Technical Information
- [<HKLM>\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] 'wdcertm_lzbk' = '<SYSTEM32>\WatchData\Watchdata LZBank CSP v3.4\WDCertLZB.exe'
- [<HKLM>\SYSTEM\ControlSet001\Services\WDMonitorLZBank] 'Start' = '00000002'
- '<SYSTEM32>\WatchData\Watchdata LZBank CSP v3.4\WDMntLZB.exe' -i
- '<SYSTEM32>\WatchData\Watchdata LZBank CSP v3.4\RegTrustedSite.exe' -i
- '%TEMP%\RarSFX0\WatchSafe 3 User_ND Setup\WD_Install.exe'
- '%PROGRAM_FILES%\WatchData\LZBank ND UKey 3.4\regrootcert.exe'
- '%WINDIR%\regedit.exe' /s "%PROGRAM_FILES%\WatchData\LZBank ND UKey 3.4\install.reg"
- [<HKCU>\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\2] '1A06' = '00000000'
- [<HKCU>\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\2] '1A05' = '00000001'
- [<HKCU>\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\2] '1A04' = '00000003'
- [<HKCU>\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\2] '1A10' = '00000000'
- [<HKCU>\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\2] '2000' = '00000000'
- [<HKCU>\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\2] '1E05' = '00020000'
- [<HKCU>\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\2] '1C00' = '00010000'
- [<HKCU>\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\2] '1A03' = '00000000'
- [<HKCU>\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\2] '1809' = '00000000'
- [<HKCU>\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\2] '1808' = '00000000'
- [<HKCU>\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\2] '1807' = '00000000'
- [<HKCU>\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\2] '180A' = '00000003'
- [<HKCU>\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\2] '1A02' = '00000000'
- [<HKCU>\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\2] '1A00' = '00020000'
- [<HKCU>\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\2] '180C' = '00000000'
- [<HKCU>\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\2] '2001' = '00000000'
- [<HKCU>\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\2] '2301' = '00000000'
- [<HKCU>\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\2] '2300' = '00000001'
- [<HKCU>\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\2] '2201' = '00000003'
- [<HKCU>\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\2] '2400' = '00000000'
- [<HKCU>\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\2] '2600' = '00000000'
- [<HKCU>\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\2] '2402' = '00000000'
- [<HKCU>\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\2] '2401' = '00000000'
- [<HKCU>\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\2] '2200' = '00000003'
- [<HKCU>\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\2] '2101' = '00000000'
- [<HKCU>\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\2] '2100' = '00000000'
- [<HKCU>\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\2] '2004' = '00000000'
- [<HKCU>\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\2] '2102' = '00000003'
- [<HKCU>\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\2] '2105' = '00000000'
- [<HKCU>\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\2] '2104' = '00000000'
- [<HKCU>\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\2] '2103' = '00000000'
- [<HKCU>\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\2] '1806' = '00000001'
- [<HKCU>\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\2] '1208' = '00000000'
- [<HKCU>\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\2] '1207' = '00000000'
