f4a4d823df9f181439042e62c776f49a801907228264a44766f985ac4166e74e

Analysis

max time kernel
144s
max time network
154s
platform
windows10-2004_x64
resource
win10v2004-20230831-en
resource tags

arch:x64arch:x86image:win10v2004-20230831-enlocale:en-usos:windows10-2004-x64system
submitted
01-09-2023 18:34

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

f4a4d823df9f181439042e62c776f49a801907228264a44766f985ac4166e74e.exe
Size

3.4MB
MD5

e1e941b059b42eac91aa6d202f25cea4
SHA1

9491962bb2dc1dae6ffd30b444ee307db31869b0
SHA256

f4a4d823df9f181439042e62c776f49a801907228264a44766f985ac4166e74e
SHA512

3e2e28d1d6e50330dfddab02ae52f51d685e3b6c45e9200b9a1ff95f7dcf5188f18a8a64c10bf68969517a59e001895add9602b206e4ce6686c3a54fb2ee98ff
SSDEEP

49152:uUlKbsdQz7kD/PVTmTN9JgrgNTcFJD+UUL3qFgxhOO23TSUh1P65Cfcg/zd:plKYdc0nVacFJRFAhUhU5CfJ

Score

8^/10

bootkit persistence

Malware Config

Signatures

Downloads MZ/PE file

Sets DLL path for service in the registry 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SpSvc\Parameters\ServiceDll = "C:\\MobileEmuMaster\\Utils\\spsvc.dll"	f4a4d823df9f181439042e62c776f49a801907228264a44766f985ac4166e74e.exe

Sets service image path in registry 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SpSvc\ImagePath = "%SystemRoot%\\System32\\svchost.exe -k netsvcs"	f4a4d823df9f181439042e62c776f49a801907228264a44766f985ac4166e74e.exe

Checks computer location settings 2 TTPs 2 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-528036852-1341495193-1175965888-1000\Control Panel\International\Geo\Nation	f4a4d823df9f181439042e62c776f49a801907228264a44766f985ac4166e74e.exe
Key value queried	\REGISTRY\USER\S-1-5-21-528036852-1341495193-1175965888-1000\Control Panel\International\Geo\Nation	LDSGameHall.exe

Executes dropped EXE 6 IoCs

pid	Process
1632	MobileEmuHelper.exe
3124	LDSGameHall.exe
3564	update.exe
2012	dismhost.exe
2348	LDSGameRun.exe
1488	ComputerZ14.exe

Loads dropped DLL 55 IoCs

pid	Process
4444	f4a4d823df9f181439042e62c776f49a801907228264a44766f985ac4166e74e.exe
4444	f4a4d823df9f181439042e62c776f49a801907228264a44766f985ac4166e74e.exe
4444	f4a4d823df9f181439042e62c776f49a801907228264a44766f985ac4166e74e.exe
4444	f4a4d823df9f181439042e62c776f49a801907228264a44766f985ac4166e74e.exe
4444	f4a4d823df9f181439042e62c776f49a801907228264a44766f985ac4166e74e.exe
1632	MobileEmuHelper.exe
4444	f4a4d823df9f181439042e62c776f49a801907228264a44766f985ac4166e74e.exe
2508	svchost.exe
4444	f4a4d823df9f181439042e62c776f49a801907228264a44766f985ac4166e74e.exe
372	RegSvr32.exe
3772	RegSvr32.exe
1132	regsvr32.exe
4344	regsvr32.exe
2508	svchost.exe
2508	svchost.exe
3192	Process not Found
3192	Process not Found
3192	Process not Found
3124	LDSGameHall.exe
3124	LDSGameHall.exe
3124	LDSGameHall.exe
3124	LDSGameHall.exe
3124	LDSGameHall.exe
3124	LDSGameHall.exe
3124	LDSGameHall.exe
3124	LDSGameHall.exe
3124	LDSGameHall.exe
3564	update.exe
3564	update.exe
3564	update.exe
3564	update.exe
3564	update.exe
2012	dismhost.exe
2012	dismhost.exe
2012	dismhost.exe
2012	dismhost.exe
2012	dismhost.exe
3124	LDSGameHall.exe
3124	LDSGameHall.exe
2348	LDSGameRun.exe
2348	LDSGameRun.exe
2348	LDSGameRun.exe
2348	LDSGameRun.exe
2348	LDSGameRun.exe
2348	LDSGameRun.exe
2348	LDSGameRun.exe
2348	LDSGameRun.exe
2348	LDSGameRun.exe
2348	LDSGameRun.exe
2348	LDSGameRun.exe
2348	LDSGameRun.exe
2348	LDSGameRun.exe
2348	LDSGameRun.exe
3124	LDSGameHall.exe
1488	ComputerZ14.exe

Registers COM server for autorun 1 TTPs 10 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{7af42ad7-2c1d-4cad-b0ec-7bd8b5ee6346}\InprocServer32\ThreadingModel = "Apartment"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{94800CF5-4B69-43ED-A69E-5358DE0BCF6D}\InProcServer32\ = "C:\\MobileEmuMaster\\Plugin\\ShellExt_x64.dll"	regsvr32.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{7af42ad7-2c1d-4cad-b0ec-7bd8b5ee6346}\InprocServer32	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{2E18ACF9-8A61-4A6C-A770-6F739037317F}\InprocServer32	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{7af42ad7-2c1d-4cad-b0ec-7bd8b5ee6346}\InprocServer32	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{7af42ad7-2c1d-4cad-b0ec-7bd8b5ee6346}\InprocServer32\ = "C:\\MobileEmuMaster\\Plugin\\ShellExt_x64.dll"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{94800CF5-4B69-43ED-A69E-5358DE0BCF6D}\InProcServer32	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{94800CF5-4B69-43ED-A69E-5358DE0BCF6D}\InProcServer32\ThreadingModel = "Both"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{2E18ACF9-8A61-4A6C-A770-6F739037317F}\InprocServer32\ = "C:\\MobileEmuMaster\\GameMemoryOpt_x64.dll"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{2E18ACF9-8A61-4A6C-A770-6F739037317F}\InprocServer32\ThreadingModel = "Apartment"	regsvr32.exe

Enumerates connected drives 3 TTPs 22 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\M:	f4a4d823df9f181439042e62c776f49a801907228264a44766f985ac4166e74e.exe
File opened (read-only)	\??\R:	f4a4d823df9f181439042e62c776f49a801907228264a44766f985ac4166e74e.exe
File opened (read-only)	\??\T:	f4a4d823df9f181439042e62c776f49a801907228264a44766f985ac4166e74e.exe
File opened (read-only)	\??\X:	f4a4d823df9f181439042e62c776f49a801907228264a44766f985ac4166e74e.exe
File opened (read-only)	\??\Z:	f4a4d823df9f181439042e62c776f49a801907228264a44766f985ac4166e74e.exe
File opened (read-only)	\??\E:	f4a4d823df9f181439042e62c776f49a801907228264a44766f985ac4166e74e.exe
File opened (read-only)	\??\I:	f4a4d823df9f181439042e62c776f49a801907228264a44766f985ac4166e74e.exe
File opened (read-only)	\??\J:	f4a4d823df9f181439042e62c776f49a801907228264a44766f985ac4166e74e.exe
File opened (read-only)	\??\N:	f4a4d823df9f181439042e62c776f49a801907228264a44766f985ac4166e74e.exe
File opened (read-only)	\??\V:	f4a4d823df9f181439042e62c776f49a801907228264a44766f985ac4166e74e.exe
File opened (read-only)	\??\H:	f4a4d823df9f181439042e62c776f49a801907228264a44766f985ac4166e74e.exe
File opened (read-only)	\??\G:	f4a4d823df9f181439042e62c776f49a801907228264a44766f985ac4166e74e.exe
File opened (read-only)	\??\S:	f4a4d823df9f181439042e62c776f49a801907228264a44766f985ac4166e74e.exe
File opened (read-only)	\??\U:	f4a4d823df9f181439042e62c776f49a801907228264a44766f985ac4166e74e.exe
File opened (read-only)	\??\W:	f4a4d823df9f181439042e62c776f49a801907228264a44766f985ac4166e74e.exe
File opened (read-only)	\??\F:	f4a4d823df9f181439042e62c776f49a801907228264a44766f985ac4166e74e.exe
File opened (read-only)	\??\L:	f4a4d823df9f181439042e62c776f49a801907228264a44766f985ac4166e74e.exe
File opened (read-only)	\??\O:	f4a4d823df9f181439042e62c776f49a801907228264a44766f985ac4166e74e.exe
File opened (read-only)	\??\P:	f4a4d823df9f181439042e62c776f49a801907228264a44766f985ac4166e74e.exe
File opened (read-only)	\??\Q:	f4a4d823df9f181439042e62c776f49a801907228264a44766f985ac4166e74e.exe
File opened (read-only)	\??\Y:	f4a4d823df9f181439042e62c776f49a801907228264a44766f985ac4166e74e.exe
File opened (read-only)	\??\K:	f4a4d823df9f181439042e62c776f49a801907228264a44766f985ac4166e74e.exe

Writes to the Master Boot Record (MBR) 1 TTPs 5 IoCs

Bootkits write to the MBR to gain persistence at a level below the operating system.

bootkit persistence

Bootkit

T1542.003

description	ioc	Process
File opened for modification	\??\PhysicalDrive0	LDSGameRun.exe
File opened for modification	\??\PhysicalDrive0	f4a4d823df9f181439042e62c776f49a801907228264a44766f985ac4166e74e.exe
File opened for modification	\??\PhysicalDrive0	MobileEmuHelper.exe
File opened for modification	\??\PhysicalDrive0	LDSGameHall.exe
File opened for modification	\??\PhysicalDrive0	update.exe

Drops file in System32 directory 15 IoCs

description	ioc	Process
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft	svchost.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\8DFDF057024880D7A081AFBF6D26B92F	svchost.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\9A19ADAD9D098E039450ABBEDD5616EB_CE18D35E70C72FBD424F3A4C77930458	svchost.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData	svchost.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\7D266D9E1E69FA1EEFB9699B009B34C8_0A9BFDD75B598C2110CBF610C078E6E6	svchost.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\9A19ADAD9D098E039450ABBEDD5616EB_CE18D35E70C72FBD424F3A4C77930458	svchost.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\EE44ECA143B76F2B9F2A5AA75B5D1EC6_847118BE2683F0C241D1D702F3A3F5F9	svchost.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\EE44ECA143B76F2B9F2A5AA75B5D1EC6_847118BE2683F0C241D1D702F3A3F5F9	svchost.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\CA4458E7366E94A3C3A9C1FE548B6D21_D5465C6C6A6448F602B724ACE9B47F69	svchost.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache	svchost.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\8DFDF057024880D7A081AFBF6D26B92F	svchost.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\Roaming\360NetUL\svchost.netul.log	svchost.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\CA4458E7366E94A3C3A9C1FE548B6D21_D5465C6C6A6448F602B724ACE9B47F69	svchost.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content	svchost.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\7D266D9E1E69FA1EEFB9699B009B34C8_0A9BFDD75B598C2110CBF610C078E6E6	svchost.exe

Drops file in Windows directory 3 IoCs

description	ioc	Process
File opened for modification	C:\Windows\	LDSGameRun.exe
File opened for modification	C:\Windows\Logs\DISM\dism.log	Dism.exe
File opened for modification	C:\Windows\Logs\DISM\dism.log	dismhost.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Modifies Internet Explorer settings 1 TTPs 10 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_BROWSER_EMULATION	LDSGameHall.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_BLOCK_LMZ_OBJECT\LDSGameHall.exe = "1"	LDSGameHall.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_BLOCK_LMZ_SCRIPT	LDSGameHall.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_BLOCK_LMZ_SCRIPT\LDSGameHall.exe = "1"	LDSGameHall.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_ALIGNED_TIMERS	LDSGameHall.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_BROWSER_EMULATION\LDSGameHall.exe = "11001"	LDSGameHall.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_BLOCK_LMZ_OBJECT	LDSGameHall.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_GPU_RENDERING	LDSGameHall.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_GPU_RENDERING\LDSGameHall.exe = "1"	LDSGameHall.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_ALIGNED_TIMERS\LDSGameHall.exe = "1"	LDSGameHall.exe

Modifies data under HKEY_USERS 41 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CTLs	svchost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CTLs	svchost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CTLs	svchost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\Certificates	svchost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople	svchost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CRLs	svchost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\Certificates	svchost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot	svchost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CRLs	svchost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CTLs	svchost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\Certificates	svchost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\Certificates	svchost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust	svchost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CTLs	svchost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\Certificates	svchost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA	svchost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed	svchost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\Certificates	svchost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CTLs	svchost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root	svchost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\Certificates	svchost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed	svchost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CRLs	svchost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\Certificates	svchost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CRLs	svchost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CRLs	svchost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CRLs	svchost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CRLs	svchost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\Certificates	svchost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CTLs	svchost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing	svchost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CRLs	svchost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CRLs	svchost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CTLs	svchost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust	svchost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CRLs	svchost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA	svchost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CTLs	svchost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CTLs	svchost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\Certificates	svchost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople	svchost.exe

Modifies registry class 64 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{32FE7CB4-3936-41AF-BF31-6F8FC8F86AC9}\1.0	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{32FE7CB4-3936-41AF-BF31-6F8FC8F86AC9}\1.0\0	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{94800CF5-4B69-43ED-A69E-5358DE0BCF6E}	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{94800CF5-4B69-43ED-A69E-5358DE0BCF6D}\InProcServer32\ThreadingModel = "Both"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\ShellExt.ShellIcon.1\ = "ShellIcon Class"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{2E18ACF9-8A61-4A6C-A770-6F739037317F}\InprocServer32\ = "C:\\MobileEmuMaster\\GameMemoryOpt_x64.dll"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{7af42ad7-2c1d-4cad-b0ec-7bd8b5ee6346}\Version	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{7af42ad7-2c1d-4cad-b0ec-7bd8b5ee6346}\Version\ = "1.0"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.apk	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\apkfile_ldsgame	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{94800CF5-4B69-43ED-A69E-5358DE0BCF6E}\NumMethods\ = "16"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\apkfile_ldsgame\ShellEx\IconHandler	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\apkfile_ldsgame\Shell\使用手机模拟大师打开\Command\ = "\"C:\\MobileEmuMaster\\LDSGameHall\\LDSGameHall.exe\" /from_shell /DisplayMode=full /RunApkFile=\"%1\""	LDSGameHall.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\ShellExt.ShellIcon\CLSID	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{32FE7CB4-3936-41AF-BF31-6F8FC8F86AC9}\1.0\ = "ShellExtLib"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{32FE7CB4-3936-41AF-BF31-6F8FC8F86AC9}\1.0\0\win64	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{94800CF5-4B69-43ED-A69E-5358DE0BCF6D}\ProxyStubClsid32\ = "{00020424-0000-0000-C000-000000000046}"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{94800CF5-4B69-43ED-A69E-5358DE0BCF6D}\ProxyStubClsid32	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{94800CF5-4B69-43ED-A69E-5358DE0BCF6D}\TypeLib	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{94800CF5-4B69-43ED-A69E-5358DE0BCF6D}\ProxyStubClsid32	regsvr32.exe
Key created	\REGISTRY\USER\S-1-5-21-528036852-1341495193-1175965888-1000_Classes\Interface	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{2E18ACF9-8A61-4A6C-A770-6F739037317F}\ = "Ludashi GameMaster"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\ShellExt.ShellIcon\CurVer	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{7af42ad7-2c1d-4cad-b0ec-7bd8b5ee6346}\TypeLib\ = "{32fe7cb4-3936-41af-bf31-6f8fc8f86ac9}"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{94800CF5-4B69-43ED-A69E-5358DE0BCF6D}	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.apk\ = "apkfile_ldsgame"	regsvr32.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{7af42ad7-2c1d-4cad-b0ec-7bd8b5ee6346}\Version	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\apkfile_ldsgame\Shell\Open\Command\ = "\"C:\\MobileEmuMaster\\LDSGameHall\\LDSGameHall.exe\" /from_shell /DisplayMode=full /RunApkFile=\"%1\""	LDSGameHall.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\ShellExt.ShellIcon\CurVer\ = "ShellExt.ShellIcon.1"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{32FE7CB4-3936-41AF-BF31-6F8FC8F86AC9}\1.0\FLAGS\ = "0"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{94800CF5-4B69-43ED-A69E-5358DE0BCF6D}\ProxyStubClsid32\ = "{00020424-0000-0000-C000-000000000046}"	regsvr32.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{7af42ad7-2c1d-4cad-b0ec-7bd8b5ee6346}\TypeLib	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\apkfile_ldsgame\DefaultIcon\ = "\"C:\\MobileEmuMaster\\LDSGameHall\\DefApkIcon.ico\""	LDSGameHall.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\ShellExt.ShellIcon.1\CLSID\ = "{7af42ad7-2c1d-4cad-b0ec-7bd8b5ee6346}"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{7af42ad7-2c1d-4cad-b0ec-7bd8b5ee6346}\ = "ShellIcon Class"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{7af42ad7-2c1d-4cad-b0ec-7bd8b5ee6346}\TypeLib	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\apkfile_ldsgame\ShellEx	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{94800CF5-4B69-43ED-A69E-5358DE0BCF6D}\NumMethods	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{94800CF5-4B69-43ED-A69E-5358DE0BCF6E}\ProxyStubClsid32\ = "{00020424-0000-0000-C000-000000000046}"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{94800CF5-4B69-43ED-A69E-5358DE0BCF6E}\TypeLib\ = "{32FE7CB4-3936-41AF-BF31-6F8FC8F86AC9}"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{94800CF5-4B69-43ED-A69E-5358DE0BCF6E}\ProxyStubClsid32\ = "{00020424-0000-0000-C000-000000000046}"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{94800CF5-4B69-43ED-A69E-5358DE0BCF6D}\InProcServer32	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\apkfile_ldsgame\Shell\Open	LDSGameHall.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{32FE7CB4-3936-41AF-BF31-6F8FC8F86AC9}\1.0\HELPDIR\ = "C:\\MobileEmuMaster\\Plugin"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{94800CF5-4B69-43ED-A69E-5358DE0BCF6E}\TypeLib	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{94800CF5-4B69-43ED-A69E-5358DE0BCF6D}\NumMethods\ = "13"	regsvr32.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{7af42ad7-2c1d-4cad-b0ec-7bd8b5ee6346}	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{94800CF5-4B69-43ED-A69E-5358DE0BCF6E}\ = "IShellApkInfo2"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\apkfile_ldsgame\ShellEx\IconHandler\ = "{7AF42AD7-2C1D-4CAD-B0EC-7BD8B5EE6346}"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\apkfile_ldsgame\DefaultIcon	LDSGameHall.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{2E18ACF9-8A61-4A6C-A770-6F739037317F}	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{7af42ad7-2c1d-4cad-b0ec-7bd8b5ee6346}\InprocServer32\ = "C:\\MobileEmuMaster\\Plugin\\ShellExt_x64.dll"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{94800CF5-4B69-43ED-A69E-5358DE0BCF6D}\ = "IShellApkInfo"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{94800CF5-4B69-43ED-A69E-5358DE0BCF6D}\TypeLib\Version = "1.0"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\apkfile_ldsgame	LDSGameHall.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\ShellExt.ShellIcon\CLSID\ = "{7af42ad7-2c1d-4cad-b0ec-7bd8b5ee6346}"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{94800CF5-4B69-43ED-A69E-5358DE0BCF6E}\TypeLib\Version = "1.0"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{94800CF5-4B69-43ED-A69E-5358DE0BCF6D}	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\apkfile_ldsgame\ShellEx\{00021500-0000-0000-C000-000000000046}\ = "{7AF42AD7-2C1D-4CAD-B0EC-7BD8B5EE6346}"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{32FE7CB4-3936-41AF-BF31-6F8FC8F86AC9}\1.0\FLAGS	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{32FE7CB4-3936-41AF-BF31-6F8FC8F86AC9}\1.0\0\win64\ = "C:\\MobileEmuMaster\\Plugin\\ShellExt_x64.dll"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{32FE7CB4-3936-41AF-BF31-6F8FC8F86AC9}\1.0\HELPDIR	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{94800CF5-4B69-43ED-A69E-5358DE0BCF6D}\TypeLib\ = "{32FE7CB4-3936-41AF-BF31-6F8FC8F86AC9}"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{2E18ACF9-8A61-4A6C-A770-6F739037317F}\InprocServer32\ThreadingModel = "Apartment"	regsvr32.exe

