Analysis
-
max time kernel
150s -
max time network
152s -
platform
windows10-1703_x64 -
resource
win10-20230220-en -
resource tags
arch:x64arch:x86image:win10-20230220-enlocale:en-usos:windows10-1703-x64system -
submitted
24-03-2023 15:52
Static task
static1
Behavioral task
behavioral1
Sample
a8d746ad75f60881430ff0fd0f8f51e8e013953113811a0ed4cd944fdbd09330.exe
Resource
win10-20230220-en
Behavioral task
behavioral2
Sample
a8d746ad75f60881430ff0fd0f8f51e8e013953113811a0ed4cd944fdbd09330.exe
Resource
win7-20230220-en
General
-
Target
a8d746ad75f60881430ff0fd0f8f51e8e013953113811a0ed4cd944fdbd09330.exe
-
Size
1.4MB
-
MD5
ad71842100670b6f880e326f2ab71c30
-
SHA1
f81bd8a7e66d5a76a36d44e37db0b28a8660a040
-
SHA256
a8d746ad75f60881430ff0fd0f8f51e8e013953113811a0ed4cd944fdbd09330
-
SHA512
48b0000bd1567dfbc7aadee7c1ad0ea81d475b9e69f176703a0bac3f3bcfaf2f2265c4adf6dc7015a1e6b5effab044b95405e5172c7aa1806e621a730bc58364
-
SSDEEP
24576:sbq0Msre2kKCzeUl9ReKie1DJ33wIynyTn1hdrKM3xyDSqqw5V+82Y+vRn7DkwSp:W7re2kKlUlqKieDHwIynyTdJ3OSSK82c
Malware Config
Signatures
-
Drops file in Drivers directory 1 IoCs
Processes:
CathayFXConfig.exedescription ioc process File opened for modification C:\Windows\system32\drivers\etc\hosts CathayFXConfig.exe -
Checks BIOS information in registry 2 TTPs 3 IoCs
BIOS information is often read in order to detect sandboxing environments.
Processes:
terminal64.execathayfutures5setup.exeterminal64.exedescription ioc process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion terminal64.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion cathayfutures5setup.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion terminal64.exe -
Checks computer location settings 2 TTPs 2 IoCs
Looks up country code configured in the registry, likely geofence.
Processes:
cathayfutures5setup.exeterminal64.exedescription ioc process Key value queried \REGISTRY\USER\S-1-5-21-3853465373-1718857667-1861325682-1000\Control Panel\International\Geo\Nation cathayfutures5setup.exe Key value queried \REGISTRY\USER\S-1-5-21-3853465373-1718857667-1861325682-1000\Control Panel\International\Geo\Nation terminal64.exe -
Executes dropped EXE 5 IoCs
Processes:
CathayFXConfig.execathayfutures5setup.exeterminal64.exeterminal64.exemetaeditor64.exepid process 4492 CathayFXConfig.exe 4248 cathayfutures5setup.exe 652 terminal64.exe 8 terminal64.exe 4680 metaeditor64.exe -
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Adds Run key to start application 2 TTPs 1 IoCs
Processes:
CathayFXConfig.exedescription ioc process Set value (str) \REGISTRY\USER\S-1-5-21-3853465373-1718857667-1861325682-1000\Software\Microsoft\Windows\CurrentVersion\Run\AppName = "\"C:\\Program Files (x86)\\CathayFutures_FX\\CathayFXConfig.exe\"" CathayFXConfig.exe -
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Processes:
terminal64.exeterminal64.exedescription ioc process Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA terminal64.exe Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA terminal64.exe -
Writes to the Master Boot Record (MBR) 1 TTPs 4 IoCs
Bootkits write to the MBR to gain persistence at a level below the operating system.
