Technical Information
- [<HKLM>\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] 'wdcertm_abc' = '<SYSTEM32>\ABC\ABC SAFE CSP v3.2\WDCertM_ABC.exe'
- [<HKLM>\SYSTEM\ControlSet001\Services\ABCMonitor] 'Start' = '00000002'
- '<SYSTEM32>\ABC\ABC SAFE CSP v3.2\RegTrustedSite.exe' -i
- '<SYSTEM32>\ABC\ABC SAFE CSP v3.2\WDKeyMonitorABC.exe' -i
- '%TEMP%\RarSFX0\WatchSafe 3 User_ND Setup\WD_Install.exe'
- '<SYSTEM32>\regsvr32.exe' -s abcPrintCtl4RA.dll
- '<SYSTEM32>\regsvr32.exe' -s NetSign.dll
- [<HKCU>\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\2] '1A06' = '00000000'
- [<HKCU>\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\2] '1A05' = '00000001'
- [<HKCU>\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\2] '1A04' = '00000000'
- [<HKCU>\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\2] '1A10' = '00000000'
- [<HKCU>\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\2] '2000' = '00000000'
- [<HKCU>\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\2] '1E05' = '00020000'
- [<HKCU>\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\2] '1C00' = '00010000'
- [<HKCU>\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\2] '1A03' = '00000000'
- [<HKCU>\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\2] '1809' = '00000000'
- [<HKCU>\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\2] '1808' = '00000000'
- [<HKCU>\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\2] '1807' = '00000000'
- [<HKCU>\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\2] '180A' = '00000003'
- [<HKCU>\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\2] '1A02' = '00000000'
- [<HKCU>\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\2] '1A00' = '00020000'
- [<HKCU>\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\2] '180C' = '00000000'
- [<HKCU>\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\2] '2001' = '00000000'
- [<HKCU>\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\2] '2301' = '00000000'
- [<HKCU>\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\2] '2300' = '00000001'
- [<HKCU>\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\2] '2201' = '00000003'
- [<HKCU>\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\2] '2400' = '00000000'
- [<HKCU>\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\2] '2600' = '00000000'
- [<HKCU>\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\2] '2402' = '00000000'
- [<HKCU>\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\2] '2401' = '00000000'
- [<HKCU>\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\2] '2200' = '00000003'
- [<HKCU>\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\2] '2101' = '00000000'
- [<HKCU>\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\2] '2100' = '00000000'
- [<HKCU>\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\2] '2004' = '00000000'
- [<HKCU>\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\2] '2102' = '00000003'
- [<HKCU>\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\2] '2105' = '00000000'
- [<HKCU>\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\2] '2104' = '00000000'
- [<HKCU>\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\2] '2103' = '00000000'
- [<HKCU>\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\2] '1806' = '00000001'
- [<HKCU>\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\2] '1208' = '00000000'
- [<HKCU>\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\2] '1207' = '00000000'
- [<HKCU>\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\2] '1206' = '00000003'
