It adds an entry to this key to ensure that the malware runs with your browser…

Firefox, IE and Chrome. Not seen it on Safari yet

hklm\software\clients\startmenuinternet|command