Processes:
cathayfutures5setup.exeterminal64.exeterminal64.exemetaeditor64.exedescription ioc process File opened for modification \??\PHYSICALDRIVE0 cathayfutures5setup.exe File opened for modification \??\PHYSICALDRIVE0 terminal64.exe File opened for modification \??\PHYSICALDRIVE0 terminal64.exe File opened for modification \??\PHYSICALDRIVE0 metaeditor64.exe -
Suspicious use of NtSetInformationThreadHideFromDebugger 6 IoCs
Processes:
terminal64.exeterminal64.exemetaeditor64.exepid process 652 terminal64.exe 652 terminal64.exe 8 terminal64.exe 8 terminal64.exe 4680 metaeditor64.exe 4680 metaeditor64.exe -
Drops file in Program Files directory 64 IoCs
Processes:
cathayfutures5setup.exeterminal64.exemetaeditor64.exedescription ioc process File created C:\Program Files\Cathay Futures\Bases\Default\Mail\3.market.german.welcome cathayfutures5setup.exe File created C:\Program Files\Cathay Futures\Bases\Default\Mail\5.freelance.thai.welcome cathayfutures5setup.exe File created C:\Program Files\Cathay Futures\MQL5\Profiles\Templates\ADX.tpl terminal64.exe File created C:\Program Files\Cathay Futures\MQL5\Indicators\Examples\OBV.mq5 terminal64.exe File created C:\Program Files\Cathay Futures\Bases\Default\Mail\1.welcome.italian.welcome cathayfutures5setup.exe File created C:\Program Files\Cathay Futures\Bases\Default\Mail\7.risk-warning.arabic.welcome cathayfutures5setup.exe File created C:\Program Files\Cathay Futures\Sounds\alert.wav cathayfutures5setup.exe File created C:\Program Files\Cathay Futures\MQL5\Include\Expert\Signal\SignalITF.mqh terminal64.exe File created C:\Program Files\Cathay Futures\MQL5\Include\Math\Fuzzy\sugenovariable.mqh terminal64.exe File created C:\Program Files\Cathay Futures\MQL5\Include\Math\Stat\NoncentralChiSquare.mqh terminal64.exe File created C:\Program Files\Cathay Futures\MQL5\Scripts\Examples\OrderInfo\OrderInfoSample.mq5 terminal64.exe File created C:\Program Files\Cathay Futures\MQL5\Scripts\UnitTests\Generic\TestStack.mq5 terminal64.exe File created C:\Program Files\Cathay Futures\Bases\Default\Mail\3.market.indonesian.welcome cathayfutures5setup.exe File created C:\Program Files\Cathay Futures\Bases\Default\Mail\3.market.spanish.welcome cathayfutures5setup.exe File created C:\Program Files\Cathay Futures\Bases\Default\Mail\3.market.thai.welcome cathayfutures5setup.exe File created C:\Program Files\Cathay Futures\Profiles\SymbolSets\forex.crosses.set cathayfutures5setup.exe File created C:\Program Files\Cathay Futures\MQL5\Include\Expert\Signal\SignalDEMA.mqh terminal64.exe File created C:\Program Files\Cathay Futures\MQL5\Scripts\Examples\AccountInfo\AccountInfoSampleInit.mqh terminal64.exe File created C:\Program Files\Cathay Futures\MQL5\Scripts\Examples\Canvas\Charts\PieChartSample.ex5 metaeditor64.exe File created C:\Program Files\Cathay Futures\Bases\Default\Mail\3.market.polish.welcome cathayfutures5setup.exe File created C:\Program Files\Cathay Futures\Bases\Default\Mail\6.virtualhosting.chinese (traditional).welcome cathayfutures5setup.exe File created C:\Program Files\Cathay Futures\Profiles\SymbolSets\forex.major.set cathayfutures5setup.exe File created C:\Program Files\Cathay Futures\MQL5\Include\Canvas\DX\DXUtils.mqh terminal64.exe File created C:\Program Files\Cathay Futures\MQL5\Include\Generic\Interfaces\IEqualityComparable.mqh terminal64.exe File created C:\Program Files\Cathay Futures\MQL5\Indicators\Examples\RSI.ex5 metaeditor64.exe File created C:\Program Files\Cathay Futures\MQL5\Include\ChartObjects\ChartObjectsElliott.mqh terminal64.exe File created C:\Program Files\Cathay Futures\MQL5\Indicators\Examples\ZigzagColor.mq5 terminal64.exe File created C:\Program Files\Cathay Futures\MQL5\Scripts\Examples\Remnant 3D\Shaders\pixel.hlsl terminal64.exe File created C:\Program Files\Cathay Futures\MQL5\Experts\Examples\Correlation Matrix 3D\Correlation Matrix 3D.ex5 metaeditor64.exe File created C:\Program Files\Cathay Futures\MQL5\Scripts\Examples\OpenCL\Double\MatrixMult.mq5 terminal64.exe File created C:\Program Files\Cathay Futures\MQL5\Indicators\Examples\ColorLine.ex5 metaeditor64.exe