Modifies system certificate store 2 TTPs 19 IoCs

evasion spyware trojan

Install Root Certificate

T1553.004

Modify Registry

T1112

description	ioc	Process
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\D69B561148F01C77C54578C10926DF5B856976AD\Blob = 040000000100000010000000c5dfb849ca051355ee2dba1ac33eb0280f00000001000000200000005229ba15b31b0c6f4cca89c2985177974327d1b689a3b935a0bd975532af22ab090000000100000054000000305206082b0601050507030206082b06010505070303060a2b0601040182370a030406082b0601050507030406082b0601050507030606082b0601050507030706082b0601050507030106082b06010505070308530000000100000040000000303e301f06092b06010401a032010130123010060a2b0601040182373c0101030200c0301b060567810c010330123010060a2b0601040182373c0101030200c00b000000010000003000000047006c006f00620061006c005300690067006e00200052006f006f00740020004300410020002d002000520033000000620000000100000020000000cbb522d7b7f127ad6a0113865bdf1cd4102e7d0759af635a7cf4720dc963c53b1400000001000000140000008ff04b7fa82e4524ae4d50fa639a8bdee2dd1bbc1d000000010000001000000001728e1ecf7a9d86fb3cec8948aba953030000000100000014000000d69b561148f01c77c54578c10926df5b856976ad190000000100000010000000d0fd3c9c380d7b65e26b9a3fedd39b8f2000000001000000630300003082035f30820247a003020102020b04000000000121585308a2300d06092a864886f70d01010b0500304c3120301e060355040b1317476c6f62616c5369676e20526f6f74204341202d20523331133011060355040a130a476c6f62616c5369676e311330110603550403130a476c6f62616c5369676e301e170d3039303331383130303030305a170d3239303331383130303030305a304c3120301e060355040b1317476c6f62616c5369676e20526f6f74204341202d20523331133011060355040a130a476c6f62616c5369676e311330110603550403130a476c6f62616c5369676e30820122300d06092a864886f70d01010105000382010f003082010a0282010100cc2576907906782216f5c083b684ca289efd057611c5ad8872fc460243c7b28a9d045f24cb2e4be1608246e152ab0c8147706cdd64d1ebf52ca30f823d0c2bae97d7b614861079bb3b1380778c08e149d26a622f1f5efa9668df892795389f06d73ec9cb26590d73deb0c8e9260e8315c6ef5b8bd20460ca49a628f6693bf6cbc82891e59d8a615737ac7414dc74e03aee722f2e9cfbd0bbbff53d00e10633e8822bae53a63a16738cdd410e203ac0b4a7a1e9b24f902e3260e957cbb904926868e538266075b29f77ff9114efae2049fcad401548d1023161195eb897efad77b7649a7abf5fc113ef9b62fb0d6ce0546916a903da6ee983937176c6698582170203010001a3423040300e0603551d0f0101ff040403020106300f0603551d130101ff040530030101ff301d0603551d0e041604148ff04b7fa82e4524ae4d50fa639a8bdee2dd1bbc300d06092a864886f70d01010b050003820101004b40dbc050aafec80ceff796544549bb96000941acb3138686280733ca6be674b9ba002daea40ad3f5f1f10f8abf73674a83c7447b78e0af6e6c6f03298e333945c38ee4b9576caafc1296ec53c62de4246cb99463fbdc536867563e83b8cf3521c3c968fecedac253aacc908ae9f05d468c95dd7a58281a2f1ddecd0037418fed446dd75328977ef367041e15d78a96b4d3de4c27a44c1b737376f41799c21f7a0ee32d08ad0a1c2cff3cab550e0f917e36ebc35749bee12e2d7c608bc3415113239dcef7326b9401a899e72c331f3a3b25d28640ce3b2c8678c9612f14baeedb556fdf84ee05094dbd28d872ced36250651eeb92978331d9b3b5ca47583f5f	f4a4d823df9f181439042e62c776f49a801907228264a44766f985ac4166e74e.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\E12DFB4B41D7D9C32B30514BAC1D81D8385E2D46	update.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\E12DFB4B41D7D9C32B30514BAC1D81D8385E2D46\Blob = 190000000100000010000000e843ac3b52ec8c297fa948c9b1fb2819030000000100000014000000e12dfb4b41d7d9c32b30514bac1d81d8385e2d4668000000010000000800000000409120d035d9017e0000000100000008000000000063f58926d7011d0000000100000010000000f919b9ccce1e59c2e785f7dc2ccf6708140000000100000014000000daed6474149c143cabdd99a9bd5b284d8b3cc9d86200000001000000200000006fff78e400a70c11011cd85977c459fb5af96a3df0540820d0f4b8607875e58f090000000100000022000000302006082b06010505070303060a2b0601040182370a030406082b060105050703080b000000010000002a0000005300650063007400690067006f0020002800550054004e0020004f0062006a00650063007400290000000f0000000100000014000000f45a0858c9cd920e647bad539ab9f1cfc77f24cb20000000010000006a040000308204663082034ea003020102021044be0c8b500024b411d3362de0b35f1b300d06092a864886f70d0101050500308195310b3009060355040613025553310b3009060355040813025554311730150603550407130e53616c74204c616b652043697479311e301c060355040a131554686520555345525452555354204e6574776f726b3121301f060355040b1318687474703a2f2f7777772e7573657274727573742e636f6d311d301b0603550403131455544e2d5553455246697273742d4f626a656374301e170d3939303730393138333132305a170d3139303730393138343033365a308195310b3009060355040613025553310b3009060355040813025554311730150603550407130e53616c74204c616b652043697479311e301c060355040a131554686520555345525452555354204e6574776f726b3121301f060355040b1318687474703a2f2f7777772e7573657274727573742e636f6d311d301b0603550403131455544e2d5553455246697273742d4f626a65637430820122300d06092a864886f70d01010105000382010f003082010a0282010100ceaa813fa3a36178aa31005595119e270f1f1cdf3a9b826830c04a611df12f0efabe79f7a523ef55519684cddbe3b96e3e31d80a2067c7f4d9bf94eb47043e02ce2aa25d870409f6309d188a97b2aa1cfc41d2a136cbfb3d91bae7d97035fae4e790c39ba39bd33cf5129977b1b709e068e61cb8f39463886a6afe0b76c9bef422e467b9ab1a5e77c18507dd0d6cbfee06c7776a419ea70fd7fbee9417b7fc85bea4abc41c31ddd7b6d1e4f0efdf168fb25293d7a1d489a1072ebfe10112421e1ae1d89534db647928ffba2e11c2e5e85b9248fb470bc26cdaad328341f3a5e54170fd65906dfafa51c4f9bd962b19042cd36da7dcf07f6f8365e26aab8786750203010001a381af3081ac300b0603551d0f0404030201c6300f0603551d130101ff040530030101ff301d0603551d0e04160414daed6474149c143cabdd99a9bd5b284d8b3cc9d830420603551d1f043b30393037a035a0338631687474703a2f2f63726c2e7573657274727573742e636f6d2f55544e2d5553455246697273742d4f626a6563742e63726c30290603551d250422302006082b0601050507030306082b06010505070308060a2b0601040182370a0304300d06092a864886f70d01010505000382010100081f52b1374478dbfdceb9da959698aa556480b55a40dd21a5c5c1f35f2c4cc8475a69eae8f03535f4d025f3c8a6a4874abd1bb17308bdd4c3cab635bb59867731cda78014ae13effcb148f96b25252d51b62c6d45c198c88a565d3eee434e3e6b278ed03a4b850b5fd3ed6aa775cbd15a872f3975135a72b002819fbef00f845420626c69d4e14dc60d9943010d12968c789dbf50a2b144aa6acf177acf6f0fd4f824555ff0341649663e5046c96371383162b862b9f353ad6cb52ba212aa194f09da5ee793c68e1408fef0308018a086854dc87dd78b03fe6ed5f79d16ac922ca023e59c91521f94df179473c3b3c1c17105200078bd13521da83ecd001fc8	update.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\0563B8630D62D75ABBC8AB1E4BDFB5A899B24D43	MobileEmuHelper.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\D69B561148F01C77C54578C10926DF5B856976AD	f4a4d823df9f181439042e62c776f49a801907228264a44766f985ac4166e74e.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\0563B8630D62D75ABBC8AB1E4BDFB5A899B24D43	f4a4d823df9f181439042e62c776f49a801907228264a44766f985ac4166e74e.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\8094640EB5A7A1CA119C1FDDD59F810263A7FBD1\Blob = 190000000100000010000000cb9dd0fceaaa492f75ce292c21bbfbdd0300000001000000140000008094640eb5a7a1ca119c1fddd59f810263a7fbd17e00000001000000080000000080c82b6886d7017a000000010000000c000000300a06082b060105050703091d0000000100000010000000521f5c98970d19a8e515ef6eeb6d48ef140000000100000014000000ae6c05a39313e2a2e7e2d71cd6c7f07fc86753a07f0000000100000016000000301406082b0601050507030306082b060105050703096200000001000000200000002cabeafe37d06ca22aba7391c0033d25982952c453647349763a3ab5ad6ccf690b000000010000003000000047006c006f00620061006c005300690067006e00200052006f006f00740020004300410020002d002000520036000000090000000100000056000000305406082b0601050507030206082b06010505070303060a2b0601040182370a030c060a2b0601040182370a030406082b0601050507030406082b0601050507030906082b0601050507030106082b0601050507030853000000010000007e000000307c301f06092b06010401a032010130123010060a2b0601040182373c0101030200c0301f06092b06010401a032010230123010060a2b0601040182373c0101030200c0301b060567810c010130123010060a2b0601040182373c0101030200c0301b060567810c010330123010060a2b0601040182373c0101030200c00f0000000100000030000000ea09c51d4c3a334ce4acd2bc08c6a9be352e334f45c4fccfcab63edb9f82dc87d4bd2ed2fadae11163fb954809984ff1200000000100000087050000308205833082036ba003020102020e45e6bb038333c3856548e6ff4551300d06092a864886f70d01010c0500304c3120301e060355040b1317476c6f62616c5369676e20526f6f74204341202d20523631133011060355040a130a476c6f62616c5369676e311330110603550403130a476c6f62616c5369676e301e170d3134313231303030303030305a170d3334313231303030303030305a304c3120301e060355040b1317476c6f62616c5369676e20526f6f74204341202d20523631133011060355040a130a476c6f62616c5369676e311330110603550403130a476c6f62616c5369676e30820222300d06092a864886f70d01010105000382020f003082020a02820201009507e873ca66f9ec14ca7b3cf70d08f1b4450b2c82b448c6eb5b3cae83b841923314a46f7fe92accc6b0886bc5b689d1c6b2ff14ce511421ec4add1b5ac6d687ee4d3a1506ed64660b9280ca44de73944ef3a7897f4f786308c812506d42662f4db979284d521a8a1a80b719810e7ec48abc644c211c4368d73d3c8ac5b266d5909ab73106c5bee26d3206a61ef9b9ebaaa3b8bfbe826350d0f01889dfe40f79f5eaa21f2ad2702e7be7bc93bb6d53e2487c8c100738ff66b277617ee0ea8c3caab4a4f6f3954a12076dfd8cb289cfd0a06177c85874b0d4233af75d3acaa2db9d09de5d442d90f181cd5792fa7ebc50046334df6b9318be6b36b239e4ac2436b7f0efb61c135793b6deb2f8e285b773a2b835aa45f2e09d36a16f548af172566e2e88c55142441594eea3c538969b4e4e5a0b47f30636497730bc7137e5a6ec210875fce661163f77d5d99197840a6cd4024d74c014edfd39fb83f25e14a104b00be9feee8fe16e0bb208b36166096ab1063a659659c0f035fdc9da288d1a118770810aa89a751d9e3a8605009edb80d625f9dc059e27594c76395beaf9a5a1d8830fd1ffdf3011f985cf3348f5ca6d64142c7a584fd34b0849c595641a630e793df5b38cca58ad9c4245796e0e87195c54b165b6bf8c9bdc13e90d6fb82edc676ec98b11b584148a0019708379919791d41a27bf371e3207d814633c284caf0203010001a3633061300e0603551d0f0101ff040403020106300f0603551d130101ff040530030101ff301d0603551d0e04160414ae6c05a39313e2a2e7e2d71cd6c7f07fc86753a0301f0603551d23041830168014ae6c05a39313e2a2e7e2d71cd6c7f07fc86753a0300d06092a864886f70d01010c050003820201008325ede8d1fd9552cd9ec004a09169e65cd084dedcada24fe84778d66598a95ba83c877c028ad16eb71673e65fc05498d574bec1cde21191ad23183ddde1724496b4955ec07b8e99781643135657b3a2b33bb577dc4072aca3eb9b353eb10821a1e7c443377932beb5e79c2c4cbc4329998e30d3ac21e0e31dfad80733765400222ab94d202e7068dae553fc835cd39df2ff440c4466f2d2e3bd46001a6d02ba255d8da13151dd54461c4ddb9996ef1a1c045ca615ef78e079fe5ddb3eaa4c55fd9a15a96fe1a6fbdf7030e9c3ee4246edc2930589fa7d637b3fd071817c00e898ae0e7834c325fbaf0a9f206bdd3b138f128ce2411a487a73a07769c7b65c7f82c81efe581b282ba86cad5e6dc005d27bb7eb80fe2537fe029b68ac425dc3eef5ccdcf05075d236699ce67b04df6e0669b6de0a09485987eb7b14607a64aa6943ef91c74cec18dd6cef532d8c99e15ef2723ecf54c8bd67eca40f4c45ffd3b93023074c8f10bf8696d9995ab499571ca4ccbb158953ba2c050fe4c49e19b11834d54c9dbaedf71faf24950478a803bbee81e5da5f7c8b4aa1907425a7b33e4bc82c56bdc7c8ef38e25c92f079f79c84ba742d6101207e7ed1f24f07595f8b2d4352eb460c94e1f566477977d5545b1fad2437cb455a4ea04448c8d8b099c5158409f6d64949c065b8e61a716ea0a8f182e8453e6cd602d70a6783055ac9a410	LDSGameRun.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\D69B561148F01C77C54578C10926DF5B856976AD\Blob = 5c000000010000000400000000080000190000000100000010000000d0fd3c9c380d7b65e26b9a3fedd39b8f030000000100000014000000d69b561148f01c77c54578c10926df5b856976ad1d000000010000001000000001728e1ecf7a9d86fb3cec8948aba9531400000001000000140000008ff04b7fa82e4524ae4d50fa639a8bdee2dd1bbc620000000100000020000000cbb522d7b7f127ad6a0113865bdf1cd4102e7d0759af635a7cf4720dc963c53b0b000000010000003000000047006c006f00620061006c005300690067006e00200052006f006f00740020004300410020002d002000520033000000530000000100000040000000303e301f06092b06010401a032010130123010060a2b0601040182373c0101030200c0301b060567810c010330123010060a2b0601040182373c0101030200c0090000000100000054000000305206082b0601050507030206082b06010505070303060a2b0601040182370a030406082b0601050507030406082b0601050507030606082b0601050507030706082b0601050507030106082b060105050703080f00000001000000200000005229ba15b31b0c6f4cca89c2985177974327d1b689a3b935a0bd975532af22ab040000000100000010000000c5dfb849ca051355ee2dba1ac33eb0282000000001000000630300003082035f30820247a003020102020b04000000000121585308a2300d06092a864886f70d01010b0500304c3120301e060355040b1317476c6f62616c5369676e20526f6f74204341202d20523331133011060355040a130a476c6f62616c5369676e311330110603550403130a476c6f62616c5369676e301e170d3039303331383130303030305a170d3239303331383130303030305a304c3120301e060355040b1317476c6f62616c5369676e20526f6f74204341202d20523331133011060355040a130a476c6f62616c5369676e311330110603550403130a476c6f62616c5369676e30820122300d06092a864886f70d01010105000382010f003082010a0282010100cc2576907906782216f5c083b684ca289efd057611c5ad8872fc460243c7b28a9d045f24cb2e4be1608246e152ab0c8147706cdd64d1ebf52ca30f823d0c2bae97d7b614861079bb3b1380778c08e149d26a622f1f5efa9668df892795389f06d73ec9cb26590d73deb0c8e9260e8315c6ef5b8bd20460ca49a628f6693bf6cbc82891e59d8a615737ac7414dc74e03aee722f2e9cfbd0bbbff53d00e10633e8822bae53a63a16738cdd410e203ac0b4a7a1e9b24f902e3260e957cbb904926868e538266075b29f77ff9114efae2049fcad401548d1023161195eb897efad77b7649a7abf5fc113ef9b62fb0d6ce0546916a903da6ee983937176c6698582170203010001a3423040300e0603551d0f0101ff040403020106300f0603551d130101ff040530030101ff301d0603551d0e041604148ff04b7fa82e4524ae4d50fa639a8bdee2dd1bbc300d06092a864886f70d01010b050003820101004b40dbc050aafec80ceff796544549bb96000941acb3138686280733ca6be674b9ba002daea40ad3f5f1f10f8abf73674a83c7447b78e0af6e6c6f03298e333945c38ee4b9576caafc1296ec53c62de4246cb99463fbdc536867563e83b8cf3521c3c968fecedac253aacc908ae9f05d468c95dd7a58281a2f1ddecd0037418fed446dd75328977ef367041e15d78a96b4d3de4c27a44c1b737376f41799c21f7a0ee32d08ad0a1c2cff3cab550e0f917e36ebc35749bee12e2d7c608bc3415113239dcef7326b9401a899e72c331f3a3b25d28640ce3b2c8678c9612f14baeedb556fdf84ee05094dbd28d872ced36250651eeb92978331d9b3b5ca47583f5f	f4a4d823df9f181439042e62c776f49a801907228264a44766f985ac4166e74e.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\8094640EB5A7A1CA119C1FDDD59F810263A7FBD1\Blob = 0f0000000100000030000000ea09c51d4c3a334ce4acd2bc08c6a9be352e334f45c4fccfcab63edb9f82dc87d4bd2ed2fadae11163fb954809984ff153000000010000007e000000307c301f06092b06010401a032010130123010060a2b0601040182373c0101030200c0301f06092b06010401a032010230123010060a2b0601040182373c0101030200c0301b060567810c010130123010060a2b0601040182373c0101030200c0301b060567810c010330123010060a2b0601040182373c0101030200c0090000000100000056000000305406082b0601050507030206082b06010505070303060a2b0601040182370a030c060a2b0601040182370a030406082b0601050507030406082b0601050507030906082b0601050507030106082b060105050703080b000000010000003000000047006c006f00620061006c005300690067006e00200052006f006f00740020004300410020002d0020005200360000006200000001000000200000002cabeafe37d06ca22aba7391c0033d25982952c453647349763a3ab5ad6ccf697f0000000100000016000000301406082b0601050507030306082b06010505070309140000000100000014000000ae6c05a39313e2a2e7e2d71cd6c7f07fc86753a01d0000000100000010000000521f5c98970d19a8e515ef6eeb6d48ef7a000000010000000c000000300a06082b060105050703097e00000001000000080000000080c82b6886d7010300000001000000140000008094640eb5a7a1ca119c1fddd59f810263a7fbd1200000000100000087050000308205833082036ba003020102020e45e6bb038333c3856548e6ff4551300d06092a864886f70d01010c0500304c3120301e060355040b1317476c6f62616c5369676e20526f6f74204341202d20523631133011060355040a130a476c6f62616c5369676e311330110603550403130a476c6f62616c5369676e301e170d3134313231303030303030305a170d3334313231303030303030305a304c3120301e060355040b1317476c6f62616c5369676e20526f6f74204341202d20523631133011060355040a130a476c6f62616c5369676e311330110603550403130a476c6f62616c5369676e30820222300d06092a864886f70d01010105000382020f003082020a02820201009507e873ca66f9ec14ca7b3cf70d08f1b4450b2c82b448c6eb5b3cae83b841923314a46f7fe92accc6b0886bc5b689d1c6b2ff14ce511421ec4add1b5ac6d687ee4d3a1506ed64660b9280ca44de73944ef3a7897f4f786308c812506d42662f4db979284d521a8a1a80b719810e7ec48abc644c211c4368d73d3c8ac5b266d5909ab73106c5bee26d3206a61ef9b9ebaaa3b8bfbe826350d0f01889dfe40f79f5eaa21f2ad2702e7be7bc93bb6d53e2487c8c100738ff66b277617ee0ea8c3caab4a4f6f3954a12076dfd8cb289cfd0a06177c85874b0d4233af75d3acaa2db9d09de5d442d90f181cd5792fa7ebc50046334df6b9318be6b36b239e4ac2436b7f0efb61c135793b6deb2f8e285b773a2b835aa45f2e09d36a16f548af172566e2e88c55142441594eea3c538969b4e4e5a0b47f30636497730bc7137e5a6ec210875fce661163f77d5d99197840a6cd4024d74c014edfd39fb83f25e14a104b00be9feee8fe16e0bb208b36166096ab1063a659659c0f035fdc9da288d1a118770810aa89a751d9e3a8605009edb80d625f9dc059e27594c76395beaf9a5a1d8830fd1ffdf3011f985cf3348f5ca6d64142c7a584fd34b0849c595641a630e793df5b38cca58ad9c4245796e0e87195c54b165b6bf8c9bdc13e90d6fb82edc676ec98b11b584148a0019708379919791d41a27bf371e3207d814633c284caf0203010001a3633061300e0603551d0f0101ff040403020106300f0603551d130101ff040530030101ff301d0603551d0e04160414ae6c05a39313e2a2e7e2d71cd6c7f07fc86753a0301f0603551d23041830168014ae6c05a39313e2a2e7e2d71cd6c7f07fc86753a0300d06092a864886f70d01010c050003820201008325ede8d1fd9552cd9ec004a09169e65cd084dedcada24fe84778d66598a95ba83c877c028ad16eb71673e65fc05498d574bec1cde21191ad23183ddde1724496b4955ec07b8e99781643135657b3a2b33bb577dc4072aca3eb9b353eb10821a1e7c443377932beb5e79c2c4cbc4329998e30d3ac21e0e31dfad80733765400222ab94d202e7068dae553fc835cd39df2ff440c4466f2d2e3bd46001a6d02ba255d8da13151dd54461c4ddb9996ef1a1c045ca615ef78e079fe5ddb3eaa4c55fd9a15a96fe1a6fbdf7030e9c3ee4246edc2930589fa7d637b3fd071817c00e898ae0e7834c325fbaf0a9f206bdd3b138f128ce2411a487a73a07769c7b65c7f82c81efe581b282ba86cad5e6dc005d27bb7eb80fe2537fe029b68ac425dc3eef5ccdcf05075d236699ce67b04df6e0669b6de0a09485987eb7b14607a64aa6943ef91c74cec18dd6cef532d8c99e15ef2723ecf54c8bd67eca40f4c45ffd3b93023074c8f10bf8696d9995ab499571ca4ccbb158953ba2c050fe4c49e19b11834d54c9dbaedf71faf24950478a803bbee81e5da5f7c8b4aa1907425a7b33e4bc82c56bdc7c8ef38e25c92f079f79c84ba742d6101207e7ed1f24f07595f8b2d4352eb460c94e1f566477977d5545b1fad2437cb455a4ea04448c8d8b099c5158409f6d64949c065b8e61a716ea0a8f182e8453e6cd602d70a6783055ac9a410	LDSGameRun.