- [<HKCU>\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\2] '1209' = '00000003'
- [<HKCU>\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\2] '1402' = '00000000'
- [<HKCU>\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\2] '1400' = '00000000'
- [<HKCU>\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\2] '120A' = '00000003'
- [<HKCU>\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\2] '1201' = '00000000'
- [<HKCU>\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\2] '1001' = '00000001'
- [<HKCU>\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\3] '1405' = '00000000'
- [<HKCU>\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\3] '1001' = '00000001'
- [<HKCU>\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\2] '1405' = '00000000'
- [<HKCU>\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\2] '1200' = '00000000'
- [<HKCU>\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\2] '1004' = '00000003'
- [<HKCU>\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\2] 'CurrentLevel' = '00011000'
- [<HKCU>\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\2] '1406' = '00000003'
- [<HKCU>\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\2] '1800' = '00000001'
- [<HKCU>\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\2] '160A' = '00000000'
- [<HKCU>\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\2] '1609' = '00000001'
- [<HKCU>\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\2] '1802' = '00000000'
- [<HKCU>\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\2] '1805' = '00000001'
- [<HKCU>\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\2] '1804' = '00000001'
- [<HKCU>\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\2] '1803' = '00000000'
- [<HKCU>\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\2] '1608' = '00000000'
- [<HKCU>\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\2] '1601' = '00000000'
- [<HKCU>\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\2] '1408' = '00000000'
- [<HKCU>\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\2] '1407' = '00000001'
- [<HKCU>\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\2] '1604' = '00000000'
- [<HKCU>\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\2] '1607' = '00000003'
- [<HKCU>\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\2] '1606' = '00000000'
- [<HKCU>\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\2] '1605' = '00000000'
- <SYSTEM32>\ABC\ABC SAFE CSP v3.2\RegTrustedSite.exe
- <SYSTEM32>\ABC\ABC SAFE CSP v3.2\FindProcess.exe
- <SYSTEM32>\ABC\ABC SAFE CSP v3.2\WDCertM_ABC.exe
- <SYSTEM32>\ABC\ABC SAFE CSP v3.2\WDKeyMonitorABC.exe
- <SYSTEM32>\ABC\ABC SAFE CSP v3.2\TokenMgr.dll
- <SYSTEM32>\ABC\ABC SAFE CSP v3.2\UIResT3.dll
- <SYSTEM32>\ABC\ABC SAFE CSP v3.2\WDAlg.dll
- <SYSTEM32>\ABC\ABC SAFE CSP v3.2\UIResC3.dll
- <SYSTEM32>\ABC\ABC SAFE CSP v3.2\UIResE3.dll
- %PROGRAM_FILES%\95599 Certificate Tools\WatchData\ABC Management Tool help_EN.chm
- <SYSTEM32>\ABC\ABC SAFE CSP v3.2\clrcert.exe
- %TEMP%\install.txt
- %PROGRAM_FILES%\95599 Certificate Tools\WatchData\ABC Management Tool help_CN.chm
- %PROGRAM_FILES%\95599 Certificate Tools\WatchData\logo.bmp
- <SYSTEM32>\ABC\ABC SAFE CSP v3.2\WatchSafe.ini
- %PROGRAM_FILES%\95599 Certificate Tools\WatchData\ABCUsertool.exe
- %PROGRAM_FILES%\95599 Certificate Tools\WatchData\ProviderName.ini
- %PROGRAM_FILES%\95599 Certificate Tools\WatchData\recfull.ico
- <SYSTEM32>\ABC\ABC SAFE CSP v3.2\abchWTDT41.dll
- <SYSTEM32>\ABC\ABC SAFE CSP v3.2\abcsWTDT41.dll