File created C:\Program Files\Cathay Futures\Bases\Default\History\EURUSD\2021.hcc cathayfutures5setup.exe File created C:\Program Files\Cathay Futures\Profiles\Charts\British Pound\chart04.chr cathayfutures5setup.exe File created C:\Program Files\Cathay Futures\MQL5\Include\Generic\Internal\Introsort.mqh terminal64.exe File created C:\Program Files\Cathay Futures\MQL5\Include\Math\Alglib\alglibinternal.mqh terminal64.exe File created C:\Program Files\Cathay Futures\MQL5\Include\Math\Fuzzy\fuzzyterm.mqh terminal64.exe File created C:\Program Files\Cathay Futures\MQL5\Include\Math\Stat\NoncentralT.mqh terminal64.exe File created C:\Program Files\Cathay Futures\MQL5\Indicators\Examples\Price_Channel.ex5 metaeditor64.exe File created C:\Program Files\Cathay Futures\MQL5\Include\Math\Alglib\fasttransforms.mqh terminal64.exe File created C:\Program Files\Cathay Futures\MQL5\Include\Trade\SymbolInfo.mqh terminal64.exe File created C:\Program Files\Cathay Futures\Bases\Default\Mail\4.mobile.hungarian.welcome cathayfutures5setup.exe File created C:\Program Files\Cathay Futures\Bases\Default\Mail\5.freelance.uzbek.welcome cathayfutures5setup.exe File created C:\Program Files\Cathay Futures\checkwritepermissions.test terminal64.exe File created C:\Program Files\Cathay Futures\MQL5\Include\Canvas\DX\DXDispatcher.mqh terminal64.exe File created C:\Program Files\Cathay Futures\MQL5\Include\Expert\ExpertMoney.mqh terminal64.exe File created C:\Program Files\Cathay Futures\MQL5\Include\Indicators\Trend.mqh terminal64.exe File created C:\Program Files\Cathay Futures\MQL5\Include\WinAPI\winnt.mqh terminal64.exe File created C:\Program Files\Cathay Futures\MQL5\Indicators\Examples\WPR.mq5 terminal64.exe File created C:\Program Files\Cathay Futures\MQL5\Scripts\Examples\OpenCL\Double\BitonicSort.ex5 metaeditor64.exe File created C:\Program Files\Cathay Futures\MQL5\Scripts\Examples\Canvas\Charts\HistogramChartSample.mq5 terminal64.exe File created C:\Program Files\Cathay Futures\MQL5\Indicators\Examples\W_AD.ex5 metaeditor64.exe File created C:\Program Files\Cathay Futures\MetaEditor64.exe cathayfutures5setup.exe File created C:\Program Files\Cathay Futures\Bases\Default\Mail\3.market.arabic.welcome cathayfutures5setup.exe File created C:\Program Files\Cathay Futures\Bases\Default\Mail\3.market.uzbek.welcome cathayfutures5setup.exe File created C:\Program Files\Cathay Futures\MQL5\Images\euro.bmp terminal64.exe File created C:\Program Files\Cathay Futures\MQL5\Include\Generic\Interfaces\ICollection.mqh terminal64.exe File created C:\Program Files\Cathay Futures\MQL5\Include\WinAPI\wingdi.mqh terminal64.exe File created C:\Program Files\Cathay Futures\Bases\Default\Mail\6.virtualhosting.arabic.welcome cathayfutures5setup.exe File created C:\Program Files\Cathay Futures\Profiles\SymbolSets\forex.all.set cathayfutures5setup.exe File created C:\Program Files\Cathay Futures\MQL5\Experts\Examples\Math 3D\Functions.mqh terminal64.exe File created C:\Program Files\Cathay Futures\MQL5\Include\Controls\res\DropOff.bmp terminal64.exe File created C:\Program Files\Cathay Futures\MQL5\Indicators\Examples\CHO.ex5 metaeditor64.exe File created C:\Program Files\Cathay Futures\Bases\Default\Mail\4.mobile.english.welcome cathayfutures5setup.exe File created C:\Program Files\Cathay Futures\Bases\Default\Mail\7.risk-warning.spanish.welcome cathayfutures5setup.exe -
Drops file in Windows directory 5 IoCs
Processes:
MicrosoftEdge.exeMicrosoftEdgeCP.exeMicrosoftEdgeCP.exemetaeditor64.exedescription ioc process File created C:\Windows\rescache\_merged\3720402701\2219095117.pri MicrosoftEdge.exe File opened for modification C:\Windows\Debug\ESE.TXT MicrosoftEdge.exe File created C:\Windows\rescache\_merged\3720402701\2219095117.pri MicrosoftEdgeCP.exe File created C:\Windows\rescache\_merged\3720402701\2219095117.pri MicrosoftEdgeCP.exe File opened for modification C:\Windows\ metaeditor64.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Checks processor information in registry 2 TTPs 4 IoCs
Processor information is often read in order to detect sandboxing environments.