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\8094640EB5A7A1CA119C1FDDD59F810263A7FBD1\Blob = 0400000001000000100000004fdd07e4d42264391e0c3742ead1c6ae0f0000000100000030000000ea09c51d4c3a334ce4acd2bc08c6a9be352e334f45c4fccfcab63edb9f82dc87d4bd2ed2fadae11163fb954809984ff153000000010000007e000000307c301f06092b06010401a032010130123010060a2b0601040182373c0101030200c0301f06092b06010401a032010230123010060a2b0601040182373c0101030200c0301b060567810c010130123010060a2b0601040182373c0101030200c0301b060567810c010330123010060a2b0601040182373c0101030200c0090000000100000056000000305406082b0601050507030206082b06010505070303060a2b0601040182370a030c060a2b0601040182370a030406082b0601050507030406082b0601050507030906082b0601050507030106082b060105050703080b000000010000003000000047006c006f00620061006c005300690067006e00200052006f006f00740020004300410020002d0020005200360000006200000001000000200000002cabeafe37d06ca22aba7391c0033d25982952c453647349763a3ab5ad6ccf697f0000000100000016000000301406082b0601050507030306082b06010505070309140000000100000014000000ae6c05a39313e2a2e7e2d71cd6c7f07fc86753a01d0000000100000010000000521f5c98970d19a8e515ef6eeb6d48ef7a000000010000000c000000300a06082b060105050703097e00000001000000080000000080c82b6886d7010300000001000000140000008094640eb5a7a1ca119c1fddd59f810263a7fbd1190000000100000010000000cb9dd0fceaaa492f75ce292c21bbfbdd200000000100000087050000308205833082036ba003020102020e45e6bb038333c3856548e6ff4551300d06092a864886f70d01010c0500304c3120301e060355040b1317476c6f62616c5369676e20526f6f74204341202d20523631133011060355040a130a476c6f62616c5369676e311330110603550403130a476c6f62616c5369676e301e170d3134313231303030303030305a170d3334313231303030303030305a304c3120301e060355040b1317476c6f62616c5369676e20526f6f74204341202d20523631133011060355040a130a476c6f62616c5369676e311330110603550403130a476c6f62616c5369676e30820222300d06092a864886f70d01010105000382020f003082020a02820201009507e873ca66f9ec14ca7b3cf70d08f1b4450b2c82b448c6eb5b3cae83b841923314a46f7fe92accc6b0886bc5b689d1c6b2ff14ce511421ec4add1b5ac6d687ee4d3a1506ed64660b9280ca44de73944ef3a7897f4f786308c812506d42662f4db979284d521a8a1a80b719810e7ec48abc644c211c4368d73d3c8ac5b266d5909ab73106c5bee26d3206a61ef9b9ebaaa3b8bfbe826350d0f01889dfe40f79f5eaa21f2ad2702e7be7bc93bb6d53e2487c8c100738ff66b277617ee0ea8c3caab4a4f6f3954a12076dfd8cb289cfd0a06177c85874b0d4233af75d3acaa2db9d09de5d442d90f181cd5792fa7ebc50046334df6b9318be6b36b239e4ac2436b7f0efb61c135793b6deb2f8e285b773a2b835aa45f2e09d36a16f548af172566e2e88c55142441594eea3c538969b4e4e5a0b47f30636497730bc7137e5a6ec210875fce661163f77d5d99197840a6cd4024d74c014edfd39fb83f25e14a104b00be9feee8fe16e0bb208b36166096ab1063a659659c0f035fdc9da288d1a118770810aa89a751d9e3a8605009edb80d625f9dc059e27594c76395beaf9a5a1d8830fd1ffdf3011f985cf3348f5ca6d64142c7a584fd34b0849c595641a630e793df5b38cca58ad9c4245796e0e87195c54b165b6bf8c9bdc13e90d6fb82edc676ec98b11b584148a0019708379919791d41a27bf371e3207d814633c284caf0203010001a3633061300e0603551d0f0101ff040403020106300f0603551d130101ff040530030101ff301d0603551d0e04160414ae6c05a39313e2a2e7e2d71cd6c7f07fc86753a0301f0603551d23041830168014ae6c05a39313e2a2e7e2d71cd6c7f07fc86753a0300d06092a864886f70d01010c050003820201008325ede8d1fd9552cd9ec004a09169e65cd084dedcada24fe84778d66598a95ba83c877c028ad16eb71673e65fc05498d574bec1cde21191ad23183ddde1724496b4955ec07b8e99781643135657b3a2b33bb577dc4072aca3eb9b353eb10821a1e7c443377932beb5e79c2c4cbc4329998e30d3ac21e0e31dfad80733765400222ab94d202e7068dae553fc835cd39df2ff440c4466f2d2e3bd46001a6d02ba255d8da13151dd54461c4ddb9996ef1a1c045ca615ef78e079fe5ddb3eaa4c55fd9a15a96fe1a6fbdf7030e9c3ee4246edc2930589fa7d637b3fd071817c00e898ae0e7834c325fbaf0a9f206bdd3b138f128ce2411a487a73a07769c7b65c7f82c81efe581b282ba86cad5e6dc005d27bb7eb80fe2537fe029b68ac425dc3eef5ccdcf05075d236699ce67b04df6e0669b6de0a09485987eb7b14607a64aa6943ef91c74cec18dd6cef532d8c99e15ef2723ecf54c8bd67eca40f4c45ffd3b93023074c8f10bf8696d9995ab499571ca4ccbb158953ba2c050fe4c49e19b11834d54c9dbaedf71faf24950478a803bbee81e5da5f7c8b4aa1907425a7b33e4bc82c56bdc7c8ef38e25c92f079f79c84ba742d6101207e7ed1f24f07595f8b2d4352eb460c94e1f566477977d5545b1fad2437cb455a4ea04448c8d8b099c5158409f6d64949c065b8e61a716ea0a8f182e8453e6cd602d70a6783055ac9a410	LDSGameRun.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\0563B8630D62D75ABBC8AB1E4BDFB5A899B24D43\Blob = 190000000100000010000000749966cecc95c1874194ca7203f9b6200300000001000000140000000563b8630d62d75abbc8ab1e4bdfb5a899b24d431d00000001000000100000004f5f106930398d09107b40c3c7ca8f1c0b000000010000001200000044006900670069004300650072007400000014000000010000001400000045eba2aff492cb82312d518ba7a7219df36dc80f6200000001000000200000003e9099b5015e8f486c00bcea9d111ee721faba355a89bcf1df69561e3dc6325c090000000100000034000000303206082b0601050507030206082b0601050507030306082b0601050507030406082b0601050507030106082b06010505070308530000000100000040000000303e301f06096086480186fd6c020130123010060a2b0601040182373c0101030200c0301b060567810c010330123010060a2b0601040182373c0101030200c00f00000001000000140000006dca5bd00dcf1c0f327059d374b29ca6e3c50aa62000000001000000bb030000308203b73082029fa00302010202100ce7e0e517d846fe8fe560fc1bf03039300d06092a864886f70d01010505003065310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d312430220603550403131b4469676943657274204173737572656420494420526f6f74204341301e170d3036313131303030303030305a170d3331313131303030303030305a3065310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d312430220603550403131b4469676943657274204173737572656420494420526f6f7420434130820122300d06092a864886f70d01010105000382010f003082010a0282010100ad0e15cee443805cb187f3b760f97112a5aedc269488aaf4cef520392858600cf880daa9159532613cb5b128848a8adc9f0a0c83177a8f90ac8ae779535c31842af60f98323676ccdedd3ca8a2ef6afb21f25261df9f20d71fe2b1d9fe1864d2125b5ff9581835bc47cda136f96b7fd4b0383ec11bc38c33d9d82f18fe280fb3a783d6c36e44c061359616fe599c8b766dd7f1a24b0d2bff0b72da9e60d08e9035c678558720a1cfe56d0ac8497c3198336c22e987d0325aa2ba138211ed39179d993a72a1e6faa4d9d5173175ae857d22ae3f014686f62879c8b1dae45717c47e1c0eb0b492a656b3bdb297edaaa7f0b7c5a83f9516d0ffa196eb085f18774f0203010001a3633061300e0603551d0f0101ff040403020186300f0603551d130101ff040530030101ff301d0603551d0e0416041445eba2aff492cb82312d518ba7a7219df36dc80f301f0603551d2304183016801445eba2aff492cb82312d518ba7a7219df36dc80f300d06092a864886f70d01010505000382010100a20ebcdfe2edf0e372737a6494bff77266d832e4427562ae87ebf2d5d9de56b39fccce1428b90d97605c124c58e4d33d834945589735691aa847ea56c679ab12d8678184df7f093c94e6b8262c20bd3db32889f75fff22e297841fe965ef87e0dfc16749b35debb2092aeb26ed78be7d3f2bf3b726356d5f8901b6495b9f01059bab3d25c1ccb67fc2f16f86c6fa6468eb812d94eb42b7fa8c1edd62f1be5067b76cbdf3f11f6b0c3607167f377ca95b6d7af112466083d72704be4bce97bec3672a6811df80e70c3366bf130d146ef37f1f63101efa8d1b256d6c8fa5b76101b1d2a326a110719dade2c3f9c39951b72b0708ce2ee650b2a7fa0a452fa2f0f2	f4a4d823df9f181439042e62c776f49a801907228264a44766f985ac4166e74e.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\D69B561148F01C77C54578C10926DF5B856976AD\Blob = 0f00000001000000200000005229ba15b31b0c6f4cca89c2985177974327d1b689a3b935a0bd975532af22ab090000000100000054000000305206082b0601050507030206082b06010505070303060a2b0601040182370a030406082b0601050507030406082b0601050507030606082b0601050507030706082b0601050507030106082b06010505070308530000000100000040000000303e301f06092b06010401a032010130123010060a2b0601040182373c0101030200c0301b060567810c010330123010060a2b0601040182373c0101030200c00b000000010000003000000047006c006f00620061006c005300690067006e00200052006f006f00740020004300410020002d002000520033000000620000000100000020000000cbb522d7b7f127ad6a0113865bdf1cd4102e7d0759af635a7cf4720dc963c53b1400000001000000140000008ff04b7fa82e4524ae4d50fa639a8bdee2dd1bbc1d000000010000001000000001728e1ecf7a9d86fb3cec8948aba953030000000100000014000000d69b561148f01c77c54578c10926df5b856976ad2000000001000000630300003082035f30820247a003020102020b04000000000121585308a2300d06092a864886f70d01010b0500304c3120301e060355040b1317476c6f62616c5369676e20526f6f74204341202d20523331133011060355040a130a476c6f62616c5369676e311330110603550403130a476c6f62616c5369676e301e170d3039303331383130303030305a170d3239303331383130303030305a304c3120301e060355040b1317476c6f62616c5369676e20526f6f74204341202d20523331133011060355040a130a476c6f62616c5369676e311330110603550403130a476c6f62616c5369676e30820122300d06092a864886f70d01010105000382010f003082010a0282010100cc2576907906782216f5c083b684ca289efd057611c5ad8872fc460243c7b28a9d045f24cb2e4be1608246e152ab0c8147706cdd64d1ebf52ca30f823d0c2bae97d7b614861079bb3b1380778c08e149d26a622f1f5efa9668df892795389f06d73ec9cb26590d73deb0c8e9260e8315c6ef5b8bd20460ca49a628f6693bf6cbc82891e59d8a615737ac7414dc74e03aee722f2e9cfbd0bbbff53d00e10633e8822bae53a63a16738cdd410e203ac0b4a7a1e9b24f902e3260e957cbb904926868e538266075b29f77ff9114efae2049fcad401548d1023161195eb897efad77b7649a7abf5fc113ef9b62fb0d6ce0546916a903da6ee983937176c6698582170203010001a3423040300e0603551d0f0101ff040403020106300f0603551d130101ff040530030101ff301d0603551d0e041604148ff04b7fa82e4524ae4d50fa639a8bdee2dd1bbc300d06092a864886f70d01010b050003820101004b40dbc050aafec80ceff796544549bb96000941acb3138686280733ca6be674b9ba002daea40ad3f5f1f10f8abf73674a83c7447b78e0af6e6c6f03298e333945c38ee4b9576caafc1296ec53c62de4246cb99463fbdc536867563e83b8cf3521c3c968fecedac253aacc908ae9f05d468c95dd7a58281a2f1ddecd0037418fed446dd75328977ef367041e15d78a96b4d3de4c27a44c1b737376f41799c21f7a0ee32d08ad0a1c2cff3cab550e0f917e36ebc35749bee12e2d7c608bc3415113239dcef7326b9401a899e72c331f3a3b25d28640ce3b2c8678c9612f14baeedb556fdf84ee05094dbd28d872ced36250651eeb92978331d9b3b5ca47583f5f	f4a4d823df9f181439042e62c776f49a801907228264a44766f985ac4166e74e.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\0563B8630D62D75ABBC8AB1E4BDFB5A899B24D43\Blob = 5c000000010000000400000000080000190000000100000010000000749966cecc95c1874194ca7203f9b6200300000001000000140000000563b8630d62d75abbc8ab1e4bdfb5a899b24d431d00000001000000100000004f5f106930398d09107b40c3c7ca8f1c0b000000010000001200000044006900670069004300650072007400000014000000010000001400000045eba2aff492cb82312d518ba7a7219df36dc80f6200000001000000200000003e9099b5015e8f486c00bcea9d111ee721faba355a89bcf1df69561e3dc6325c090000000100000034000000303206082b0601050507030206082b0601050507030306082b0601050507030406082b0601050507030106082b06010505070308530000000100000040000000303e301f06096086480186fd6c020130123010060a2b0601040182373c0101030200c0301b060567810c010330123010060a2b0601040182373c0101030200c00f00000001000000140000006dca5bd00dcf1c0f327059d374b29ca6e3c50aa604000000010000001000000087ce0b7b2a0e4900e158719b37a893722000000001000000bb030000308203b73082029fa00302010202100ce7e0e517d846fe8fe560fc1bf03039300d06092a864886f70d01010505003065310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d312430220603550403131b4469676943657274204173737572656420494420526f6f74204341301e170d3036313131303030303030305a170d3331313131303030303030305a3065310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d312430220603550403131b4469676943657274204173737572656420494420526f6f7420434130820122300d06092a864886f70d01010105000382010f003082010a0282010100ad0e15cee443805cb187f3b760f97112a5aedc269488aaf4cef520392858600cf880daa9159532613cb5b128848a8adc9f0a0c83177a8f90ac8ae779535c31842af60f98323676ccdedd3ca8a2ef6afb21f25261df9f20d71fe2b1d9fe1864d2125b5ff9581835bc47cda136f96b7fd4b0383ec11bc38c33d9d82f18fe280fb3a783d6c36e44c061359616fe599c8b766dd7f1a24b0d2bff0b72da9e60d08e9035c678558720a1cfe56d0ac8497c3198336c22e987d0325aa2ba138211ed39179d993a72a1e6faa4d9d5173175ae857d22ae3f014686f62879c8b1dae45717c47e1c0eb0b492a656b3bdb297edaaa7f0b7c5a83f9516d0ffa196eb085f18774f0203010001a3633061300e0603551d0f0101ff040403020186300f0603551d130101ff040530030101ff301d0603551d0e0416041445eba2aff492cb82312d518ba7a7219df36dc80f301f0603551d2304183016801445eba2aff492cb82312d518ba7a7219df36dc80f300d06092a864886f70d01010505000382010100a20ebcdfe2edf0e372737a6494bff77266d832e4427562ae87ebf2d5d9de56b39fccce1428b90d97605c124c58e4d33d834945589735691aa847ea56c679ab12d8678184df7f093c94e6b8262c20bd3db32889f75fff22e297841fe965ef87e0dfc16749b35debb2092aeb26ed78be7d3f2bf3b726356d5f8901b6495b9f01059bab3d25c1ccb67fc2f16f86c6fa6468eb812d94eb42b7fa8c1edd62f1be5067b76cbdf3f11f6b0c3607167f377ca95b6d7af112466083d72704be4bce97bec3672a6811df80e70c3366bf130d146ef37f1f63101efa8d1b256d6c8fa5b76101b1d2a326a110719dade2c3f9c39951b72b0708ce2ee650b2a7fa0a452fa2f0f2	MobileEmuHelper.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\D69B561148F01C77C54578C10926DF5B856976AD\Blob = 190000000100000010000000d0fd3c9c380d7b65e26b9a3fedd39b8f030000000100000014000000d69b561148f01c77c54578c10926df5b856976ad1d000000010000001000000001728e1ecf7a9d86fb3cec8948aba9531400000001000000140000008ff04b7fa82e4524ae4d50fa639a8bdee2dd1bbc620000000100000020000000cbb522d7b7f127ad6a0113865bdf1cd4102e7d0759af635a7cf4720dc963c53b0b000000010000003000000047006c006f00620061006c005300690067006e00200052006f006f00740020004300410020002d002000520033000000530000000100000040000000303e301f06092b06010401a032010130123010060a2b0601040182373c0101030200c0301b060567810c010330123010060a2b0601040182373c0101030200c0090000000100000054000000305206082b0601050507030206082b06010505070303060a2b0601040182370a030406082b0601050507030406082b0601050507030606082b0601050507030706082b0601050507030106082b060105050703080f00000001000000200000005229ba15b31b0c6f4cca89c2985177974327d1b689a3b935a0bd975532af22ab2000000001000000630300003082035f30820247a003020102020b04000000000121585308a2300d06092a864886f70d01010b0500304c3120301e060355040b1317476c6f62616c5369676e20526f6f74204341202d20523331133011060355040a130a476c6f62616c5369676e311330110603550403130a476c6f62616c5369676e301e170d3039303331383130303030305a170d3239303331383130303030305a304c3120301e060355040b1317476c6f62616c5369676e20526f6f74204341202d20523331133011060355040a130a476c6f62616c5369676e311330110603550403130a476c6f62616c5369676e30820122300d06092a864886f70d01010105000382010f003082010a0282010100cc2576907906782216f5c083b684ca289efd057611c5ad8872fc460243c7b28a9d045f24cb2e4be1608246e152ab0c8147706cdd64d1ebf52ca30f823d0c2bae97d7b614861079bb3b1380778c08e149d26a622f1f5efa9668df892795389f06d73ec9cb26590d73deb0c8e9260e8315c6ef5b8bd20460ca49a628f6693bf6cbc82891e59d8a615737ac7414dc74e03aee722f2e9cfbd0bbbff53d00e10633e8822bae53a63a16738cdd410e203ac0b4a7a1e9b24f902e3260e957cbb904926868e538266075b29f77ff9114efae2049fcad401548d1023161195eb897efad77b7649a7abf5fc113ef9b62fb0d6ce0546916a903da6ee983937176c6698582170203010001a3423040300e0603551d0f0101ff040403020106300f0603551d130101ff040530030101ff301d0603551d0e041604148ff04b7fa82e4524ae4d50fa639a8bdee2dd1bbc300d06092a864886f70d01010b050003820101004b40dbc050aafec80ceff796544549bb96000941acb3138686280733ca6be674b9ba002daea40ad3f5f1f10f8abf73674a83c7447b78e0af6e6c6f03298e333945c38ee4b9576caafc1296ec53c62de4246cb99463fbdc536867563e83b8cf3521c3c968fecedac253aacc908ae9f05d468c95dd7a58281a2f1ddecd0037418fed446dd75328977ef367041e15d78a96b4d3de4c27a44c1b737376f41799c21f7a0ee32d08ad0a1c2cff3cab550e0f917e36ebc35749bee12e2d7c608bc3415113239dcef7326b9401a899e72c331f3a3b25d28640ce3b2c8678c9612f14baeedb556fdf84ee05094dbd28d872ced36250651eeb92978331d9b3b5ca47583f5f	f4a4d823df9f181439042e62c776f49a801907228264a44766f985ac4166e74e.