Adware.WarThunder

Adware.WarThunder

*file
C:\Windows\System32\Tasks\WarThunder24
C:\Windows\System32\Tasks\WarThunder sun
C:\Windows\System32\Tasks\WarThunder sat
C:\Users{USERNAME}Desktop\WarThunder.lnk
C:\Users\{USERNAME}\AppData\Roaming\ZU_warthunder\wt.ico
C:\Users\{USERNAME}\AppData\Roaming\ZU_WarThunder\Unpin.vbs
C:\Users\{USERNAME}\AppData\Roaming\ZU_WarThunder\Uninstaller.exe
C:\Users\{USERNAME}\AppData\Roaming\ZU_WarThunder\TaskScheduler.dll
C:\Users\{USERNAME}\AppData\Roaming\ZU_WarThunder\PinItem.vbs
C:\Users\{USERNAME}\AppData\Roaming\ZU_WarThunder\CreateShortcut.dll
C:\Users\{USERNAME}\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\WarThunder.lnk

 

*reg_key
HKCU\Software\Microsoft\Windows\CurrentVersion\Uninstall\WarThunder
HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tasks\{588057c5-eee2-4E0E-948A-DFFFAE323721}
HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tasks\{8e8ec2a4-874c-4F8C-99E5-CABD77948699}
HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tasks\{F947E452-3463-4DBD-9A62-26657305BEEA}
HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tree\WarThunder sat
HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tree\WarThunder sun
HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tree\WarThunder05
HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tree\WarThunder24