Processes:
cathayfutures5setup.exeterminal64.exedescription ioc process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 cathayfutures5setup.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString cathayfutures5setup.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 terminal64.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString terminal64.exe -
Enumerates system info in registry 2 TTPs 9 IoCs
Processes:
cathayfutures5setup.exeterminal64.exeterminal64.exedescription ioc process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS cathayfutures5setup.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer cathayfutures5setup.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS terminal64.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer terminal64.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName terminal64.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName cathayfutures5setup.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS terminal64.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer terminal64.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName terminal64.exe -
Processes:
terminal64.exeMicrosoftEdge.exebrowser_broker.exeMicrosoftEdgeCP.exedescription ioc process Set value (int) \REGISTRY\USER\S-1-5-21-3853465373-1718857667-1861325682-1000\Software\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_BROWSER_EMULATION\terminal64.exe = "11000" terminal64.exe Key created \REGISTRY\USER\S-1-5-21-3853465373-1718857667-1861325682-1000\Software\Microsoft\Internet Explorer\Main MicrosoftEdge.exe Key created \REGISTRY\USER\S-1-5-21-3853465373-1718857667-1861325682-1000\Software\Microsoft\Internet Explorer\Main browser_broker.exe Key created \REGISTRY\USER\S-1-5-21-3853465373-1718857667-1861325682-1000\Software\Microsoft\Internet Explorer\Main MicrosoftEdgeCP.exe -
Modifies registry class 64 IoCs
Processes:
MicrosoftEdge.exeMicrosoftEdgeCP.exeMicrosoftEdgeCP.exeterminal64.exeMicrosoftEdgeCP.exeMicrosoftEdgeCP.exedescription ioc process Key created \REGISTRY\USER\S-1-5-21-3853465373-1718857667-1861325682-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\ServiceUI MicrosoftEdge.exe Set value (int) \REGISTRY\USER\S-1-5-21-3853465373-1718857667-1861325682-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\006\CIStatus\CIPolicyState = "0" MicrosoftEdgeCP.exe Key created \REGISTRY\USER\S-1-5-21-3853465373-1718857667-1861325682-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\ACGStatus MicrosoftEdgeCP.exe Set value (data) \REGISTRY\USER\S-1-5-21-3853465373-1718857667-1861325682-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\FlipAhead\Meta\generator$vBulletin 3 MicrosoftEdge.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.ex5\ = "EX5.File" terminal64.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\MQL5.Header\shell\open\command\ = "C:\\Program Files\\Cathay Futures\\metaeditor64.exe \"%1\"" terminal64.exe Key created \REGISTRY\USER\S-1-5-21-3853465373-1718857667-1861325682-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Internet Settings\Cache\Cookies MicrosoftEdge.exe Set value (int) \REGISTRY\USER\S-1-5-21-3853465373-1718857667-1861325682-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\GPU\Wow64-VersionLow = "0" MicrosoftEdge.exe Set value (int) \REGISTRY\USER\S-1-5-21-3853465373-1718857667-1861325682-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\Internet Explorer\Main\OperationalData = "1" MicrosoftEdgeCP.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\MetaTrader 5 Export File terminal64.exe Set value (int) \REGISTRY\USER\S-1-5-21-3853465373-1718857667-1861325682-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\Roaming\ChangeUnitGenerationNeeded = "1" MicrosoftEdge.exe Key created \REGISTRY\USER\S-1-5-21-3853465373-1718857667-1861325682-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Internet Settings\Cache MicrosoftEdge.exe Set value (data) \REGISTRY\USER\S-1-5-21-3853465373-1718857667-1861325682-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\Protected - It is a violation of Windows Policy to modif = 010000004bdfc72fe3ecff2505e0b84f6cb2dacc7b373fc847b4a318f019f04ef4540d28f25f5e11e80a61fd0ba6a7effc6316ea962b3a1380f8df4c6a5c MicrosoftEdge.exe Set value (int) \REGISTRY\USER\S-1-5-21-3853465373-1718857667-1861325682-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\121\CIStatus\CIPolicyState = "0" MicrosoftEdgeCP.