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\E12DFB4B41D7D9C32B30514BAC1D81D8385E2D46\Blob = 0f0000000100000014000000f45a0858c9cd920e647bad539ab9f1cfc77f24cb0b000000010000002a0000005300650063007400690067006f0020002800550054004e0020004f0062006a0065006300740029000000090000000100000022000000302006082b06010505070303060a2b0601040182370a030406082b060105050703086200000001000000200000006fff78e400a70c11011cd85977c459fb5af96a3df0540820d0f4b8607875e58f140000000100000014000000daed6474149c143cabdd99a9bd5b284d8b3cc9d81d0000000100000010000000f919b9ccce1e59c2e785f7dc2ccf67087e0000000100000008000000000063f58926d70168000000010000000800000000409120d035d901030000000100000014000000e12dfb4b41d7d9c32b30514bac1d81d8385e2d4620000000010000006a040000308204663082034ea003020102021044be0c8b500024b411d3362de0b35f1b300d06092a864886f70d0101050500308195310b3009060355040613025553310b3009060355040813025554311730150603550407130e53616c74204c616b652043697479311e301c060355040a131554686520555345525452555354204e6574776f726b3121301f060355040b1318687474703a2f2f7777772e7573657274727573742e636f6d311d301b0603550403131455544e2d5553455246697273742d4f626a656374301e170d3939303730393138333132305a170d3139303730393138343033365a308195310b3009060355040613025553310b3009060355040813025554311730150603550407130e53616c74204c616b652043697479311e301c060355040a131554686520555345525452555354204e6574776f726b3121301f060355040b1318687474703a2f2f7777772e7573657274727573742e636f6d311d301b0603550403131455544e2d5553455246697273742d4f626a65637430820122300d06092a864886f70d01010105000382010f003082010a0282010100ceaa813fa3a36178aa31005595119e270f1f1cdf3a9b826830c04a611df12f0efabe79f7a523ef55519684cddbe3b96e3e31d80a2067c7f4d9bf94eb47043e02ce2aa25d870409f6309d188a97b2aa1cfc41d2a136cbfb3d91bae7d97035fae4e790c39ba39bd33cf5129977b1b709e068e61cb8f39463886a6afe0b76c9bef422e467b9ab1a5e77c18507dd0d6cbfee06c7776a419ea70fd7fbee9417b7fc85bea4abc41c31ddd7b6d1e4f0efdf168fb25293d7a1d489a1072ebfe10112421e1ae1d89534db647928ffba2e11c2e5e85b9248fb470bc26cdaad328341f3a5e54170fd65906dfafa51c4f9bd962b19042cd36da7dcf07f6f8365e26aab8786750203010001a381af3081ac300b0603551d0f0404030201c6300f0603551d130101ff040530030101ff301d0603551d0e04160414daed6474149c143cabdd99a9bd5b284d8b3cc9d830420603551d1f043b30393037a035a0338631687474703a2f2f63726c2e7573657274727573742e636f6d2f55544e2d5553455246697273742d4f626a6563742e63726c30290603551d250422302006082b0601050507030306082b06010505070308060a2b0601040182370a0304300d06092a864886f70d01010505000382010100081f52b1374478dbfdceb9da959698aa556480b55a40dd21a5c5c1f35f2c4cc8475a69eae8f03535f4d025f3c8a6a4874abd1bb17308bdd4c3cab635bb59867731cda78014ae13effcb148f96b25252d51b62c6d45c198c88a565d3eee434e3e6b278ed03a4b850b5fd3ed6aa775cbd15a872f3975135a72b002819fbef00f845420626c69d4e14dc60d9943010d12968c789dbf50a2b144aa6acf177acf6f0fd4f824555ff0341649663e5046c96371383162b862b9f353ad6cb52ba212aa194f09da5ee793c68e1408fef0308018a086854dc87dd78b03fe6ed5f79d16ac922ca023e59c91521f94df179473c3b3c1c17105200078bd13521da83ecd001fc8	update.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\8094640EB5A7A1CA119C1FDDD59F810263A7FBD1	LDSGameRun.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\8094640EB5A7A1CA119C1FDDD59F810263A7FBD1\Blob = 5c000000010000000400000000100000190000000100000010000000cb9dd0fceaaa492f75ce292c21bbfbdd0300000001000000140000008094640eb5a7a1ca119c1fddd59f810263a7fbd17e00000001000000080000000080c82b6886d7017a000000010000000c000000300a06082b060105050703091d0000000100000010000000521f5c98970d19a8e515ef6eeb6d48ef140000000100000014000000ae6c05a39313e2a2e7e2d71cd6c7f07fc86753a07f0000000100000016000000301406082b0601050507030306082b060105050703096200000001000000200000002cabeafe37d06ca22aba7391c0033d25982952c453647349763a3ab5ad6ccf690b000000010000003000000047006c006f00620061006c005300690067006e00200052006f006f00740020004300410020002d002000520036000000090000000100000056000000305406082b0601050507030206082b06010505070303060a2b0601040182370a030c060a2b0601040182370a030406082b0601050507030406082b0601050507030906082b0601050507030106082b0601050507030853000000010000007e000000307c301f06092b06010401a032010130123010060a2b0601040182373c0101030200c0301f06092b06010401a032010230123010060a2b0601040182373c0101030200c0301b060567810c010130123010060a2b0601040182373c0101030200c0301b060567810c010330123010060a2b0601040182373c0101030200c00f0000000100000030000000ea09c51d4c3a334ce4acd2bc08c6a9be352e334f45c4fccfcab63edb9f82dc87d4bd2ed2fadae11163fb954809984ff10400000001000000100000004fdd07e4d42264391e0c3742ead1c6ae200000000100000087050000308205833082036ba003020102020e45e6bb038333c3856548e6ff4551300d06092a864886f70d01010c0500304c3120301e060355040b1317476c6f62616c5369676e20526f6f74204341202d20523631133011060355040a130a476c6f62616c5369676e311330110603550403130a476c6f62616c5369676e301e170d3134313231303030303030305a170d3334313231303030303030305a304c3120301e060355040b1317476c6f62616c5369676e20526f6f74204341202d20523631133011060355040a130a476c6f62616c5369676e311330110603550403130a476c6f62616c5369676e30820222300d06092a864886f70d01010105000382020f003082020a02820201009507e873ca66f9ec14ca7b3cf70d08f1b4450b2c82b448c6eb5b3cae83b841923314a46f7fe92accc6b0886bc5b689d1c6b2ff14ce511421ec4add1b5ac6d687ee4d3a1506ed64660b9280ca44de73944ef3a7897f4f786308c812506d42662f4db979284d521a8a1a80b719810e7ec48abc644c211c4368d73d3c8ac5b266d5909ab73106c5bee26d3206a61ef9b9ebaaa3b8bfbe826350d0f01889dfe40f79f5eaa21f2ad2702e7be7bc93bb6d53e2487c8c100738ff66b277617ee0ea8c3caab4a4f6f3954a12076dfd8cb289cfd0a06177c85874b0d4233af75d3acaa2db9d09de5d442d90f181cd5792fa7ebc50046334df6b9318be6b36b239e4ac2436b7f0efb61c135793b6deb2f8e285b773a2b835aa45f2e09d36a16f548af172566e2e88c55142441594eea3c538969b4e4e5a0b47f30636497730bc7137e5a6ec210875fce661163f77d5d99197840a6cd4024d74c014edfd39fb83f25e14a104b00be9feee8fe16e0bb208b36166096ab1063a659659c0f035fdc9da288d1a118770810aa89a751d9e3a8605009edb80d625f9dc059e27594c76395beaf9a5a1d8830fd1ffdf3011f985cf3348f5ca6d64142c7a584fd34b0849c595641a630e793df5b38cca58ad9c4245796e0e87195c54b165b6bf8c9bdc13e90d6fb82edc676ec98b11b584148a0019708379919791d41a27bf371e3207d814633c284caf0203010001a3633061300e0603551d0f0101ff040403020106300f0603551d130101ff040530030101ff301d0603551d0e04160414ae6c05a39313e2a2e7e2d71cd6c7f07fc86753a0301f0603551d23041830168014ae6c05a39313e2a2e7e2d71cd6c7f07fc86753a0300d06092a864886f70d01010c050003820201008325ede8d1fd9552cd9ec004a09169e65cd084dedcada24fe84778d66598a95ba83c877c028ad16eb71673e65fc05498d574bec1cde21191ad23183ddde1724496b4955ec07b8e99781643135657b3a2b33bb577dc4072aca3eb9b353eb10821a1e7c443377932beb5e79c2c4cbc4329998e30d3ac21e0e31dfad80733765400222ab94d202e7068dae553fc835cd39df2ff440c4466f2d2e3bd46001a6d02ba255d8da13151dd54461c4ddb9996ef1a1c045ca615ef78e079fe5ddb3eaa4c55fd9a15a96fe1a6fbdf7030e9c3ee4246edc2930589fa7d637b3fd071817c00e898ae0e7834c325fbaf0a9f206bdd3b138f128ce2411a487a73a07769c7b65c7f82c81efe581b282ba86cad5e6dc005d27bb7eb80fe2537fe029b68ac425dc3eef5ccdcf05075d236699ce67b04df6e0669b6de0a09485987eb7b14607a64aa6943ef91c74cec18dd6cef532d8c99e15ef2723ecf54c8bd67eca40f4c45ffd3b93023074c8f10bf8696d9995ab499571ca4ccbb158953ba2c050fe4c49e19b11834d54c9dbaedf71faf24950478a803bbee81e5da5f7c8b4aa1907425a7b33e4bc82c56bdc7c8ef38e25c92f079f79c84ba742d6101207e7ed1f24f07595f8b2d4352eb460c94e1f566477977d5545b1fad2437cb455a4ea04448c8d8b099c5158409f6d64949c065b8e61a716ea0a8f182e8453e6cd602d70a6783055ac9a410	LDSGameRun.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\0563B8630D62D75ABBC8AB1E4BDFB5A899B24D43\Blob = 0f00000001000000140000006dca5bd00dcf1c0f327059d374b29ca6e3c50aa6530000000100000040000000303e301f06096086480186fd6c020130123010060a2b0601040182373c0101030200c0301b060567810c010330123010060a2b0601040182373c0101030200c0090000000100000034000000303206082b0601050507030206082b0601050507030306082b0601050507030406082b0601050507030106082b060105050703086200000001000000200000003e9099b5015e8f486c00bcea9d111ee721faba355a89bcf1df69561e3dc6325c14000000010000001400000045eba2aff492cb82312d518ba7a7219df36dc80f0b00000001000000120000004400690067006900430065007200740000001d00000001000000100000004f5f106930398d09107b40c3c7ca8f1c0300000001000000140000000563b8630d62d75abbc8ab1e4bdfb5a899b24d432000000001000000bb030000308203b73082029fa00302010202100ce7e0e517d846fe8fe560fc1bf03039300d06092a864886f70d01010505003065310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d312430220603550403131b4469676943657274204173737572656420494420526f6f74204341301e170d3036313131303030303030305a170d3331313131303030303030305a3065310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d312430220603550403131b4469676943657274204173737572656420494420526f6f7420434130820122300d06092a864886f70d01010105000382010f003082010a0282010100ad0e15cee443805cb187f3b760f97112a5aedc269488aaf4cef520392858600cf880daa9159532613cb5b128848a8adc9f0a0c83177a8f90ac8ae779535c31842af60f98323676ccdedd3ca8a2ef6afb21f25261df9f20d71fe2b1d9fe1864d2125b5ff9581835bc47cda136f96b7fd4b0383ec11bc38c33d9d82f18fe280fb3a783d6c36e44c061359616fe599c8b766dd7f1a24b0d2bff0b72da9e60d08e9035c678558720a1cfe56d0ac8497c3198336c22e987d0325aa2ba138211ed39179d993a72a1e6faa4d9d5173175ae857d22ae3f014686f62879c8b1dae45717c47e1c0eb0b492a656b3bdb297edaaa7f0b7c5a83f9516d0ffa196eb085f18774f0203010001a3633061300e0603551d0f0101ff040403020186300f0603551d130101ff040530030101ff301d0603551d0e0416041445eba2aff492cb82312d518ba7a7219df36dc80f301f0603551d2304183016801445eba2aff492cb82312d518ba7a7219df36dc80f300d06092a864886f70d01010505000382010100a20ebcdfe2edf0e372737a6494bff77266d832e4427562ae87ebf2d5d9de56b39fccce1428b90d97605c124c58e4d33d834945589735691aa847ea56c679ab12d8678184df7f093c94e6b8262c20bd3db32889f75fff22e297841fe965ef87e0dfc16749b35debb2092aeb26ed78be7d3f2bf3b726356d5f8901b6495b9f01059bab3d25c1ccb67fc2f16f86c6fa6468eb812d94eb42b7fa8c1edd62f1be5067b76cbdf3f11f6b0c3607167f377ca95b6d7af112466083d72704be4bce97bec3672a6811df80e70c3366bf130d146ef37f1f63101efa8d1b256d6c8fa5b76101b1d2a326a110719dade2c3f9c39951b72b0708ce2ee650b2a7fa0a452fa2f0f2	f4a4d823df9f181439042e62c776f49a801907228264a44766f985ac4166e74e.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\0563B8630D62D75ABBC8AB1E4BDFB5A899B24D43\Blob = 04000000010000001000000087ce0b7b2a0e4900e158719b37a893720f00000001000000140000006dca5bd00dcf1c0f327059d374b29ca6e3c50aa6530000000100000040000000303e301f06096086480186fd6c020130123010060a2b0601040182373c0101030200c0301b060567810c010330123010060a2b0601040182373c0101030200c0090000000100000034000000303206082b0601050507030206082b0601050507030306082b0601050507030406082b0601050507030106082b060105050703086200000001000000200000003e9099b5015e8f486c00bcea9d111ee721faba355a89bcf1df69561e3dc6325c14000000010000001400000045eba2aff492cb82312d518ba7a7219df36dc80f0b00000001000000120000004400690067006900430065007200740000001d00000001000000100000004f5f106930398d09107b40c3c7ca8f1c0300000001000000140000000563b8630d62d75abbc8ab1e4bdfb5a899b24d43190000000100000010000000749966cecc95c1874194ca7203f9b6202000000001000000bb030000308203b73082029fa00302010202100ce7e0e517d846fe8fe560fc1bf03039300d06092a864886f70d01010505003065310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d312430220603550403131b4469676943657274204173737572656420494420526f6f74204341301e170d3036313131303030303030305a170d3331313131303030303030305a3065310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d312430220603550403131b4469676943657274204173737572656420494420526f6f7420434130820122300d06092a864886f70d01010105000382010f003082010a0282010100ad0e15cee443805cb187f3b760f97112a5aedc269488aaf4cef520392858600cf880daa9159532613cb5b128848a8adc9f0a0c83177a8f90ac8ae779535c31842af60f98323676ccdedd3ca8a2ef6afb21f25261df9f20d71fe2b1d9fe1864d2125b5ff9581835bc47cda136f96b7fd4b0383ec11bc38c33d9d82f18fe280fb3a783d6c36e44c061359616fe599c8b766dd7f1a24b0d2bff0b72da9e60d08e9035c678558720a1cfe56d0ac8497c3198336c22e987d0325aa2ba138211ed39179d993a72a1e6faa4d9d5173175ae857d22ae3f014686f62879c8b1dae45717c47e1c0eb0b492a656b3bdb297edaaa7f0b7c5a83f9516d0ffa196eb085f18774f0203010001a3633061300e0603551d0f0101ff040403020186300f0603551d130101ff040530030101ff301d0603551d0e0416041445eba2aff492cb82312d518ba7a7219df36dc80f301f0603551d2304183016801445eba2aff492cb82312d518ba7a7219df36dc80f300d06092a864886f70d01010505000382010100a20ebcdfe2edf0e372737a6494bff77266d832e4427562ae87ebf2d5d9de56b39fccce1428b90d97605c124c58e4d33d834945589735691aa847ea56c679ab12d8678184df7f093c94e6b8262c20bd3db32889f75fff22e297841fe965ef87e0dfc16749b35debb2092aeb26ed78be7d3f2bf3b726356d5f8901b6495b9f01059bab3d25c1ccb67fc2f16f86c6fa6468eb812d94eb42b7fa8c1edd62f1be5067b76cbdf3f11f6b0c3607167f377ca95b6d7af112466083d72704be4bce97bec3672a6811df80e70c3366bf130d146ef37f1f63101efa8d1b256d6c8fa5b76101b1d2a326a110719dade2c3f9c39951b72b0708ce2ee650b2a7fa0a452fa2f0f2	MobileEmuHelper.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
4444	f4a4d823df9f181439042e62c776f49a801907228264a44766f985ac4166e74e.exe
4444	f4a4d823df9f181439042e62c776f49a801907228264a44766f985ac4166e74e.exe
4444	f4a4d823df9f181439042e62c776f49a801907228264a44766f985ac4166e74e.exe
4444	f4a4d823df9f181439042e62c776f49a801907228264a44766f985ac4166e74e.exe
4444	f4a4d823df9f181439042e62c776f49a801907228264a44766f985ac4166e74e.exe
4444	f4a4d823df9f181439042e62c776f49a801907228264a44766f985ac4166e74e.exe
4444	f4a4d823df9f181439042e62c776f49a801907228264a44766f985ac4166e74e.exe
4444	f4a4d823df9f181439042e62c776f49a801907228264a44766f985ac4166e74e.exe
4444	f4a4d823df9f181439042e62c776f49a801907228264a44766f985ac4166e74e.exe
4444	f4a4d823df9f181439042e62c776f49a801907228264a44766f985ac4166e74e.exe
4444	f4a4d823df9f181439042e62c776f49a801907228264a44766f985ac4166e74e.exe
4444	f4a4d823df9f181439042e62c776f49a801907228264a44766f985ac4166e74e.exe
4444	f4a4d823df9f181439042e62c776f49a801907228264a44766f985ac4166e74e.exe
4444	f4a4d823df9f181439042e62c776f49a801907228264a44766f985ac4166e74e.exe
4444	f4a4d823df9f181439042e62c776f49a801907228264a44766f985ac4166e74e.exe
4444	f4a4d823df9f181439042e62c776f49a801907228264a44766f985ac4166e74e.exe
4444	f4a4d823df9f181439042e62c776f49a801907228264a44766f985ac4166e74e.exe
4444	f4a4d823df9f181439042e62c776f49a801907228264a44766f985ac4166e74e.exe
4444	f4a4d823df9f181439042e62c776f49a801907228264a44766f985ac4166e74e.exe
4444	f4a4d823df9f181439042e62c776f49a801907228264a44766f985ac4166e74e.exe
4444	f4a4d823df9f181439042e62c776f49a801907228264a44766f985ac4166e74e.exe
4444	f4a4d823df9f181439042e62c776f49a801907228264a44766f985ac4166e74e.exe
4444	f4a4d823df9f181439042e62c776f49a801907228264a44766f985ac4166e74e.exe
4444	f4a4d823df9f181439042e62c776f49a801907228264a44766f985ac4166e74e.exe
4444	f4a4d823df9f181439042e62c776f49a801907228264a44766f985ac4166e74e.exe
4444	f4a4d823df9f181439042e62c776f49a801907228264a44766f985ac4166e74e.exe
4444	f4a4d823df9f181439042e62c776f49a801907228264a44766f985ac4166e74e.exe
4444	f4a4d823df9f181439042e62c776f49a801907228264a44766f985ac4166e74e.exe
4444	f4a4d823df9f181439042e62c776f49a801907228264a44766f985ac4166e74e.exe
4444	f4a4d823df9f181439042e62c776f49a801907228264a44766f985ac4166e74e.exe
4444	f4a4d823df9f181439042e62c776f49a801907228264a44766f985ac4166e74e.exe
4444	f4a4d823df9f181439042e62c776f49a801907228264a44766f985ac4166e74e.exe
1632	MobileEmuHelper.exe
1632	MobileEmuHelper.exe
4444	f4a4d823df9f181439042e62c776f49a801907228264a44766f985ac4166e74e.exe
4444	f4a4d823df9f181439042e62c776f49a801907228264a44766f985ac4166e74e.exe
2508	svchost.exe
2508	svchost.exe
2508	svchost.exe
2508	svchost.exe
3124	LDSGameHall.exe
3124	LDSGameHall.exe
3124	LDSGameHall.exe
3124	LDSGameHall.exe
2348	LDSGameRun.exe
2348	LDSGameRun.exe
2348	LDSGameRun.exe
2348	LDSGameRun.exe
2348	LDSGameRun.exe
2348	LDSGameRun.exe
2348	LDSGameRun.exe
2348	LDSGameRun.exe
2348	LDSGameRun.exe
2348	LDSGameRun.exe
2348	LDSGameRun.exe
2348	LDSGameRun.exe
2348	LDSGameRun.exe
2348	LDSGameRun.exe
2348	LDSGameRun.exe
2348	LDSGameRun.exe
2348	LDSGameRun.exe
2348	LDSGameRun.exe
2348	LDSGameRun.exe
2348	LDSGameRun.exe

