmcmpdnhjhgkcaicaofigljoijo\5.2\background.html
- C:\users\guest\appdata\local\comodo\dragon\user data\default\extensions\phkcagmcmpdnhjhgkcaicaofigljoijo\5.2\content.js
- C:\users\guest\appdata\local\comodo\dragon\user data\default\extensions\phkcagmcmpdnhjhgkcaicaofigljoijo\5.2\izkb3xd.js
- C:\users\guest\appdata\local\comodo\dragon\user data\default\extensions\phkcagmcmpdnhjhgkcaicaofigljoijo\5.2\lsdb.js
- C:\users\guest\appdata\local\comodo\dragon\user data\default\extensions\phkcagmcmpdnhjhgkcaicaofigljoijo\5.2\manifest.json
- %LOCALAPPDATA%\google\chrome\user data\default\extensions\phkcagmcmpdnhjhgkcaicaofigljoijo\5.2\izkb3xd.js
- %ALLUSERSPROFILE%\85b7646b86ccf78b\{75f9bf4a-af67-a478-a37b-31d73186d3f3}.20220611153406
Deletes the following files
- %TEMP%\7b8540af\iczpg2gv0th5ch8.dat
- %TEMP%\7b8540af\2sp13hyvj47cfl.dll
- %TEMP%\7b8540af\2sp13hyvj47cfl.tlb
- %TEMP%\7b8540af\2sp13hyvj47cfl.x64.dll
- %TEMP%\7b8540af\rp@wvfb.edu\content\bg.js
- %TEMP%\7b8540af\rp@wvfb.edu\bootstrap.js
- %TEMP%\7b8540af\rp@wvfb.edu\chrome.manifest
- %TEMP%\7b8540af\rp@wvfb.edu\install.rdf
- %TEMP%\7b8540af\phkcagmcmpdnhjhgkcaicaofigljoijo\izkb3xd.js
- %TEMP%\7b8540af\phkcagmcmpdnhjhgkcaicaofigljoijo\background.html
- %TEMP%\7b8540af\phkcagmcmpdnhjhgkcaicaofigljoijo\manifest.json
- %TEMP%\7b8540af\phkcagmcmpdnhjhgkcaicaofigljoijo\content.js
- %TEMP%\7b8540af\phkcagmcmpdnhjhgkcaicaofigljoijo\lsdb.js
Modifies the following files
- %LOCALAPPDATA%\google\chrome\user data\local state
- %LOCALAPPDATA%\google\chrome\user data\default\preferences__.tmp
Substitutes the following files
- %LOCALAPPDATA%\google\chrome\user data\default\preferences__.tmp
- %ALLUSERSPROFILE%\ntuser.pol
Miscellaneous
Searches for the following windows
- ClassName: 'MS_AutodialMonitor' WindowName: ''
- ClassName: 'MS_WebCheckMonitor' WindowName: ''
Executes the following
- '%WINDIR%\syswow64\regsvr32.exe' /s "%ProgramFiles(x86)%\PriceLess\2Sp13hYVJ47CFl.x64.dll"
- '<SYSTEM32>\regsvr32.exe' /s "%ProgramFiles(x86)%\PriceLess\2Sp13hYVJ47CFl.x64.dll"
- '<SYSTEM32>\raserver.exe' /offerraupdate