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\MQL5.File\DefaultIcon\ = "C:\\Program Files\\Cathay Futures\\metaeditor64.exe,1" terminal64.exe Set value (data) \REGISTRY\USER\S-1-5-21-3853465373-1718857667-1861325682-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\UserStateMigration\ChromeMigration\MigrationTime = 3df8bf635a45d901 MicrosoftEdge.exe Key created \REGISTRY\USER\S-1-5-21-3853465373-1718857667-1861325682-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\TypedURLs MicrosoftEdge.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.mt5\ = "MetaTrader 5 Export File" terminal64.exe Set value (str) \REGISTRY\USER\S-1-5-21-3853465373-1718857667-1861325682-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\Internet Settings\Cache\Cookies\CachePrefix = "Cookie:" MicrosoftEdgeCP.exe Key created \REGISTRY\USER\S-1-5-21-3853465373-1718857667-1861325682-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\HistoryJournalCertificate MicrosoftEdge.exe Set value (str) \REGISTRY\USER\S-1-5-21-3853465373-1718857667-1861325682-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\TypedURLs\url2 = "https://login.aliexpress.com/" MicrosoftEdge.exe Set value (int) \REGISTRY\USER\S-1-5-21-3853465373-1718857667-1861325682-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\UserStateMigration\IEMigration\AllComplete = "1" MicrosoftEdge.exe Key created \REGISTRY\USER\S-1-5-21-3853465373-1718857667-1861325682-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\006\CIStatus MicrosoftEdgeCP.exe Set value (data) \REGISTRY\USER\S-1-5-21-3853465373-1718857667-1861325682-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\DataStore\LastCleanup = 0000000000000000 MicrosoftEdge.exe Key created \REGISTRY\USER\S-1-5-21-3853465373-1718857667-1861325682-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Software MicrosoftEdge.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\MetaTrader 5 Export File\shell\open\command\ = "C:\\Program Files\\Cathay Futures\\terminal64.exe /import:\"%1\"" terminal64.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\MQL5.Header\ = "MQL5 Header File" terminal64.exe Set value (int) \REGISTRY\USER\S-1-5-21-3853465373-1718857667-1861325682-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\FavOrder\TreeView = "1" MicrosoftEdge.exe Key created \REGISTRY\USER\S-1-5-21-3853465373-1718857667-1861325682-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\Internet Explorer MicrosoftEdgeCP.exe Set value (int) \REGISTRY\USER\S-1-5-21-3853465373-1718857667-1861325682-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\ReadingMode\FontSize = "3" MicrosoftEdge.exe Key created \REGISTRY\USER\S-1-5-21-3853465373-1718857667-1861325682-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\LowRegistry\DOMStorage MicrosoftEdge.exe Set value (int) \REGISTRY\USER\S-1-5-21-3853465373-1718857667-1861325682-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\Protected - It is a violation of Windows Policy to modif = "1" MicrosoftEdge.exe Set value (int) \REGISTRY\USER\S-1-5-21-3853465373-1718857667-1861325682-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\Internet Settings\PrivacyAdvanced = "0" MicrosoftEdge.exe Set value (data) \REGISTRY\USER\S-1-5-21-3853465373-1718857667-1861325682-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\CIStatus\CIStatusTimestamp = 95903f47715ed901 MicrosoftEdge.exe Key created \REGISTRY\USER\S-1-5-21-3853465373-1718857667-1861325682-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\Internet Settings\Cache\Cookies MicrosoftEdgeCP.exe Key created \REGISTRY\USER\S-1-5-21-3853465373-1718857667-1861325682-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge MicrosoftEdge.exe Set value (int) \REGISTRY\USER\S-1-5-21-3853465373-1718857667-1861325682-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\UserStateMigration\ChromeMigration\AllComplete = "1" MicrosoftEdge.exe Set value (data) \REGISTRY\USER\S-1-5-21-3853465373-1718857667-1861325682-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\Internet Settings\Zones\3\{AEBA21FA-782A-4A90-978D-B7216 = 1a3761592352350c7a5f20172f1e1a190e2b017313371312141a152a MicrosoftEdge.exe Key created \REGISTRY\USER\S-1-5-21-3853465373-1718857667-1861325682-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\LowRegistry\DontShowMeThisDialogAgain MicrosoftEdge.exe Key created \REGISTRY\USER\S-1-5-21-3853465373-1718857667-1861325682-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\Internet Settings\Zones\3 MicrosoftEdge.exe Key created \REGISTRY\USER\S-1-5-21-3853465373-1718857667-1861325682-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\Internet Settings\Cache\History MicrosoftEdgeCP.exe Key created \REGISTRY\USER\S-1-5-21-3853465373-1718857667-1861325682-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\DataStore MicrosoftEdge.exe Key created \REGISTRY\USER\S-1-5-21-3853465373-1718857667-1861325682-1000_Classes\Local Settings MicrosoftEdge.