Suspicious behavior: LoadsDriver 1 IoCs

pid	Process
660	Process not Found

Suspicious use of AdjustPrivilegeToken 9 IoCs

description	pid	Process
Token: SeDebugPrivilege	4444	f4a4d823df9f181439042e62c776f49a801907228264a44766f985ac4166e74e.exe
Token: SeDebugPrivilege	4444	f4a4d823df9f181439042e62c776f49a801907228264a44766f985ac4166e74e.exe
Token: SeDebugPrivilege	4444	f4a4d823df9f181439042e62c776f49a801907228264a44766f985ac4166e74e.exe
Token: SeDebugPrivilege	4444	f4a4d823df9f181439042e62c776f49a801907228264a44766f985ac4166e74e.exe
Token: 33	924	AUDIODG.EXE
Token: SeIncBasePriorityPrivilege	924	AUDIODG.EXE
Token: 33	3124	LDSGameHall.exe
Token: SeIncBasePriorityPrivilege	3124	LDSGameHall.exe
Token: SeDebugPrivilege	2348	LDSGameRun.exe

Suspicious use of FindShellTrayWindow 59 IoCs

pid	Process
4444	f4a4d823df9f181439042e62c776f49a801907228264a44766f985ac4166e74e.exe
4444	f4a4d823df9f181439042e62c776f49a801907228264a44766f985ac4166e74e.exe
4444	f4a4d823df9f181439042e62c776f49a801907228264a44766f985ac4166e74e.exe
4444	f4a4d823df9f181439042e62c776f49a801907228264a44766f985ac4166e74e.exe
4444	f4a4d823df9f181439042e62c776f49a801907228264a44766f985ac4166e74e.exe
4444	f4a4d823df9f181439042e62c776f49a801907228264a44766f985ac4166e74e.exe
4444	f4a4d823df9f181439042e62c776f49a801907228264a44766f985ac4166e74e.exe
4444	f4a4d823df9f181439042e62c776f49a801907228264a44766f985ac4166e74e.exe
4444	f4a4d823df9f181439042e62c776f49a801907228264a44766f985ac4166e74e.exe
4444	f4a4d823df9f181439042e62c776f49a801907228264a44766f985ac4166e74e.exe
4444	f4a4d823df9f181439042e62c776f49a801907228264a44766f985ac4166e74e.exe
4444	f4a4d823df9f181439042e62c776f49a801907228264a44766f985ac4166e74e.exe
4444	f4a4d823df9f181439042e62c776f49a801907228264a44766f985ac4166e74e.exe
4444	f4a4d823df9f181439042e62c776f49a801907228264a44766f985ac4166e74e.exe
4444	f4a4d823df9f181439042e62c776f49a801907228264a44766f985ac4166e74e.exe
4444	f4a4d823df9f181439042e62c776f49a801907228264a44766f985ac4166e74e.exe
4444	f4a4d823df9f181439042e62c776f49a801907228264a44766f985ac4166e74e.exe
4444	f4a4d823df9f181439042e62c776f49a801907228264a44766f985ac4166e74e.exe
4444	f4a4d823df9f181439042e62c776f49a801907228264a44766f985ac4166e74e.exe
4444	f4a4d823df9f181439042e62c776f49a801907228264a44766f985ac4166e74e.exe
4444	f4a4d823df9f181439042e62c776f49a801907228264a44766f985ac4166e74e.exe
4444	f4a4d823df9f181439042e62c776f49a801907228264a44766f985ac4166e74e.exe
4444	f4a4d823df9f181439042e62c776f49a801907228264a44766f985ac4166e74e.exe
4444	f4a4d823df9f181439042e62c776f49a801907228264a44766f985ac4166e74e.exe
4444	f4a4d823df9f181439042e62c776f49a801907228264a44766f985ac4166e74e.exe
4444	f4a4d823df9f181439042e62c776f49a801907228264a44766f985ac4166e74e.exe
4444	f4a4d823df9f181439042e62c776f49a801907228264a44766f985ac4166e74e.exe
4444	f4a4d823df9f181439042e62c776f49a801907228264a44766f985ac4166e74e.exe
4444	f4a4d823df9f181439042e62c776f49a801907228264a44766f985ac4166e74e.exe
4444	f4a4d823df9f181439042e62c776f49a801907228264a44766f985ac4166e74e.exe
4444	f4a4d823df9f181439042e62c776f49a801907228264a44766f985ac4166e74e.exe
4444	f4a4d823df9f181439042e62c776f49a801907228264a44766f985ac4166e74e.exe
4444	f4a4d823df9f181439042e62c776f49a801907228264a44766f985ac4166e74e.exe
4444	f4a4d823df9f181439042e62c776f49a801907228264a44766f985ac4166e74e.exe
4444	f4a4d823df9f181439042e62c776f49a801907228264a44766f985ac4166e74e.exe
4444	f4a4d823df9f181439042e62c776f49a801907228264a44766f985ac4166e74e.exe
4444	f4a4d823df9f181439042e62c776f49a801907228264a44766f985ac4166e74e.exe
4444	f4a4d823df9f181439042e62c776f49a801907228264a44766f985ac4166e74e.exe
4444	f4a4d823df9f181439042e62c776f49a801907228264a44766f985ac4166e74e.exe
4444	f4a4d823df9f181439042e62c776f49a801907228264a44766f985ac4166e74e.exe
4444	f4a4d823df9f181439042e62c776f49a801907228264a44766f985ac4166e74e.exe
4444	f4a4d823df9f181439042e62c776f49a801907228264a44766f985ac4166e74e.exe
4444	f4a4d823df9f181439042e62c776f49a801907228264a44766f985ac4166e74e.exe
4444	f4a4d823df9f181439042e62c776f49a801907228264a44766f985ac4166e74e.exe
4444	f4a4d823df9f181439042e62c776f49a801907228264a44766f985ac4166e74e.exe
4444	f4a4d823df9f181439042e62c776f49a801907228264a44766f985ac4166e74e.exe
4444	f4a4d823df9f181439042e62c776f49a801907228264a44766f985ac4166e74e.exe
4444	f4a4d823df9f181439042e62c776f49a801907228264a44766f985ac4166e74e.exe
4444	f4a4d823df9f181439042e62c776f49a801907228264a44766f985ac4166e74e.exe
4444	f4a4d823df9f181439042e62c776f49a801907228264a44766f985ac4166e74e.exe
4444	f4a4d823df9f181439042e62c776f49a801907228264a44766f985ac4166e74e.exe
4444	f4a4d823df9f181439042e62c776f49a801907228264a44766f985ac4166e74e.exe
4444	f4a4d823df9f181439042e62c776f49a801907228264a44766f985ac4166e74e.exe
4444	f4a4d823df9f181439042e62c776f49a801907228264a44766f985ac4166e74e.exe
4444	f4a4d823df9f181439042e62c776f49a801907228264a44766f985ac4166e74e.exe
4444	f4a4d823df9f181439042e62c776f49a801907228264a44766f985ac4166e74e.exe
4444	f4a4d823df9f181439042e62c776f49a801907228264a44766f985ac4166e74e.exe
4444	f4a4d823df9f181439042e62c776f49a801907228264a44766f985ac4166e74e.exe
4444	f4a4d823df9f181439042e62c776f49a801907228264a44766f985ac4166e74e.exe