- <SYSTEM32>\ABC\ABC SAFE CSP v3.2\wdsafe3.dll
- <SYSTEM32>\ABC\ABC SAFE CSP v3.2\wdsafe3.sig
- %PROGRAM_FILES%\95599 Certificate Tools\WatchData\ABC.ico
- %ALLUSERSPROFILE%\Desktop\Internet Banking of Agricultural Bank of China Certificate User Tool.lnk
- %ALLUSERSPROFILE%\Start Menu\Programs\Internet Banking of Agricultural Bank of China Certificate Tools\WatchData\Internet Banking of Agricultural Bank of China Certificate User Tool.lnk
- %PROGRAM_FILES%\95599 Certificate Tools\WatchData\WD_Uninstall.exe
- %ALLUSERSPROFILE%\Start Menu\Programs\Internet Banking of Agricultural Bank of China Certificate Tools\WatchData\Uninstall.lnk
- <SYSTEM32>\ABC\ABC SAFE CSP v3.2\WDEvent.dll
- <SYSTEM32>\ABC\ABC SAFE CSP v3.2\wdkmgr.dll
- <SYSTEM32>\ABC\ABC SAFE CSP v3.2\WDCSP03.dll
- <SYSTEM32>\ABC\ABC SAFE CSP v3.2\wdcspui.dll
- <SYSTEM32>\WD_NDP11_ABC.dll
- <SYSTEM32>\NetSign.dll
- <SYSTEM32>\ABC\ABC SAFE CSP v3.2\wdpkcs.dll
- <SYSTEM32>\abcPrintCtl4RA.dll
- <SYSTEM32>\CEA_Crypt.dll
- %TEMP%\RarSFX0\WatchSafe 3 User_ND Setup\csp3.0\wdsafe3.sig
- %TEMP%\RarSFX0\WatchSafe 3 User_ND Setup\WD_Uninstall.exe
- %TEMP%\RarSFX0\WatchSafe 3 User_ND Setup\Tools\WDCertM_ABC.exe
- %TEMP%\RarSFX0\WatchSafe 3 User_ND Setup\Tools\RegTrustedSite.exe
- %TEMP%\RarSFX0\WatchSafe 3 User_ND Setup\WD_Install.exe
- %TEMP%\RarSFX0\WatchSafe 3 User_ND Setup\Tools\WDKeyMonitorABC.exe
- %TEMP%\RarSFX0\WatchSafe 3 User_ND Setup\csp3.0\abcsWTDT41.dll
- %TEMP%\RarSFX0\WatchSafe 3 User_ND Setup\csp3.0\CEA_Crypt.dll
- %TEMP%\RarSFX0\WatchSafe 3 User_ND Setup\csp3.0\abchWTDT41.dll
- %TEMP%\RarSFX0\WatchSafe 3 User_ND Setup\csp3.0\abcPrintCtl4RA.dll
- %TEMP%\RarSFX0\WatchSafe 3 User_ND Setup\SetupEnglsh.ini
- %TEMP%\RarSFX0\WatchSafe 3 User_ND Setup\SetupTraditional.ini
- %TEMP%\RarSFX0\WatchSafe 3 User_ND Setup\Tools\ProviderName.ini
- %TEMP%\RarSFX0\WatchSafe 3 User_ND Setup\Setup.ini
- %TEMP%\RarSFX0\WatchSafe 3 User_ND Setup\Tools\WatchSafe.ini
- %TEMP%\RarSFX0\WatchSafe 3 User_ND Setup\Tools\clrcert.exe
- %TEMP%\RarSFX0\WatchSafe 3 User_ND Setup\Tools\FindProcess.exe
- %TEMP%\RarSFX0\WatchSafe 3 User_ND Setup\Tools\ABCUsertool.exe
- %TEMP%\RarSFX0\WatchSafe 3 User_ND Setup\closeprocess.exe
- %TEMP%\RarSFX0\WatchSafe 3 User_ND Setup\csp3.0\wdpkcs.dll
- %TEMP%\RarSFX0\WatchSafe 3 User_ND Setup\csp3.0\wdsafe3.dll
- %TEMP%\RarSFX0\WatchSafe 3 User_ND Setup\csp3.0\WDEvent.dll
- %TEMP%\RarSFX0\WatchSafe 3 User_ND Setup\csp3.0\wdkmgr.dll
- %TEMP%\RarSFX0\WatchSafe 3 User_ND Setup\Tools\logo.bmp
- %TEMP%\RarSFX0\WatchSafe 3 User_ND Setup\ABC.ico
- %TEMP%\RarSFX0\WatchSafe 3 User_ND Setup\Tools\recfull.ico
- %TEMP%\RarSFX0\WatchSafe 3 User_ND Setup\Tools\ABC Management Tool help_CN.chm
- %TEMP%\RarSFX0\WatchSafe 3 User_ND Setup\Tools\ABC Management Tool help_EN.chm
- %TEMP%\RarSFX0\WatchSafe 3 User_ND Setup\csp3.0\UIResC3.dll
- %TEMP%\RarSFX0\WatchSafe 3 User_ND Setup\csp3.0\UIResE3.dll
- %TEMP%\RarSFX0\WatchSafe 3 User_ND Setup\csp3.0\NetSign.dll
- %TEMP%\RarSFX0\WatchSafe 3 User_ND Setup\csp3.0\TokenMgr.dll
- %TEMP%\RarSFX0\WatchSafe 3 User_ND Setup\csp3.0\UIResT3.dll
- %TEMP%\RarSFX0\WatchSafe 3 User_ND Setup\csp3.0\WDCSP03.dll
- %TEMP%\RarSFX0\WatchSafe 3 User_ND Setup\csp3.0\wdcspui.dll
- %TEMP%\RarSFX0\WatchSafe 3 User_ND Setup\csp3.0\WD_NDP11_ABC.dll
- %TEMP%\RarSFX0\WatchSafe 3 User_ND Setup\csp3.0\WDAlg.dll
- from %TEMP%\install.txt to %PROGRAM_FILES%\95599 Certificate Tools\WatchData\install.txt
- ClassName: 'Shell_TrayWnd' WindowName: '(null)'
- ClassName: 'EDIT' WindowName: '(null)'