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\EX5.File\shell\open terminal64.exe Set value (int) \REGISTRY\USER\S-1-5-21-3853465373-1718857667-1861325682-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\CIStatus\CIPolicyState = "0" MicrosoftEdgeCP.exe Set value (data) \REGISTRY\USER\S-1-5-21-3853465373-1718857667-1861325682-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\CIStatus\SignaturePolicy = 06000000 MicrosoftEdgeCP.exe Key created \REGISTRY\USER\S-1-5-21-3853465373-1718857667-1861325682-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\Toolbar MicrosoftEdge.exe Key created \REGISTRY\USER\S-1-5-21-3853465373-1718857667-1861325682-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\Toolbar\WebBrowser MicrosoftEdge.exe Key created \REGISTRY\USER\S-1-5-21-3853465373-1718857667-1861325682-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\Recovery MicrosoftEdge.exe Set value (int) \REGISTRY\USER\S-1-5-21-3853465373-1718857667-1861325682-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\BrowserEmulation\IECompatVersionLow = "0" MicrosoftEdge.exe Set value (str) \REGISTRY\USER\S-1-5-21-3853465373-1718857667-1861325682-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\DomainSuggestion\FileNames\en-US = "en-US.1" MicrosoftEdge.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\MQL5.File\ShellNew terminal64.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\MQL5.Header\shell terminal64.exe Key created \REGISTRY\USER\S-1-5-21-3853465373-1718857667-1861325682-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\New Windows\AllowInPrivate MicrosoftEdge.exe Set value (data) \REGISTRY\USER\S-1-5-21-3853465373-1718857667-1861325682-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\FlipAhead\Meta\generator$MediaWiki MicrosoftEdge.exe Set value (int) \REGISTRY\USER\S-1-5-21-3853465373-1718857667-1861325682-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\ExtensionsStore\datastore\usage\dscc_inventory\Extension = "5" MicrosoftEdge.exe Set value (int) \REGISTRY\USER\S-1-5-21-3853465373-1718857667-1861325682-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\Main\JumpListInPrivateBrowsingAllowed = "1" MicrosoftEdge.exe Set value (data) \REGISTRY\USER\S-1-5-21-3853465373-1718857667-1861325682-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\DataStore\LastCleanup = e64c934c715ed901 MicrosoftEdge.exe Key created \REGISTRY\USER\S-1-5-21-3853465373-1718857667-1861325682-1000_Classes\Local Settings\MrtCache MicrosoftEdge.exe Set value (str) \REGISTRY\USER\S-1-5-21-3853465373-1718857667-1861325682-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\TypedURLs\url1 = "https://www.facebook.com/" MicrosoftEdge.exe Set value (str) \REGISTRY\USER\S-1-5-21-3853465373-1718857667-1861325682-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\ExtensionsStore\datastore\usage\dscc_inventory\Extension = "{FDEC5E32-3FFA-4817-86C5-2F9C6A1CA039}" MicrosoftEdge.exe Set value (int) \REGISTRY\USER\S-1-5-21-3853465373-1718857667-1861325682-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\GPU\DeviceId = "0" MicrosoftEdge.exe Key created \REGISTRY\USER\S-1-5-21-3853465373-1718857667-1861325682-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\121\Internet Settings\Cache MicrosoftEdgeCP.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\mql5buy\shell terminal64.exe -
Processes:
cathayfutures5setup.exeterminal64.exedescription ioc process Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\91C6D6EE3E8AC86384E548C299295C756C817B81\Blob = 190000000100000010000000dc73f9b71e16d51d26527d32b11a6a3d0f000000010000001400000085fef11b4f47fe3952f98301c9f98976fefee0ce7f000000010000002a000000302806082b0601050507030206082b0601050507030306082b0601050507030406082b0601050507030109000000010000002a000000302806082b0601050507030206082b0601050507030306082b0601050507030406082b0601050507030153000000010000002500000030233021060b6086480186f8450107300130123010060a2b0601040182373c0101030200c06200000001000000200000008d722f81a9c113c0791df136a2966db26c950a971db46b4199f4ea54b78bfb9f1400000001000000140000007b5b45cfafcecb7afd31921a6ab6f346eb5748501d00000001000000100000005b3b67000eeb80022e42605b6b3b72400b000000010000000e00000074006800610077007400650000007e000000010000000800000000c0032f2df8d60103000000010000001400000091c6d6ee3e8ac86384e548c299295c756c817b812000000001000000240400003082042030820308a0030201020210344ed55720d5edec49f42fce37db2b6d300d06092a864886f70d01010505003081a9310b300906035504061302555331153013060355040a130c7468617774652c20496e632e31283026060355040b131f43657274696669636174696f6e205365727669636573204469766973696f6e31383036060355040b132f2863292032303036207468617774652c20496e632e202d20466f7220617574686f72697a656420757365206f6e6c79311f301d06035504031316746861777465205072696d61727920526f6f74204341301e170d3036313131373030303030305a170d3336303731363233353935395a3081a9310b300906035504061302555331153013060355040a130c7468617774652c20496e632e31283026060355040b131f43657274696669636174696f6e205365727669636573204469766973696f6e31383036060355040b132f2863292032303036207468617774652c20496e632e202d20466f7220617574686f72697a656420757365206f6e6c79311f301d06035504031316746861777465205072696d61727920526f6f7420434130820122300d06092a864886f70d01010105000382010f003082010a0282010100aca0f0fb8059d49cc7a4cf9da159730910450c0d2c6e68f16c5b4868495937fc0b3319c2777fcc102d95341ce6eb4d09a71cd2b8c9973602b789d4245f06c0cc4494948d02626feb5add118d289a5c8490107a0dbd74662f6a38a0e2d55444eb1d079f07ba6feee9fd4e0b29f53e84a001f19cabf81c7e89a4e8a1d871650da3517beebcd222600db95b9ddfbafc515b0baf98b2e92ee904e86287de2bc8d74ec14c641eddcf8758ba4a4fca68071d1c9d4ac6d52f91cc7c71721cc5c067eb32fdc9925c94da85c09bbf537d2b09f48c9d911f976a52cbde0936a477d87b875044d53e6e2969fb3949261e09a5807b402debe82785c9fe61fd7ee67c971dd59d0203010001a3423040300f0603551d130101ff040530030101ff300e0603551d0f0101ff040403020106301d0603551d0e041604147b5b45cfafcecb7afd31921a6ab6f346eb574850300d06092a864886f70d010105050003820101007911c04bb391b6fcf0e967d40d6e45be55e893d2ce033fedda25b01d57cb1e3a76a04cec5076e864720ca4a9f1b88bd6d68784bb32e54111c077d9b3609deb1bd5d16e4444a9a601ec55621d77b85c8e48497c9c3b5711acad73378e2f785c906847d96060e6fc073d222017c4f716e9c4d872f9c8737cdf162f15a93efd6a27b6a1eb5aba981fd5e34d640a9d13c861baf5391c87bab8bd7b227ff6feac4079e5ac106f3d8f1b79768bc437b3211884e53600eb632099b9e9fe3304bb41c8c102f94463209e81ce42d3d63f2c76d3639c59dd8fa6e10ea02e41f72e9547cfbcfd33f3f60b617e7e912b8147c22730eea7105d378f5c392be404f07b8d568c68 cathayfutures5setup.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\D1CBCA5DB2D52A7F693B674DE5F05A1D0C957DF0 cathayfutures5setup.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\D1CBCA5DB2D52A7F693B674DE5F05A1D0C957DF0\Blob = 0f00000001000000300000000b043572c899dec43efd590cfce610cf443a6315925ebfe589f7506907e44824608489581c7ca0e041458514cf157614090000000100000054000000305206082b0601050507030206082b06010505070303060a2b0601040182370a030406082b0601050507030406082b0601050507030606082b0601050507030706082b0601050507030106082b0601050507030853000000010000004300000030413022060c2b06010401b231010201050130123010060a2b0601040182373c0101030200c0301b060567810c010330123010060a2b0601040182373c0101030200c06200000001000000200000004ff460d54b9c86dabfbcfc5712e0400d2bed3fbc4d4fbdaa86e06adcd2a9ad7a0b00000001000000180000005300650063007400690067006f00200045004300430000001400000001000000140000003ae10986d4cf19c29676744976dce035c663639a1d0000000100000010000000280cf6042c30a2646644ba7286a3aa97030000000100000014000000d1cbca5db2d52a7f693b674de5f05a1d0c957df02000000001000000930200003082028f30820215a00302010202105c8b99c55a94c5d27156decd8980cc26300a06082a8648ce3d040303308188310b3009060355040613025553311330110603550408130a4e6577204a6572736579311430120603550407130b4a65727365792043697479311e301c060355040a131554686520555345525452555354204e6574776f726b312e302c06035504031325555345525472757374204543432043657274696669636174696f6e20417574686f72697479301e170d3130303230313030303030305a170d3338303131383233353935395a308188310b3009060355040613025553311330110603550408130a4e6577204a6572736579311430120603550407130b4a65727365792043697479311e301c060355040a131554686520555345525452555354204e6574776f726b312e302c06035504031325555345525472757374204543432043657274696669636174696f6e20417574686f726974793076301006072a8648ce3d020106052b81040022036200041aac545aa9f96823e77ad5246f53c65ad84babc6d5b6d1e67371aedd9cd60c61fddba08903b80514ec57ceee5d3fe221b3cef7d48a79e0a3837e2d97d061c4f199dc259163ab7f30a3b470e2c7a1339cf3bf2e5c53b15fb37d327f8a34e37979a3423040301d0603551d0e041604143ae10986d4cf19c29676744976dce035c663639a300e0603551d0f0101ff040403020106300f0603551d130101ff040530030101ff300a06082a8648ce3d040303036800306502303667a11608dce49700411d4ebee16301cf3baa421164a09d94390211795c7b1dfa64b9ee1642b3bf8ac209c4ece4b14d023100e92a61478c524a4b4e1870f6d644d66ef583ba6d58bd24d95648eaefc4a24681886a3a46d1a99b4dc961dad15d576a18 cathayfutures5setup.