Suspicious use of SendNotifyMessage 59 IoCs

pid	Process
4444	f4a4d823df9f181439042e62c776f49a801907228264a44766f985ac4166e74e.exe
4444	f4a4d823df9f181439042e62c776f49a801907228264a44766f985ac4166e74e.exe
4444	f4a4d823df9f181439042e62c776f49a801907228264a44766f985ac4166e74e.exe
4444	f4a4d823df9f181439042e62c776f49a801907228264a44766f985ac4166e74e.exe
4444	f4a4d823df9f181439042e62c776f49a801907228264a44766f985ac4166e74e.exe
4444	f4a4d823df9f181439042e62c776f49a801907228264a44766f985ac4166e74e.exe
4444	f4a4d823df9f181439042e62c776f49a801907228264a44766f985ac4166e74e.exe
4444	f4a4d823df9f181439042e62c776f49a801907228264a44766f985ac4166e74e.exe
4444	f4a4d823df9f181439042e62c776f49a801907228264a44766f985ac4166e74e.exe
4444	f4a4d823df9f181439042e62c776f49a801907228264a44766f985ac4166e74e.exe
4444	f4a4d823df9f181439042e62c776f49a801907228264a44766f985ac4166e74e.exe
4444	f4a4d823df9f181439042e62c776f49a801907228264a44766f985ac4166e74e.exe
4444	f4a4d823df9f181439042e62c776f49a801907228264a44766f985ac4166e74e.exe
4444	f4a4d823df9f181439042e62c776f49a801907228264a44766f985ac4166e74e.exe
4444	f4a4d823df9f181439042e62c776f49a801907228264a44766f985ac4166e74e.exe
4444	f4a4d823df9f181439042e62c776f49a801907228264a44766f985ac4166e74e.exe
4444	f4a4d823df9f181439042e62c776f49a801907228264a44766f985ac4166e74e.exe
4444	f4a4d823df9f181439042e62c776f49a801907228264a44766f985ac4166e74e.exe
4444	f4a4d823df9f181439042e62c776f49a801907228264a44766f985ac4166e74e.exe
4444	f4a4d823df9f181439042e62c776f49a801907228264a44766f985ac4166e74e.exe
4444	f4a4d823df9f181439042e62c776f49a801907228264a44766f985ac4166e74e.exe
4444	f4a4d823df9f181439042e62c776f49a801907228264a44766f985ac4166e74e.exe
4444	f4a4d823df9f181439042e62c776f49a801907228264a44766f985ac4166e74e.exe
4444	f4a4d823df9f181439042e62c776f49a801907228264a44766f985ac4166e74e.exe
4444	f4a4d823df9f181439042e62c776f49a801907228264a44766f985ac4166e74e.exe
4444	f4a4d823df9f181439042e62c776f49a801907228264a44766f985ac4166e74e.exe
4444	f4a4d823df9f181439042e62c776f49a801907228264a44766f985ac4166e74e.exe
4444	f4a4d823df9f181439042e62c776f49a801907228264a44766f985ac4166e74e.exe
4444	f4a4d823df9f181439042e62c776f49a801907228264a44766f985ac4166e74e.exe
4444	f4a4d823df9f181439042e62c776f49a801907228264a44766f985ac4166e74e.exe
4444	f4a4d823df9f181439042e62c776f49a801907228264a44766f985ac4166e74e.exe
4444	f4a4d823df9f181439042e62c776f49a801907228264a44766f985ac4166e74e.exe
4444	f4a4d823df9f181439042e62c776f49a801907228264a44766f985ac4166e74e.exe
4444	f4a4d823df9f181439042e62c776f49a801907228264a44766f985ac4166e74e.exe
4444	f4a4d823df9f181439042e62c776f49a801907228264a44766f985ac4166e74e.exe
4444	f4a4d823df9f181439042e62c776f49a801907228264a44766f985ac4166e74e.exe
4444	f4a4d823df9f181439042e62c776f49a801907228264a44766f985ac4166e74e.exe
4444	f4a4d823df9f181439042e62c776f49a801907228264a44766f985ac4166e74e.exe
4444	f4a4d823df9f181439042e62c776f49a801907228264a44766f985ac4166e74e.exe
4444	f4a4d823df9f181439042e62c776f49a801907228264a44766f985ac4166e74e.exe
4444	f4a4d823df9f181439042e62c776f49a801907228264a44766f985ac4166e74e.exe
4444	f4a4d823df9f181439042e62c776f49a801907228264a44766f985ac4166e74e.exe
4444	f4a4d823df9f181439042e62c776f49a801907228264a44766f985ac4166e74e.exe
4444	f4a4d823df9f181439042e62c776f49a801907228264a44766f985ac4166e74e.exe
4444	f4a4d823df9f181439042e62c776f49a801907228264a44766f985ac4166e74e.exe
4444	f4a4d823df9f181439042e62c776f49a801907228264a44766f985ac4166e74e.exe
4444	f4a4d823df9f181439042e62c776f49a801907228264a44766f985ac4166e74e.exe
4444	f4a4d823df9f181439042e62c776f49a801907228264a44766f985ac4166e74e.exe
4444	f4a4d823df9f181439042e62c776f49a801907228264a44766f985ac4166e74e.exe
4444	f4a4d823df9f181439042e62c776f49a801907228264a44766f985ac4166e74e.exe
4444	f4a4d823df9f181439042e62c776f49a801907228264a44766f985ac4166e74e.exe
4444	f4a4d823df9f181439042e62c776f49a801907228264a44766f985ac4166e74e.exe
4444	f4a4d823df9f181439042e62c776f49a801907228264a44766f985ac4166e74e.exe
4444	f4a4d823df9f181439042e62c776f49a801907228264a44766f985ac4166e74e.exe
4444	f4a4d823df9f181439042e62c776f49a801907228264a44766f985ac4166e74e.exe
4444	f4a4d823df9f181439042e62c776f49a801907228264a44766f985ac4166e74e.exe
4444	f4a4d823df9f181439042e62c776f49a801907228264a44766f985ac4166e74e.exe
4444	f4a4d823df9f181439042e62c776f49a801907228264a44766f985ac4166e74e.exe
4444	f4a4d823df9f181439042e62c776f49a801907228264a44766f985ac4166e74e.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
3124	LDSGameHall.exe
3124	LDSGameHall.exe

Suspicious use of WriteProcessMemory 30 IoCs

description	pid	Process	procid_target
PID 4444 wrote to memory of 1632	4444	f4a4d823df9f181439042e62c776f49a801907228264a44766f985ac4166e74e.exe	86
PID 4444 wrote to memory of 1632	4444	f4a4d823df9f181439042e62c776f49a801907228264a44766f985ac4166e74e.exe	86
PID 4444 wrote to memory of 1632	4444	f4a4d823df9f181439042e62c776f49a801907228264a44766f985ac4166e74e.exe	86
PID 4444 wrote to memory of 3772	4444	f4a4d823df9f181439042e62c776f49a801907228264a44766f985ac4166e74e.exe	88
PID 4444 wrote to memory of 3772	4444	f4a4d823df9f181439042e62c776f49a801907228264a44766f985ac4166e74e.exe	88
PID 4444 wrote to memory of 3772	4444	f4a4d823df9f181439042e62c776f49a801907228264a44766f985ac4166e74e.exe	88
PID 4444 wrote to memory of 372	4444	f4a4d823df9f181439042e62c776f49a801907228264a44766f985ac4166e74e.exe	87
PID 4444 wrote to memory of 372	4444	f4a4d823df9f181439042e62c776f49a801907228264a44766f985ac4166e74e.exe	87
PID 4444 wrote to memory of 372	4444	f4a4d823df9f181439042e62c776f49a801907228264a44766f985ac4166e74e.exe	87
PID 372 wrote to memory of 4344	372	RegSvr32.exe	90
PID 372 wrote to memory of 4344	372	RegSvr32.exe	90
PID 3772 wrote to memory of 1132	3772	RegSvr32.exe	91
PID 3772 wrote to memory of 1132	3772	RegSvr32.exe	91
PID 4444 wrote to memory of 3124	4444	f4a4d823df9f181439042e62c776f49a801907228264a44766f985ac4166e74e.exe	93
PID 4444 wrote to memory of 3124	4444	f4a4d823df9f181439042e62c776f49a801907228264a44766f985ac4166e74e.exe	93
PID 4444 wrote to memory of 3124	4444	f4a4d823df9f181439042e62c776f49a801907228264a44766f985ac4166e74e.exe	93
PID 3124 wrote to memory of 3564	3124	LDSGameHall.exe	95
PID 3124 wrote to memory of 3564	3124	LDSGameHall.exe	95
PID 3124 wrote to memory of 3564	3124	LDSGameHall.exe	95
PID 3124 wrote to memory of 4152	3124	LDSGameHall.exe	96
PID 3124 wrote to memory of 4152	3124	LDSGameHall.exe	96
PID 3124 wrote to memory of 4152	3124	LDSGameHall.exe	96
PID 4152 wrote to memory of 2012	4152	Dism.exe	98
PID 4152 wrote to memory of 2012	4152	Dism.exe	98
PID 3124 wrote to memory of 2348	3124	LDSGameHall.exe	101
PID 3124 wrote to memory of 2348	3124	LDSGameHall.exe	101
PID 3124 wrote to memory of 2348	3124	LDSGameHall.exe	101
PID 2508 wrote to memory of 1488	2508	svchost.exe	104
PID 2508 wrote to memory of 1488	2508	svchost.exe	104
PID 2508 wrote to memory of 1488	2508	svchost.exe	104

C:\Users\Admin\AppData\Local\Temp\f4a4d823df9f181439042e62c776f49a801907228264a44766f985ac4166e74e.exe
"C:\Users\Admin\AppData\Local\Temp\f4a4d823df9f181439042e62c776f49a801907228264a44766f985ac4166e74e.exe"
1⤵
- Sets DLL path for service in the registry
- Sets service image path in registry
- Checks computer location settings
- Loads dropped DLL
- Enumerates connected drives
- Writes to the Master Boot Record (MBR)
- Modifies system certificate store
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4444
- C:\MobileEmuMaster\Utils\MobileEmuHelper.exe
  C:\MobileEmuMaster\Utils\MobileEmuHelper.exe
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Writes to the Master Boot Record (MBR)
  - Modifies system certificate store
  - Suspicious behavior: EnumeratesProcesses
  PID:1632
- C:\Windows\SysWOW64\RegSvr32.exe
  "C:\Windows\System32\RegSvr32.exe" /s /i "C:\MobileEmuMaster\Plugin\ShellExt_x64.dll"
  2⤵
  - Loads dropped DLL
  - Suspicious use of WriteProcessMemory
  PID:372
- - C:\Windows\system32\regsvr32.exe
    /s /i "C:\MobileEmuMaster\Plugin\ShellExt_x64.dll"
    3⤵
    - Loads dropped DLL
    - Registers COM server for autorun
    - Modifies registry class
    PID:4344
- C:\Windows\SysWOW64\RegSvr32.exe
  "C:\Windows\System32\RegSvr32.exe" /s /i "C:\MobileEmuMaster\GameMemoryOpt_x64.dll"
  2⤵
  - Loads dropped DLL
  - Suspicious use of WriteProcessMemory
  PID:3772
- - C:\Windows\system32\regsvr32.exe
    /s /i "C:\MobileEmuMaster\GameMemoryOpt_x64.dll"
    3⤵
    - Loads dropped DLL
    - Registers COM server for autorun
    - Modifies registry class
    PID:1132
- C:\MobileEmuMaster\LDSGameHall\LDSGameHall.exe
  "C:\MobileEmuMaster\LDSGameHall\LDSGameHall.exe" /DisplayMode="hide" /From="inst" /HideBoot /NewInstall /PID="210101" /Push /SubPID="210101"
  2⤵
  - Checks computer location settings
  - Executes dropped EXE
  - Loads dropped DLL
  - Writes to the Master Boot Record (MBR)
  - Modifies Internet Explorer settings
  - Modifies registry class
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:3124
- - C:\MobileEmuMaster\update.exe
    "C:\MobileEmuMaster\update.exe" checkupdate
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - Writes to the Master Boot Record (MBR)
    - Modifies system certificate store
    PID:3564
- - C:\Windows\SysWOW64\Dism.exe
    /Online /Get-FeatureInfo:Microsoft-Hyper-V
    3⤵
    - Drops file in Windows directory
    - Suspicious use of WriteProcessMemory
    PID:4152
  - - C:\Users\Admin\AppData\Local\Temp\F46BF42F-8F2A-4259-89CF-59E29944C66C\dismhost.exe
      C:\Users\Admin\AppData\Local\Temp\F46BF42F-8F2A-4259-89CF-59E29944C66C\dismhost.exe {6A43DBB7-4EC3-4380-80A5-C140A0E3582B}
      4⤵
      Executes dropped EXE
      Loads dropped DLL
      Drops file in Windows directory
      PID:2012
- - C:\MobileEmuMaster\LDSGameHall\LDSGameRun.exe
    "C:\MobileEmuMaster\LDSGameHall\LDSGameRun.exe"
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - Writes to the Master Boot Record (MBR)
    - Drops file in Windows directory
    - Modifies system certificate store
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:2348

C:\Windows\SysWOW64\svchost.exe
C:\Windows\SysWOW64\svchost.exe -k netsvcs -s SpSvc
1⤵
- Loads dropped DLL
- Drops file in System32 directory
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:2508
- \??\c:\mobileemumaster\utils\ComputerZ14.exe
  "c:\mobileemumaster\utils\ComputerZ14.exe"
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  PID:1488

C:\Windows\system32\AUDIODG.EXE
C:\Windows\system32\AUDIODG.EXE 0x46c 0x3d8
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:924

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Pre-OS Boot

T1542

Bootkit

T1542.003

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Pre-OS Boot

T1542

Bootkit

T1542.003

Subvert Trust Controls

T1553

Install Root Certificate

T1553.004

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\MobileEmuMaster\360Base.dll

Filesize
881KB

MD5
84beb92b22b17841b326e4df2d31117b

SHA1
ef3a1cb3f64e3a9084f047c777f3ce29e761aa09

SHA256
51f68c7e9e40694ff4cc49d23a2e406b5feba6f0aa9f998bdd8030065c90a9da

SHA512
4d4b29e84daa5e999a35723bddb32019a306fdefec660fc53244385d960e55a94a9855093fc146e3fa0110f8dc6a264ef4c6802386c19175b7464c629f6fe8e9

Download Submit
C:\MobileEmuMaster\360Base.dll

Filesize
881KB

MD5
84beb92b22b17841b326e4df2d31117b

SHA1
ef3a1cb3f64e3a9084f047c777f3ce29e761aa09

SHA256
51f68c7e9e40694ff4cc49d23a2e406b5feba6f0aa9f998bdd8030065c90a9da

SHA512
4d4b29e84daa5e999a35723bddb32019a306fdefec660fc53244385d960e55a94a9855093fc146e3fa0110f8dc6a264ef4c6802386c19175b7464c629f6fe8e9

Download Submit
C:\MobileEmuMaster\360Base64.dll

Filesize
1.1MB

MD5
78daff414cb587699bed6980cebbf8a5

SHA1
eafca98f4b33643162eec9b2d6e1f558e3bad06a

SHA256
d972d608bc83e3642a8236f8f482d60dcf3138bbed55ef86fd228ee96aa9cb9e

SHA512
0f60f11d6ddbc8e38079093cf0889b6fd8cb9c2fb598fc83d838776771ce4c78c908c00f8980c14b8eb8ffdb6ecae9561db1291ea5cb68bfe8be9c2f1493b32a

Download Submit
C:\MobileEmuMaster\360NetUL.dll

Filesize
234KB

MD5
cd03029957ebc78c0ca7a6c02a9ca846

SHA1
0044114b8073781479044f0294701be9611be2ac

SHA256
139fdd92e6ddf1aac0761a68502b374daa32e82039621018511dc491ed9b4048

SHA512
14c641cb9536def0ddc1969d50b97b83a23017c97373e3ad74d3fbf9825ac81f3fdf8169281c8ad4cebd45d9c9ae05f752d553ba4653e620889b274479cb7c32

Download Submit
C:\MobileEmuMaster\360NetUL.dll

Filesize
234KB

MD5
cd03029957ebc78c0ca7a6c02a9ca846

SHA1
0044114b8073781479044f0294701be9611be2ac

SHA256
139fdd92e6ddf1aac0761a68502b374daa32e82039621018511dc491ed9b4048

SHA512
14c641cb9536def0ddc1969d50b97b83a23017c97373e3ad74d3fbf9825ac81f3fdf8169281c8ad4cebd45d9c9ae05f752d553ba4653e620889b274479cb7c32

Download Submit
C:\MobileEmuMaster\7z.dll

Filesize
1.1MB

MD5
a46135bdd574092d85955070e72d5aad

SHA1
aad137b0a883fea22b7118778512ffc7865513bc

SHA256
aa57160684feb240a85da677caaf7cf6a08b7349d89ae9cb4a3476884d80aac5

SHA512
72188f348d9ae33e2b5a7886c80667cc3015bfac170249537baa9e31abf8d63ca198903206feb64887f1d509a1b9bfc9f54ede8b3aa26bee3f5c4375e5c6a24b

Download Submit
C:\MobileEmuMaster\7z.dll

Filesize
1.1MB

MD5
a46135bdd574092d85955070e72d5aad

SHA1
aad137b0a883fea22b7118778512ffc7865513bc

SHA256
aa57160684feb240a85da677caaf7cf6a08b7349d89ae9cb4a3476884d80aac5

SHA512
72188f348d9ae33e2b5a7886c80667cc3015bfac170249537baa9e31abf8d63ca198903206feb64887f1d509a1b9bfc9f54ede8b3aa26bee3f5c4375e5c6a24b

Download Submit
C:\MobileEmuMaster\7z.dll

Filesize
1.1MB

MD5
a46135bdd574092d85955070e72d5aad

SHA1
aad137b0a883fea22b7118778512ffc7865513bc

SHA256
aa57160684feb240a85da677caaf7cf6a08b7349d89ae9cb4a3476884d80aac5

SHA512
72188f348d9ae33e2b5a7886c80667cc3015bfac170249537baa9e31abf8d63ca198903206feb64887f1d509a1b9bfc9f54ede8b3aa26bee3f5c4375e5c6a24b

Download Submit
C:\MobileEmuMaster\ComputerZ.set

Filesize
80B

MD5
48643fee8751437b33f19183af20a686

SHA1
ac0abd91a7fa2c2227af397a1234ae4e7b27b3c5

SHA256
d51ffe725bc6b909fb55eb641768b1f2b8053a03b50479fc292ff8ba61d5045c

SHA512
cd2bac119ffd97bd375238c9032ec21564f2522032cdcf66824c605a6cd1bbbcbd1e5a3f5543cb761ff06a2426ee61dddb08f39933b588ee8f2e52096734321a

Download Submit
C:\MobileEmuMaster\ComputerZ.set

Filesize
80B

MD5
48643fee8751437b33f19183af20a686

SHA1
ac0abd91a7fa2c2227af397a1234ae4e7b27b3c5

SHA256
d51ffe725bc6b909fb55eb641768b1f2b8053a03b50479fc292ff8ba61d5045c

SHA512
cd2bac119ffd97bd375238c9032ec21564f2522032cdcf66824c605a6cd1bbbcbd1e5a3f5543cb761ff06a2426ee61dddb08f39933b588ee8f2e52096734321a

Download Submit
C:\MobileEmuMaster\ComputerZ.set

Filesize
80B

MD5
48643fee8751437b33f19183af20a686

SHA1
ac0abd91a7fa2c2227af397a1234ae4e7b27b3c5

SHA256
d51ffe725bc6b909fb55eb641768b1f2b8053a03b50479fc292ff8ba61d5045c

SHA512
cd2bac119ffd97bd375238c9032ec21564f2522032cdcf66824c605a6cd1bbbcbd1e5a3f5543cb761ff06a2426ee61dddb08f39933b588ee8f2e52096734321a