- [<HKCU>\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\2] '1206' = '00000003'
- [<HKCU>\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\2] '1209' = '00000003'
- [<HKCU>\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\2] '1402' = '00000000'
- [<HKCU>\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\2] '1400' = '00000000'
- [<HKCU>\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\2] '120A' = '00000003'
- [<HKCU>\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\2] '1201' = '00000003'
- [<HKCU>\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\2] '1001' = '00000001'
- [<HKCU>\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\3] '1405' = '00000000'
- [<HKCU>\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\3] '1001' = '00000001'
- [<HKCU>\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\2] '1405' = '00000000'
- [<HKCU>\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\2] '1200' = '00000000'
- [<HKCU>\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\2] '1004' = '00000003'
- [<HKCU>\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\2] 'CurrentLevel' = '00011000'
- [<HKCU>\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\2] '1406' = '00000003'
- [<HKCU>\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\2] '1800' = '00000001'
- [<HKCU>\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\2] '160A' = '00000000'
- [<HKCU>\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\2] '1609' = '00000001'
- [<HKCU>\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\2] '1802' = '00000000'
- [<HKCU>\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\2] '1805' = '00000001'
- [<HKCU>\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\2] '1804' = '00000001'
- [<HKCU>\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\2] '1803' = '00000000'
- [<HKCU>\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\2] '1608' = '00000000'
- [<HKCU>\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\2] '1601' = '00000000'
- [<HKCU>\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\2] '1408' = '00000000'
- [<HKCU>\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\2] '1407' = '00000001'
- [<HKCU>\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\2] '1604' = '00000000'
- [<HKCU>\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\2] '1607' = '00000003'
- [<HKCU>\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\2] '1606' = '00000000'
- [<HKCU>\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\2] '1605' = '00000000'
- %PROGRAM_FILES%\WatchData\LZBank ND UKey 3.4\unistall.reg
- <SYSTEM32>\WatchData\Watchdata LZBank CSP v3.4\RegTrustedSite.exe
- %PROGRAM_FILES%\WatchData\LZBank ND UKey 3.4\LZBKUserTool.exe
- %PROGRAM_FILES%\WatchData\LZBank ND UKey 3.4\install.reg
- <SYSTEM32>\WatchData\Watchdata LZBank CSP v3.4\UIResC3.dll
- <SYSTEM32>\WatchData\Watchdata LZBank CSP v3.4\UIResE3.dll
- %PROGRAM_FILES%\WatchData\LZBank ND UKey 3.4\regrootcert.exe
- <SYSTEM32>\WatchData\Watchdata LZBank CSP v3.4\TokenMgr.dll
- <SYSTEM32>\WatchData\Watchdata LZBank CSP v3.4\WDMntLZB.exe
- %PROGRAM_FILES%\WatchData\LZBank ND UKey 3.4\ProviderName.ini
- %PROGRAM_FILES%\WatchData\LZBank ND UKey 3.4\recfull.ico
- <SYSTEM32>\WatchData\Watchdata LZBank CSP v3.4\clrcert.exe
- %PROGRAM_FILES%\WatchData\LZBank ND UKey 3.4\logo.bmp
- <SYSTEM32>\WatchData\Watchdata LZBank CSP v3.4\Protect.sig
- <SYSTEM32>\WatchData\Watchdata LZBank CSP v3.4\WDCertLZB.exe
