{"id":5710,"date":"2018-12-21T01:25:17","date_gmt":"2018-12-21T01:25:17","guid":{"rendered":"http:\/\/www.hexacorn.com\/blog\/?p=5710"},"modified":"2018-12-21T01:25:19","modified_gmt":"2018-12-21T01:25:19","slug":"beyond-good-ol-run-key-part-96","status":"publish","type":"post","link":"https:\/\/www.hexacorn.com\/blog\/2018\/12\/21\/beyond-good-ol-run-key-part-96\/","title":{"rendered":"Beyond good ol\u2019 Run key, Part 96"},"content":{"rendered":"\n<p>Today, while browsing through the Registry, I came across this strange set of garbled Registry keys:<\/p>\n\n\n\n<ul><li>HKCU\\Software\\Microsoft\\Payment\\PaymentApps<\/li><\/ul>\n\n\n\n<div class=\"wp-block-image\"><figure class=\"aligncenter is-resized\"><img decoding=\"async\" loading=\"lazy\" src=\"https:\/\/www.hexacorn.com\/blog\/wp-content\/uploads\/2018\/12\/payment.png\" alt=\"\" class=\"wp-image-5711\" width=\"271\" height=\"142\" srcset=\"https:\/\/www.hexacorn.com\/blog\/wp-content\/uploads\/2018\/12\/payment.png 421w, https:\/\/www.hexacorn.com\/blog\/wp-content\/uploads\/2018\/12\/payment-300x157.png 300w\" sizes=\"(max-width: 271px) 100vw, 271px\" \/><\/figure><\/div>\n\n\n\n<p>Not sure what they are, but when I grepped win10 for DLLs that referenced the parent key name I found the DLL called SEMgrSvc.dll.<\/p>\n\n\n\n<p>The internal name of the DLL is &#8216;NFC SEManagement Service DLL&#8217;. A quick google followed and I found this <a href=\"http:\/\/batcmd.com\/windows\/10\/services\/semgrsvc\/\">post<\/a>. It refers to the `Payments and NFC\/SE Manager` service.<\/p>\n\n\n\n<p>Browsing through the code of the DLL I spotted a possible persistence opportunity. I can&#8217;t test it as I really don&#8217;t know under what circumstances it is being used, but documenting in case someone wants to poke around, or one day it is actually being used:<\/p>\n\n\n\n<ul><li>HKLM\\Software\\Microsoft\\SEMgr\\Wallet\\DllName=&lt;file><\/li><\/ul>\n\n\n\n<p>The &lt;file> is loaded via LoadLibraryW when Wallet instance is created, and then the API GetMockWalletCOMInstance exported by the wallet DLL is executed.<\/p>\n\n\n\n<p>If you know how it is being used, please let me know. Thanks.<\/p>\n","protected":false},"excerpt":{"rendered":"<p>Today, while browsing through the Registry, I came across this strange set of garbled Registry keys: HKCU\\Software\\Microsoft\\Payment\\PaymentApps Not sure what they are, but when I grepped win10 for DLLs that referenced the parent key name I found the DLL called &hellip; <a href=\"https:\/\/www.hexacorn.com\/blog\/2018\/12\/21\/beyond-good-ol-run-key-part-96\/\">Continue reading <span class=\"meta-nav\">&rarr;<\/span><\/a><\/p>\n","protected":false},"author":1,"featured_media":0,"comment_status":"closed","ping_status":"closed","sticky":false,"template":"","format":"standard","meta":[],"categories":[35],"tags":[],"_links":{"self":[{"href":"https:\/\/www.hexacorn.com\/blog\/wp-json\/wp\/v2\/posts\/5710"}],"collection":[{"href":"https:\/\/www.hexacorn.com\/blog\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/www.hexacorn.com\/blog\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/www.hexacorn.com\/blog\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/www.hexacorn.com\/blog\/wp-json\/wp\/v2\/comments?post=5710"}],"version-history":[{"count":3,"href":"https:\/\/www.hexacorn.com\/blog\/wp-json\/wp\/v2\/posts\/5710\/revisions"}],"predecessor-version":[{"id":5714,"href":"https:\/\/www.hexacorn.com\/blog\/wp-json\/wp\/v2\/posts\/5710\/revisions\/5714"}],"wp:attachment":[{"href":"https:\/\/www.hexacorn.com\/blog\/wp-json\/wp\/v2\/media?parent=5710"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/www.hexacorn.com\/blog\/wp-json\/wp\/v2\/categories?post=5710"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/www.hexacorn.com\/blog\/wp-json\/wp\/v2\/tags?post=5710"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}