Download Submit
C:\MobileEmuMaster\GameMemoryOpt_x64.dll

Filesize
848KB

MD5
adfc0da3fe579df12c43f2ac66eb0b7d

SHA1
9bf5f696b5dc39fa491b59c899bcdaac30844ff3

SHA256
3bb054b6b71f629d9952c635eb9d7efac4765ff2f28eb8503ae8ba69edc132c2

SHA512
8724efd9e8f0a3c4c939cb85093e5d109690c26c85c80c9ff4e1e167f16600e6c380a968a22f7525a75b88a71f22b661ca61ec62eaec2470f965d891cede438c

Download Submit
C:\MobileEmuMaster\GameMemoryOpt_x64.dll

Filesize
848KB

MD5
adfc0da3fe579df12c43f2ac66eb0b7d

SHA1
9bf5f696b5dc39fa491b59c899bcdaac30844ff3

SHA256
3bb054b6b71f629d9952c635eb9d7efac4765ff2f28eb8503ae8ba69edc132c2

SHA512
8724efd9e8f0a3c4c939cb85093e5d109690c26c85c80c9ff4e1e167f16600e6c380a968a22f7525a75b88a71f22b661ca61ec62eaec2470f965d891cede438c

Download Submit
C:\MobileEmuMaster\GameMemoryOpt_x64.dll

Filesize
848KB

MD5
adfc0da3fe579df12c43f2ac66eb0b7d

SHA1
9bf5f696b5dc39fa491b59c899bcdaac30844ff3

SHA256
3bb054b6b71f629d9952c635eb9d7efac4765ff2f28eb8503ae8ba69edc132c2

SHA512
8724efd9e8f0a3c4c939cb85093e5d109690c26c85c80c9ff4e1e167f16600e6c380a968a22f7525a75b88a71f22b661ca61ec62eaec2470f965d891cede438c

Download Submit
C:\MobileEmuMaster\GameMemoryOpt_x64.dll

Filesize
848KB

MD5
adfc0da3fe579df12c43f2ac66eb0b7d

SHA1
9bf5f696b5dc39fa491b59c899bcdaac30844ff3

SHA256
3bb054b6b71f629d9952c635eb9d7efac4765ff2f28eb8503ae8ba69edc132c2

SHA512
8724efd9e8f0a3c4c939cb85093e5d109690c26c85c80c9ff4e1e167f16600e6c380a968a22f7525a75b88a71f22b661ca61ec62eaec2470f965d891cede438c

Download Submit
C:\MobileEmuMaster\LDSGameHall\LDSGameHall.exe

Filesize
6.2MB

MD5
b63f3cb5cb9533edb75b8c2976870c0d

SHA1
23831b1f837fb51083e00331f5fe8b34c24039df

SHA256
1514fc041f55d0a595dc9b607c1b6b6e9daa4a6af85e9e2e6e0a18ea708498a7

SHA512
18a15ac2730c74d1872ee76d027843af04979d99604680f6f50ce320c4039520d40942a6cdea63d37246df294b63ce51a0874381a2458e041c5192dd095e27c5

Download Submit
C:\MobileEmuMaster\LDSGameHall\LDSGameHall.exe

Filesize
6.2MB

MD5
b63f3cb5cb9533edb75b8c2976870c0d

SHA1
23831b1f837fb51083e00331f5fe8b34c24039df

SHA256
1514fc041f55d0a595dc9b607c1b6b6e9daa4a6af85e9e2e6e0a18ea708498a7

SHA512
18a15ac2730c74d1872ee76d027843af04979d99604680f6f50ce320c4039520d40942a6cdea63d37246df294b63ce51a0874381a2458e041c5192dd095e27c5

Download Submit
C:\MobileEmuMaster\LDSGamePlayerPK\LudashiEmulator.dll

Filesize
561KB

MD5
6926afa7a9d784a482293330b115d72f

SHA1
be993aef2e0e10e17c76cb0881765425168a8275

SHA256
1f697286be87b72ffaa68310400197d26a7ceedc13a4c65cef153a98123853ae

SHA512
e4786a1a21e1222c86cb55769c511a9b79c05f5bd4c7459386a84691d7f50575109b9fd72b4dba8d5f16a97078abefa0a7d674f12e35e69d67428ab5a78ac06b

Download Submit
C:\MobileEmuMaster\LDSGamePlayerPK\LudashiEmulator.dll

Filesize
561KB

MD5
6926afa7a9d784a482293330b115d72f

SHA1
be993aef2e0e10e17c76cb0881765425168a8275

SHA256
1f697286be87b72ffaa68310400197d26a7ceedc13a4c65cef153a98123853ae

SHA512
e4786a1a21e1222c86cb55769c511a9b79c05f5bd4c7459386a84691d7f50575109b9fd72b4dba8d5f16a97078abefa0a7d674f12e35e69d67428ab5a78ac06b

Download Submit
C:\MobileEmuMaster\LDSGameVer.dll

Filesize
9KB

MD5
985ca3b7263f73be66446a27a166f654

SHA1
14dff97b67ddf5327ebd006d0cbd0ac6333c32de

SHA256
acf0457cf07a5d103f76e843c0ef12086a39c69806caf75860407a371b24f9ad

SHA512
08f513e52dd0a333b89950a7298d860e14d9792dd805b1276455150af64b73a9065f7ab6ecfa98b48a1c34a444a9b99f53c0f69fa9419d90808b6b647c533c51

Download Submit
C:\MobileEmuMaster\NetBridge.dll

Filesize
238KB

MD5
8786d469338c30e0ba9fedfc62bd5197

SHA1
5fb12028ceae9772f938e1b98b699f0e02e32718

SHA256
beeaf8b72f7008e9adabacfcd85e32a50747a0dfb5c86802aeb973bd1f5c3d2f

SHA512
5db1e5b78e62cda81a63e8e712e720f87a7c7a539237a55a9098c076f9fb4e0b5adb83383c23657b4ccc90c117e55e3946a399cdf3d15cb94444b203d9d6c45c

Download Submit
C:\MobileEmuMaster\Plugin\ShellExt_x64.dll

Filesize
393KB

MD5
0d83f9c3fd4686065c2b043cafc6cbef

SHA1
21d1d93bd079269d5b80685caac952d097fead21

SHA256
653aba53aa7825b89065daccf985fce3e7386d5891f1ace71e79f2cd326c4ed8

SHA512
271cfecb7badd32b968d2d3535edca6ab08ce37e863371c079d34f8f5c0cea2f3b668ae42aa10343ca3878ce402481c20427c002261a0d0d21da56b51c978c17

Download Submit
C:\MobileEmuMaster\Plugin\ShellExt_x64.dll

Filesize
393KB

MD5
0d83f9c3fd4686065c2b043cafc6cbef

SHA1
21d1d93bd079269d5b80685caac952d097fead21

SHA256
653aba53aa7825b89065daccf985fce3e7386d5891f1ace71e79f2cd326c4ed8

SHA512
271cfecb7badd32b968d2d3535edca6ab08ce37e863371c079d34f8f5c0cea2f3b668ae42aa10343ca3878ce402481c20427c002261a0d0d21da56b51c978c17

Download Submit
C:\MobileEmuMaster\Plugin\ShellExt_x64.dll

Filesize
393KB

MD5
0d83f9c3fd4686065c2b043cafc6cbef

SHA1
21d1d93bd079269d5b80685caac952d097fead21

SHA256
653aba53aa7825b89065daccf985fce3e7386d5891f1ace71e79f2cd326c4ed8

SHA512
271cfecb7badd32b968d2d3535edca6ab08ce37e863371c079d34f8f5c0cea2f3b668ae42aa10343ca3878ce402481c20427c002261a0d0d21da56b51c978c17

Download Submit
C:\MobileEmuMaster\Plugin\ShellExt_x86.dll

Filesize
352KB

MD5
744cf96dbd2755c2d35ffb9585bf905a

SHA1
3acd2db4152d44e26341884786cfc44e00237ccb

SHA256
3a643bff2038e2b841f21264f152cab26f352d47f979f311853b975930250803

SHA512
c24aed66990d9ba63d51354374d6ed91787e7173e9ff25d548fcbeacd8918f3a606aac35c398f84f274e4aa338d49a2659a121fb7e269f0f17cb3f1c3581b3df

Download Submit
C:\MobileEmuMaster\Plugin\ShellExt_x86.dll

Filesize
352KB

MD5
744cf96dbd2755c2d35ffb9585bf905a

SHA1
3acd2db4152d44e26341884786cfc44e00237ccb

SHA256
3a643bff2038e2b841f21264f152cab26f352d47f979f311853b975930250803

SHA512
c24aed66990d9ba63d51354374d6ed91787e7173e9ff25d548fcbeacd8918f3a606aac35c398f84f274e4aa338d49a2659a121fb7e269f0f17cb3f1c3581b3df

Download Submit
C:\MobileEmuMaster\Utils\ArCtrl.dll

Filesize
447KB

MD5
68ab43ec86d02a6ea3a82f8abcb3144b

SHA1
48f3dbee1d445bae77d713124dd573d9481cf68a

SHA256
92f31d38813bca69cfe1b83205cc1e87a8131cf293a41200f66b01b28d269ee1

SHA512
bdf5deab1b2987deba6f137e4b28d9bd1e2525bd297011ef23dfbf96290695fecf6881d04a6e4eb736100e5c30c555615844d878279a728f4b7dc18aa8f29b4a

Download Submit
C:\MobileEmuMaster\Utils\ArCtrl.dll

Filesize
447KB

MD5
68ab43ec86d02a6ea3a82f8abcb3144b

SHA1
48f3dbee1d445bae77d713124dd573d9481cf68a

SHA256
92f31d38813bca69cfe1b83205cc1e87a8131cf293a41200f66b01b28d269ee1

SHA512
bdf5deab1b2987deba6f137e4b28d9bd1e2525bd297011ef23dfbf96290695fecf6881d04a6e4eb736100e5c30c555615844d878279a728f4b7dc18aa8f29b4a

Download Submit
C:\MobileEmuMaster\Utils\ArCtrl.dll

Filesize
447KB

MD5
68ab43ec86d02a6ea3a82f8abcb3144b

SHA1
48f3dbee1d445bae77d713124dd573d9481cf68a

SHA256
92f31d38813bca69cfe1b83205cc1e87a8131cf293a41200f66b01b28d269ee1

SHA512
bdf5deab1b2987deba6f137e4b28d9bd1e2525bd297011ef23dfbf96290695fecf6881d04a6e4eb736100e5c30c555615844d878279a728f4b7dc18aa8f29b4a

Download Submit
C:\MobileEmuMaster\Utils\CefHelper.dll

Filesize
315KB

MD5
64f0649773f42780ff046387839ace1a

SHA1
9ae24c6c768b8ada9668e2425ee313dc9fbbce92

SHA256
3d6dba53530134f65513b005e55d7893099693f28be84eb12d14616689d3a453

SHA512
0d8c4e7fba3969f11dabd26c7ea32e5021889141dc3f5725362b4c8a260faf16becded7491224dc0ae11214ed63a36c736cf2535cfcbe448944372e00178ee18

Download Submit
C:\MobileEmuMaster\Utils\CheckHp.dll

Filesize
428KB

MD5
f0a993d2968a944f41ea28e20bbfd78d

SHA1
ffcf5c4a79d1f5f290ab3e72d5082fc462b46e38

SHA256
01847fb5a6823dbc6e332477e3132e82897c503a5e0908baf035ed189c8bba29

SHA512
48b4248674c92f5494f9d1a4a71919b5b1894d03767e73e8f4dc00e5f996f9b2b3a31349d7ac085509a0a56ac3205bd2aae933945ffd360a7f05bc76c6e893c6

Download Submit
C:\MobileEmuMaster\Utils\CheckHp.dll

Filesize
428KB

MD5
f0a993d2968a944f41ea28e20bbfd78d

SHA1
ffcf5c4a79d1f5f290ab3e72d5082fc462b46e38

SHA256
01847fb5a6823dbc6e332477e3132e82897c503a5e0908baf035ed189c8bba29

SHA512
48b4248674c92f5494f9d1a4a71919b5b1894d03767e73e8f4dc00e5f996f9b2b3a31349d7ac085509a0a56ac3205bd2aae933945ffd360a7f05bc76c6e893c6

Download Submit
C:\MobileEmuMaster\Utils\ComputerZ12.dll

Filesize
670KB

MD5
e9729af55f9ef5ae35e2abb46e943180

SHA1
4ae5dc8b8680de5a60787119d25c3f8c81baf981

SHA256
28535efe0e4524ea4ad3a554725346a00b02be3e56a0ae3cd354893190c7b61e

SHA512
0aca33040f71019c7debebd043f26d54ee5baf314a5c5680c20d71dc90855878a7082354b0d91c3b435cc45eb3890693c3ce674cd0542c5f215139be62dd1df9

Download Submit
C:\MobileEmuMaster\Utils\ComputerZ12_x64.dll

Filesize
862KB

MD5
60b437fbddcf701bc4e5a0c842d735d0

SHA1
be144d850bebecb12025a97712acf75fac1aba85

SHA256
e76bb1bf8285b577444c0f159b04facd2417ee0d24c480b4561d4bb5d906d590

SHA512
293b48f088a12055d107f88dce91090326d1eedbfc1600c050836c524264193a409b80dc5faa99e1f8679a4f48b91647608a06745e7cd1d1b36ab1f0c886d22e

Download Submit
C:\MobileEmuMaster\Utils\ComputerZ12_x64.dll

Filesize
862KB

MD5
60b437fbddcf701bc4e5a0c842d735d0

SHA1
be144d850bebecb12025a97712acf75fac1aba85

SHA256
e76bb1bf8285b577444c0f159b04facd2417ee0d24c480b4561d4bb5d906d590

SHA512
293b48f088a12055d107f88dce91090326d1eedbfc1600c050836c524264193a409b80dc5faa99e1f8679a4f48b91647608a06745e7cd1d1b36ab1f0c886d22e

Download Submit
C:\MobileEmuMaster\Utils\GMSettings.dll

Filesize
1.4MB

MD5
8616b89250743647d25e99d88c81e8d1

SHA1
6829e908d548c417cd6ff99e826150880510b69a

SHA256
d08ffb7728079598e330fb67eaed411524e392db917fad5aaa7a8d11c8cd39aa

SHA512
0e8a6d55f71315db59cf237636a6a24de83900e60a60c3aa8f17797f6d09deec75bc0dd87ec25e58a6fd3f49a0553b05240dcdca3c8fa7694e83518fd99adcfb

Download Submit
C:\MobileEmuMaster\Utils\InstExt.dll

Filesize
474KB

MD5
31c6e7f6b8d06eb83bedab3cf2b43850

SHA1
d3add1b9879b42d32f1fa71129ea3889ce3b0089

SHA256
3055b6129d237d32b45e18158cb0b175e586090828724fb51ea6e0ba3f9b7b37

SHA512
1585b6063b2c202030cf67de0d47d66d287ae733371eec4f3c9a2a6492d0c38992e2ead8cc97afe8b888c03adcebe8bc904e8978ce13099597e43106f0372429

Download Submit
C:\MobileEmuMaster\Utils\InstExt.dll

Filesize
474KB

MD5
31c6e7f6b8d06eb83bedab3cf2b43850

SHA1
d3add1b9879b42d32f1fa71129ea3889ce3b0089

SHA256
3055b6129d237d32b45e18158cb0b175e586090828724fb51ea6e0ba3f9b7b37

SHA512
1585b6063b2c202030cf67de0d47d66d287ae733371eec4f3c9a2a6492d0c38992e2ead8cc97afe8b888c03adcebe8bc904e8978ce13099597e43106f0372429

Download Submit
C:\MobileEmuMaster\Utils\InstExt.dll

Filesize
474KB

MD5
31c6e7f6b8d06eb83bedab3cf2b43850

SHA1
d3add1b9879b42d32f1fa71129ea3889ce3b0089

SHA256
3055b6129d237d32b45e18158cb0b175e586090828724fb51ea6e0ba3f9b7b37

SHA512
1585b6063b2c202030cf67de0d47d66d287ae733371eec4f3c9a2a6492d0c38992e2ead8cc97afe8b888c03adcebe8bc904e8978ce13099597e43106f0372429

Download Submit
C:\MobileEmuMaster\Utils\LDSBasic.dll

Filesize
2.1MB

MD5
c35ab236702291f1a2d090af8ea253d9

SHA1
d7f58f0f5fee6b26564af3c5d7ab6defe5a4608d

SHA256
c4dba892a9a1fb675d06dd615c4fc079e9f4e12a8368e8bd18e37137ed567f35

SHA512
87a3fa1927ad2fad117055411a471be95275a4d4bf99ee3ab522faee70067b239bb77ddd94c4300958607efd4a3fc071df2262754557fca2530e70f2c438a068

Download Submit
C:\MobileEmuMaster\Utils\LdsVolumeCtrl.dll

Filesize
110KB

MD5
5c6a3ba2d7f3df29664130df5295d4aa

SHA1
b54567e68fa036feae52513d672daffe188c793b

SHA256
0bbbcbb1bfd65dbb2fc3c671220bff391992eb381c13a4a7dd36fa2bc8e3e902

SHA512
2203fa85012cf535521f07ea2008766ce15e728d61d8a4ab20507c955229fd73c32f742c9c8f7ee9dce67ef2636ed61b9ef80b72d78a3564055a09059e448a16

Download Submit
C:\MobileEmuMaster\Utils\LoginWnd.dll

Filesize
1.1MB

MD5
e7cece8b5d934114d7cd4a19859fce0b

SHA1
d15bdf1f7b7047ea759771fb9161758c191210b3

SHA256
ba83ffb94206ebbedb8cf9d94319e4d0c11861d9e51fce17453bbc6613d97766

SHA512
46b007b6bb66399e9e750d4795e94704cdf04f341af0761b3cf14dc3ca5a8704eaf5bd85675bd4fec7b8370a16c680649c015cc76839eade7001e288d3df0c52

Download Submit
C:\MobileEmuMaster\Utils\MNQAppMon.dll

Filesize
1.0MB

MD5
316e61ec909b3ff9186046716470f64b

SHA1
aee8cf463d92c9ff38fc0a59b0e96ac60dbd01a9

SHA256
f60f0f47651f0203820f753340f0abebabf4c1b42a22f017b740f87513172bde

SHA512
51785025415f8e5b6fd726209c8c41bf9f246ba9573d55a9363af16d630f698452c3fc26c208f7e7ea26cfff6fc51d3b0a25cbfba697012834f52f61aa952d35

Download Submit
C:\MobileEmuMaster\Utils\MobileEmuHelper.exe

Filesize
878KB

MD5
bb586a127fe99513c5a540cc68ecab4b

SHA1
1f4213f961cd623c9737c3b3e5c1a9afe06982dd

SHA256
bf4c007063dec7f125f28271c151d3d6dec82a1469bf48f7705f51231bf1b1c7

SHA512
ee23d248b7336731e1341b00159961355bc73aae9f6424e37291d66a30d126b7ecbdc5b54f666dec555618aec087cbcf12dd57c9d24b6ab189db5a331852f4ca