- <SYSTEM32>\WatchData\Watchdata LZBank CSP v3.4\WatchSafe.ini
- <SYSTEM32>\WatchData\Watchdata LZBank CSP v3.4\Protectini.ini
- <SYSTEM32>\WatchData\Watchdata LZBank CSP v3.4\unistall.reg
- %PROGRAM_FILES%\WatchData\LZBank ND UKey 3.4\WD_Uninstall.exe
- <SYSTEM32>\WatchData\Watchdata LZBank CSP v3.4\wdsafe3.sig
- <SYSTEM32>\WatchData\Watchdata LZBank CSP v3.4\hodll.dll
- %ALLUSERSPROFILE%\Start Menu\Programs\LZBank UKey User Tool v1.0\LZBank UKey User Tool v1.0.lnk
- %ALLUSERSPROFILE%\Start Menu\Programs\LZBank UKey User Tool v1.0\UnInstall.lnk
- %PROGRAM_FILES%\WatchData\LZBank ND UKey 3.4\WatchData.ico
- %ALLUSERSPROFILE%\Desktop\LZBank UKey User Tool v1.0.lnk
- <SYSTEM32>\WatchData\Watchdata LZBank CSP v3.4\wdsafe3.dll
- <SYSTEM32>\WatchData\Watchdata LZBank CSP v3.4\WDCSP03.dll
- <SYSTEM32>\WatchData\Watchdata LZBank CSP v3.4\wdcspui.dll
- <SYSTEM32>\WatchData\Watchdata LZBank CSP v3.4\UIResT3.dll
- <SYSTEM32>\WatchData\Watchdata LZBank CSP v3.4\WDAlg.dll
- <SYSTEM32>\WDP11_LZBank.dll
- <SYSTEM32>\WatchData\Watchdata LZBank CSP v3.4\wdpkcs.dll
- <SYSTEM32>\WatchData\Watchdata LZBank CSP v3.4\WDEvent.dll
- <SYSTEM32>\WatchData\Watchdata LZBank CSP v3.4\wdkmgr.dll
- %TEMP%\install.txt
- %TEMP%\RarSFX0\WatchSafe 3 User_ND Setup\WD_Uninstall.exe
- %TEMP%\RarSFX0\WatchSafe 3 User_ND Setup\Tools\WDCertLZB.exe
- %TEMP%\RarSFX0\WatchSafe 3 User_ND Setup\Tools\RegTrustedSite.exe
- %TEMP%\RarSFX0\WatchSafe 3 User_ND Setup\WD_Install.exe
- %TEMP%\RarSFX0\WatchSafe 3 User_ND Setup\csp3.0\TokenMgr.dll
- %TEMP%\RarSFX0\WatchSafe 3 User_ND Setup\csp3.0\UIResC3.dll
- %TEMP%\RarSFX0\WatchSafe 3 User_ND Setup\Tools\WDMntLZB.exe
- %TEMP%\RarSFX0\WatchSafe 3 User_ND Setup\csp3.0\hodll.dll
- %TEMP%\RarSFX0\WatchSafe 3 User_ND Setup\Tools\regrootcert.exe
- %TEMP%\RarSFX0\WatchSafe 3 User_ND Setup\Setup.ini
- %TEMP%\RarSFX0\WatchSafe 3 User_ND Setup\SetupEnglsh.ini
- %TEMP%\RarSFX0\WatchSafe 3 User_ND Setup\Tools\Protectini.ini
- %TEMP%\RarSFX0\WatchSafe 3 User_ND Setup\Tools\ProviderName.ini
- %TEMP%\RarSFX0\WatchSafe 3 User_ND Setup\Tools\clrcert.exe
- %TEMP%\RarSFX0\WatchSafe 3 User_ND Setup\Tools\LZBkUserTool.exe
- %TEMP%\RarSFX0\WatchSafe 3 User_ND Setup\SetupTraditional.ini
- %TEMP%\RarSFX0\WatchSafe 3 User_ND Setup\Tools\WatchSafe.ini
- %TEMP%\RarSFX0\WatchSafe 3 User_ND Setup\Tools\recfull.ico
- %TEMP%\RarSFX0\WatchSafe 3 User_ND Setup\WatchData.ico
- %TEMP%\RarSFX0\WatchSafe 3 User_ND Setup\csp3.0\wdsafe3.dll
- %TEMP%\RarSFX0\WatchSafe 3 User_ND Setup\Tools\logo.bmp
- %TEMP%\RarSFX0\WatchSafe 3 User_ND Setup\Tools\Protect.sig
- %TEMP%\RarSFX0\WatchSafe 3 User_ND Setup\csp3.0\wdsafe3.sig
- %TEMP%\RarSFX0\WatchSafe 3 User_ND Setup\Tools\install.reg
- %TEMP%\RarSFX0\WatchSafe 3 User_ND Setup\Tools\unistall.reg
- %TEMP%\RarSFX0\WatchSafe 3 User_ND Setup\csp3.0\wdpkcs.dll
- %TEMP%\RarSFX0\WatchSafe 3 User_ND Setup\csp3.0\WDAlg.dll
- %TEMP%\RarSFX0\WatchSafe 3 User_ND Setup\csp3.0\WDCSP03.dll
- %TEMP%\RarSFX0\WatchSafe 3 User_ND Setup\csp3.0\UIResE3.dll
- %TEMP%\RarSFX0\WatchSafe 3 User_ND Setup\csp3.0\UIResT3.dll
- %TEMP%\RarSFX0\WatchSafe 3 User_ND Setup\csp3.0\wdkmgr.dll
- %TEMP%\RarSFX0\WatchSafe 3 User_ND Setup\csp3.0\WDP11_LZBank.dll
- %TEMP%\RarSFX0\WatchSafe 3 User_ND Setup\csp3.0\wdcspui.dll
- %TEMP%\RarSFX0\WatchSafe 3 User_ND Setup\csp3.0\WDEvent.dll
- from %TEMP%\install.txt to %PROGRAM_FILES%\WatchData\LZBank ND UKey 3.4\install.txt
- ClassName: 'RegEdit_RegEdit' WindowName: '(null)'
- ClassName: 'Shell_TrayWnd' WindowName: '(null)'
- ClassName: 'EDIT' WindowName: '(null)'