Download Submit
C:\MobileEmuMaster\Utils\MobileEmuHelper.exe

Filesize
878KB

MD5
bb586a127fe99513c5a540cc68ecab4b

SHA1
1f4213f961cd623c9737c3b3e5c1a9afe06982dd

SHA256
bf4c007063dec7f125f28271c151d3d6dec82a1469bf48f7705f51231bf1b1c7

SHA512
ee23d248b7336731e1341b00159961355bc73aae9f6424e37291d66a30d126b7ecbdc5b54f666dec555618aec087cbcf12dd57c9d24b6ab189db5a331852f4ca

Download Submit
C:\MobileEmuMaster\Utils\Pop.dll

Filesize
826KB

MD5
34495d47d62fa20162e33c51ff124bf3

SHA1
ccaff0a24fa0f1fec195112369490ffaf675a475

SHA256
57c6e3c264bdf548e00a9f108fb0acde3e705c9db9dec3a81686cf2d118cb539

SHA512
f121b51688d29443fdf512b7630f72fba90b23556a92a4f5fc3ff603722ace6874fd1f545335c94edb9a3e0408cee913d0f11f5473b5b8592c6ac41d6a797a56

Download Submit
C:\MobileEmuMaster\Utils\PopEx.dll

Filesize
461KB

MD5
8b1f289eacf5645dfb905b32b66e7999

SHA1
97a34f0ad5f8a096f18e27a7e0577e0964bb5e6b

SHA256
d5a6c04af66430ed1da3fb65b7e2d4469c4a28d063826579e8ca40516121d2b1

SHA512
2d6ab422453dcbbb4fa60f0da9ae62c99684564459d3ad4590349e44d927961d56f68dcb014971c98ece38380a530d0825824afbd666df0f9fc381e26f4ba97f

Download Submit
C:\MobileEmuMaster\Utils\ProductInfo.dat

Filesize
90KB

MD5
4c2e57c47493428094576f2e1ab2333f

SHA1
0a0253d20746c6d21a7ec4907abfcfdb63dc389a

SHA256
2df2a08c227dfdfd6a51083ce3d6183600b86ce3972173cd86adecc92f5afd0c

SHA512
180eb372e40930f7e2f06eb2f024fedf828b282a08e76e01f22ce48fac575c3f72398b487cdef8050f325ec99def5306f860c92bbfb3a1437e8851cbfa7d3f52

Download Submit
C:\MobileEmuMaster\Utils\SpSvc.dll

Filesize
543KB

MD5
fe9719ed7ed5f3038e682a9e8349507f

SHA1
d27d0f323483fab288a81757fedfb05de8ac3cf4

SHA256
3f014ddca4a013c48302e92de2273787989d08015cfae6ffbbb68dffba4e0ec8

SHA512
b38f4ac3b5418fb83d77fe7333ea6d4ca47c57aeca5b5bc696b4cc04d49bfd6f9e947e3cfe4df33af7cb33cab9557556c3c3ed87d7dc6826c0b671f507c043ad

Download Submit
C:\MobileEmuMaster\Utils\SpSvc.dll

Filesize
543KB

MD5
fe9719ed7ed5f3038e682a9e8349507f

SHA1
d27d0f323483fab288a81757fedfb05de8ac3cf4

SHA256
3f014ddca4a013c48302e92de2273787989d08015cfae6ffbbb68dffba4e0ec8

SHA512
b38f4ac3b5418fb83d77fe7333ea6d4ca47c57aeca5b5bc696b4cc04d49bfd6f9e947e3cfe4df33af7cb33cab9557556c3c3ed87d7dc6826c0b671f507c043ad

Download Submit
C:\MobileEmuMaster\Utils\SpSvc.dll

Filesize
543KB

MD5
fe9719ed7ed5f3038e682a9e8349507f

SHA1
d27d0f323483fab288a81757fedfb05de8ac3cf4

SHA256
3f014ddca4a013c48302e92de2273787989d08015cfae6ffbbb68dffba4e0ec8

SHA512
b38f4ac3b5418fb83d77fe7333ea6d4ca47c57aeca5b5bc696b4cc04d49bfd6f9e947e3cfe4df33af7cb33cab9557556c3c3ed87d7dc6826c0b671f507c043ad

Download Submit
C:\MobileEmuMaster\Utils\UserCenter.dll

Filesize
267KB

MD5
b67b6dbe72d7aa2c820195424acdf099

SHA1
dbba69652926444aa6e012148a88d5f76d052cef

SHA256
8b976dfe5fe6561285d908c9b562227074eae2553da3c1d0bf413e5e9eef04e2

SHA512
11b7808eb45247cd562e6a1082549736759b84c8c3507579a0459ede58bb0ba24e16bb9b6c4cf37816a4781d482a5e5d05868132274948a0d54b51de122592a2

Download Submit
C:\MobileEmuMaster\Utils\WebView.dll

Filesize
1.3MB

MD5
3a6df12e5a6fdc46d22222df9d70431a

SHA1
0b4c234cbdd9f17e2152a81aae568ffeaaa19646

SHA256
4d310d4fd453ca5538ca72f2898126fea7a25ea00a33285536eb9e0a439620bd

SHA512
18532ca0a98cee7d1398e3a1952e80b2b02e9e6fcba35697c9e1f953241fd9799cf79515645cd937c7d03d36c8c329ab2dca9efd5fb24cbd5abbbb2bb876aed0

Download Submit
C:\MobileEmuMaster\Utils\WndPlugin.dll

Filesize
1.3MB

MD5
fa7ce04df823adec443d0838dc83c1d1

SHA1
922d33dfbbe91ca53b8c0745340ad82dd30fd1a1

SHA256
e48e55166cd00994cf8e5cd1be3d0941a93770d6c219d9673ed678b57ab5da92

SHA512
d19995647f14b2bb961a6084100d1c887eefc2849c8b44f4a408defb8d0b89e479324e12396853672f7e3face80dd51b8c23f2e48d9c2ede838e947c50427a7a

Download Submit
C:\MobileEmuMaster\Utils\down7z.dll

Filesize
971KB

MD5
072c1a273948a92893ed7fc68eb7827b

SHA1
7c20216ca5f105d15dd5a104f8d8a8252a2cc02f

SHA256
fe39c6f5462f0cb8b6ce6c56d16b694cfafef977566e835a8625f413dacf74ff

SHA512
58ceddf7ff04bb1dea33e862f8d5d0f4c0b0f11ac10eade4de5f4c93afbdae840e654dba4b0edf67fe95268df777941e6ba9aa8a6d14ccabb0d83307db7833aa

Download Submit
C:\MobileEmuMaster\Utils\netul.dll

Filesize
1.9MB

MD5
d8b0dd8a7b046b8a0584a48d03658214

SHA1
8b04bd4568dc38be26eb94c8eadea830db87b0c5

SHA256
3c4b4b34a093c6e261e7189b02691627b4bfc4a479fdf09b8c4814f1f49af550

SHA512
82cde319f934f76ce46a31b44fa94db8810d6a203c5d08c9a791011ceb783d7c10ec1b1a7bee89822a748edc92551fb41fcb1d7a1f513932552bd4184822075e

Download Submit
C:\MobileEmuMaster\Utils\netul64.dll

Filesize
2.3MB

MD5
ce75bd2c1e3770f3cd1d2089e3ac2b42

SHA1
c275522fa544fed25778ca25f92bcdf4f39a4259

SHA256
3d4adf447f8a82b179992c21978337fcadc47db9e5253adb8a3504c8d6582036

SHA512
26f30277bc94c0ece4bd76e24cc056606ab783fbd464f06c21e0ce5b8fb2c04d7b60dc29b4e72d0406b06eedc546aad648cdbaa9c377850a2cd4dc5d7e1ed218

Download Submit
C:\MobileEmuMaster\Utils\pgstation.dll

Filesize
14.0MB

MD5
dea322691d9d605ee6d544b287612b48

SHA1
704365c51ba313c57c4f565e031b881fe22282de

SHA256
9a186a67554e59e8ace3fc58a3d3b05ef91f0f83dacff48a349260cf001a7213

SHA512
2a607fbb43a1c9b44fcfd5731ee111ff0dffb14fdfe03629cd981ba262f344feed0f61561c20180133ac8f22a2c54fc63b5c449146241c5804eee3d52c3254aa

Download Submit
C:\MobileEmuMaster\Utils\product_helper.dll

Filesize
728KB

MD5
5e6fa10455a33ecffbd2a9487c91424b

SHA1
8424351101fed9b290ab52fe9b8af896cb4885d5

SHA256
7ca0c97a500d82494070865ca478b2e99a8bd3c02a4e27b101d1f2ca61229de7

SHA512
1d5a15fafc3ee273c8d04ab2f39fc6b389f1445a1e356c87616b0ed9a8bd2f55449816155694a92333876dfbb48074617a747087aec3fbf85ac166aa37cff48e

Download Submit
C:\MobileEmuMaster\Utils\product_helper.dll

Filesize
728KB

MD5
5e6fa10455a33ecffbd2a9487c91424b

SHA1
8424351101fed9b290ab52fe9b8af896cb4885d5

SHA256
7ca0c97a500d82494070865ca478b2e99a8bd3c02a4e27b101d1f2ca61229de7

SHA512
1d5a15fafc3ee273c8d04ab2f39fc6b389f1445a1e356c87616b0ed9a8bd2f55449816155694a92333876dfbb48074617a747087aec3fbf85ac166aa37cff48e

Download Submit
C:\MobileEmuMaster\Utils\product_helper_x64.dll

Filesize
839KB

MD5
551e02af61cd1324f18ad0951f87eba7

SHA1
8a33d2332f345bb29b7409b7173f590473cc1f2a

SHA256
affe4376e85fb36d30c31ee3cecb5dbd82e97d87d1fd04aff2b35789055189f3

SHA512
e686f1883ebc1ea02a086e916ea315b4404c931e7b854bb31cf38d87a3ad51f840bd6ea0d0fed4489d33e6e9396f345285a76f3f235f94ad2bb3b1ef115e7268

Download Submit
C:\MobileEmuMaster\gamemaster_setup.log

Filesize
2KB

MD5
03844f6bb6cd87127ea3e724e1229dc4

SHA1
6680987d2f7e3719e4537d9031481fc31b3808ee

SHA256
47ec3f63be75d49be50a045e7454fed1b2d5560d899907b60a28bca32680a0fa

SHA512
5ae41eb96e7a9322b52fbf3972bed2ba79480a26d749f7a283fce22dc5cdd63ee1f666c72cef25cb257165940b3f9bfd9dff60a4caf779027fed462c663a0ca4

Download Submit
C:\MobileEmuMaster\gamemaster_setup.log

Filesize
4KB

MD5
2c891b2c469afaa0c242a9b17156e003

SHA1
d1180d4889486a47b826061e6f9d2b982ad1f6a2

SHA256
7917a658b864738fe49c474a68e0d57e9baf41b8c8c74ef47ff0b7001fcf4ad9

SHA512
f762c916b9d7ea42fc45301f93a6a25783eeb29123bc537cf0170566de2b45bf505eae0d8c55793bcafe281b49d8481fc1397dd9dea661650515d908b9b0b139

Download Submit
C:\Users\Admin\AppData\Local\LDSGameMaster\Store\360Base\360NetUL.dll

Filesize
234KB

MD5
cd03029957ebc78c0ca7a6c02a9ca846

SHA1
0044114b8073781479044f0294701be9611be2ac

SHA256
139fdd92e6ddf1aac0761a68502b374daa32e82039621018511dc491ed9b4048

SHA512
14c641cb9536def0ddc1969d50b97b83a23017c97373e3ad74d3fbf9825ac81f3fdf8169281c8ad4cebd45d9c9ae05f752d553ba4653e620889b274479cb7c32

Download Submit
C:\Users\Admin\AppData\Local\LDSGameMaster\Store\360Base\360NetUL.dll

Filesize
234KB

MD5
cd03029957ebc78c0ca7a6c02a9ca846

SHA1
0044114b8073781479044f0294701be9611be2ac

SHA256
139fdd92e6ddf1aac0761a68502b374daa32e82039621018511dc491ed9b4048

SHA512
14c641cb9536def0ddc1969d50b97b83a23017c97373e3ad74d3fbf9825ac81f3fdf8169281c8ad4cebd45d9c9ae05f752d553ba4653e620889b274479cb7c32

Download Submit
C:\Users\Admin\AppData\Local\LDSGameMaster\Store\360Base\Utils\LDSBasic.dll

Filesize
2.1MB

MD5
c35ab236702291f1a2d090af8ea253d9

SHA1
d7f58f0f5fee6b26564af3c5d7ab6defe5a4608d

SHA256
c4dba892a9a1fb675d06dd615c4fc079e9f4e12a8368e8bd18e37137ed567f35

SHA512
87a3fa1927ad2fad117055411a471be95275a4d4bf99ee3ab522faee70067b239bb77ddd94c4300958607efd4a3fc071df2262754557fca2530e70f2c438a068

Download Submit
C:\Users\Admin\AppData\Local\LDSGameMaster\Store\360Base\Utils\LDSBasic.dll

Filesize
2.1MB

MD5
c35ab236702291f1a2d090af8ea253d9

SHA1
d7f58f0f5fee6b26564af3c5d7ab6defe5a4608d

SHA256
c4dba892a9a1fb675d06dd615c4fc079e9f4e12a8368e8bd18e37137ed567f35

SHA512
87a3fa1927ad2fad117055411a471be95275a4d4bf99ee3ab522faee70067b239bb77ddd94c4300958607efd4a3fc071df2262754557fca2530e70f2c438a068

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\NDE3BND5\mgame[1].txt

Filesize
2B

MD5
444bcb3a3fcf8389296c49467f27e1d6

SHA1
7a85f4764bbd6daf1c3545efbbf0f279a6dc0beb

SHA256
2689367b205c16ce32ed4200942b8b8b1e262dfc70d9bc9fbc77c49699a4f1df

SHA512
9fbbbb5a0f329f9782e2356fa41d89cf9b3694327c1a934d6af2a9df2d7f936ce83717fb513196a4ce5548471708cd7134c2ae99b3c357bcabb2eafc7b9b7570

Download Submit
C:\Users\Admin\AppData\Local\Temp\refineinst.dll

Filesize
37.1MB

MD5
bd2d6fe455dee9667df185000d2dd979

SHA1
a6658afc14b4f92323c5731ab0b003058e82cd25

SHA256
2eb9d3a4d3431076508feaf9f08f79d27e33d0137bcd99828bd34e5434aca2c5

SHA512
315e794afc3727cbe9d6b3d1e16607b52ed95b9bc8b916e1c86bc71febced046cc0014a7c2db7ce2f622fc102d2717f8e2a3eccbd142d2b71d4b81123110de5b

Download Submit
C:\Users\Admin\AppData\Local\Temp\refineinst.dll

Filesize
37.1MB

MD5
bd2d6fe455dee9667df185000d2dd979

SHA1
a6658afc14b4f92323c5731ab0b003058e82cd25

SHA256
2eb9d3a4d3431076508feaf9f08f79d27e33d0137bcd99828bd34e5434aca2c5

SHA512
315e794afc3727cbe9d6b3d1e16607b52ed95b9bc8b916e1c86bc71febced046cc0014a7c2db7ce2f622fc102d2717f8e2a3eccbd142d2b71d4b81123110de5b

Download Submit
C:\Users\Admin\AppData\Local\Temp\{64F64C75-A318-4ead-A115-6BC96F441271}.tmp\7z.dll

Filesize
1.1MB

MD5
a46135bdd574092d85955070e72d5aad

SHA1
aad137b0a883fea22b7118778512ffc7865513bc

SHA256
aa57160684feb240a85da677caaf7cf6a08b7349d89ae9cb4a3476884d80aac5

SHA512
72188f348d9ae33e2b5a7886c80667cc3015bfac170249537baa9e31abf8d63ca198903206feb64887f1d509a1b9bfc9f54ede8b3aa26bee3f5c4375e5c6a24b

Download Submit
C:\Users\Admin\AppData\Roaming\lds\lds.set

Filesize
26B

MD5
f93d1c2ef385a0cad0830fda2ab87dd2

SHA1
1afdfe25d71eec28fe54ddcd42f46c13393026c4

SHA256
0b944d0a65bd12ae237276a9cadfe16aef60d60f702e7b363da9205a45d72438

SHA512
38966678bce539481e0915fc414f6e3cb8ccce8cfda17db58f0fc5db1bf3c0553efbbc77d564e7610c2176614e76f396b8987a5cf6ea0b19231b7af1b6f6aceb

Download Submit
C:\Windows\Logs\DISM\dism.log

Filesize
193KB

MD5
e48e09b58ecd39c4d43795b9fa8f83d5

SHA1
9f9555f50f6e7abe0e0a38dd846427806830b4c8

SHA256
6605ad5a497b7655ac2e76896cae5bef6e8b755034937bdf09fdaf64d64729fc

SHA512
fd448eaf7a1d104794fa5f355ae80222f58416568bde1e50b36c97118088877ff48f8ff6e4b99d07b50db34f488bcbcacc907e2d250ea0327ad99657af494de3

Download Submit
\??\c:\mobileemumaster\NetBridge.dll

Filesize
238KB

MD5
8786d469338c30e0ba9fedfc62bd5197

SHA1
5fb12028ceae9772f938e1b98b699f0e02e32718

SHA256
beeaf8b72f7008e9adabacfcd85e32a50747a0dfb5c86802aeb973bd1f5c3d2f

SHA512
5db1e5b78e62cda81a63e8e712e720f87a7c7a539237a55a9098c076f9fb4e0b5adb83383c23657b4ccc90c117e55e3946a399cdf3d15cb94444b203d9d6c45c

Download Submit
memory/1632-448-0x0000000077B02000-0x0000000077B03000-memory.dmp

Filesize
4KB

Download
memory/1632-447-0x0000000077C40000-0x0000000077C50000-memory.dmp

Filesize
64KB

Download
memory/1632-715-0x0000000077B02000-0x0000000077B03000-memory.dmp

Filesize
4KB

Download
memory/1632-449-0x0000000077C40000-0x0000000077C50000-memory.dmp

Filesize
64KB

Download
memory/2348-809-0x000000006E9E0000-0x000000006ED0D000-memory.dmp

Filesize
3.2MB

Download
memory/2348-812-0x000000006E9E0000-0x000000006ED0D000-memory.dmp

Filesize
3.2MB

Download
memory/3124-718-0x0000000005B60000-0x0000000005B61000-memory.dmp

Filesize
4KB

Download