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\D1CBCA5DB2D52A7F693B674DE5F05A1D0C957DF0\Blob = 040000000100000010000000fa68bcd9b57fadfdc91d068328cc24c1030000000100000014000000d1cbca5db2d52a7f693b674de5f05a1d0c957df01d0000000100000010000000280cf6042c30a2646644ba7286a3aa971400000001000000140000003ae10986d4cf19c29676744976dce035c663639a0b00000001000000180000005300650063007400690067006f00200045004300430000006200000001000000200000004ff460d54b9c86dabfbcfc5712e0400d2bed3fbc4d4fbdaa86e06adcd2a9ad7a53000000010000004300000030413022060c2b06010401b231010201050130123010060a2b0601040182373c0101030200c0301b060567810c010330123010060a2b0601040182373c0101030200c0090000000100000054000000305206082b0601050507030206082b06010505070303060a2b0601040182370a030406082b0601050507030406082b0601050507030606082b0601050507030706082b0601050507030106082b060105050703080f00000001000000300000000b043572c899dec43efd590cfce610cf443a6315925ebfe589f7506907e44824608489581c7ca0e041458514cf1576142000000001000000930200003082028f30820215a00302010202105c8b99c55a94c5d27156decd8980cc26300a06082a8648ce3d040303308188310b3009060355040613025553311330110603550408130a4e6577204a6572736579311430120603550407130b4a65727365792043697479311e301c060355040a131554686520555345525452555354204e6574776f726b312e302c06035504031325555345525472757374204543432043657274696669636174696f6e20417574686f72697479301e170d3130303230313030303030305a170d3338303131383233353935395a308188310b3009060355040613025553311330110603550408130a4e6577204a6572736579311430120603550407130b4a65727365792043697479311e301c060355040a131554686520555345525452555354204e6574776f726b312e302c06035504031325555345525472757374204543432043657274696669636174696f6e20417574686f726974793076301006072a8648ce3d020106052b81040022036200041aac545aa9f96823e77ad5246f53c65ad84babc6d5b6d1e67371aedd9cd60c61fddba08903b80514ec57ceee5d3fe221b3cef7d48a79e0a3837e2d97d061c4f199dc259163ab7f30a3b470e2c7a1339cf3bf2e5c53b15fb37d327f8a34e37979a3423040301d0603551d0e041604143ae10986d4cf19c29676744976dce035c663639a300e0603551d0f0101ff040403020106300f0603551d130101ff040530030101ff300a06082a8648ce3d040303036800306502303667a11608dce49700411d4ebee16301cf3baa421164a09d94390211795c7b1dfa64b9ee1642b3bf8ac209c4ece4b14d023100e92a61478c524a4b4e1870f6d644d66ef583ba6d58bd24d95648eaefc4a24681886a3a46d1a99b4dc961dad15d576a18 cathayfutures5setup.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\D1CBCA5DB2D52A7F693B674DE5F05A1D0C957DF0\Blob = 5c000000010000000400000080010000040000000100000010000000fa68bcd9b57fadfdc91d068328cc24c1030000000100000014000000d1cbca5db2d52a7f693b674de5f05a1d0c957df01d0000000100000010000000280cf6042c30a2646644ba7286a3aa971400000001000000140000003ae10986d4cf19c29676744976dce035c663639a0b00000001000000180000005300650063007400690067006f00200045004300430000006200000001000000200000004ff460d54b9c86dabfbcfc5712e0400d2bed3fbc4d4fbdaa86e06adcd2a9ad7a53000000010000004300000030413022060c2b06010401b231010201050130123010060a2b0601040182373c0101030200c0301b060567810c010330123010060a2b0601040182373c0101030200c0090000000100000054000000305206082b0601050507030206082b06010505070303060a2b0601040182370a030406082b0601050507030406082b0601050507030606082b0601050507030706082b0601050507030106082b060105050703080f00000001000000300000000b043572c899dec43efd590cfce610cf443a6315925ebfe589f7506907e44824608489581c7ca0e041458514cf15761419000000010000001000000076935b5c5a037216daaf8aac76df42c12000000001000000930200003082028f30820215a00302010202105c8b99c55a94c5d27156decd8980cc26300a06082a8648ce3d040303308188310b3009060355040613025553311330110603550408130a4e6577204a6572736579311430120603550407130b4a65727365792043697479311e301c060355040a131554686520555345525452555354204e6574776f726b312e302c06035504031325555345525472757374204543432043657274696669636174696f6e20417574686f72697479301e170d3130303230313030303030305a170d3338303131383233353935395a308188310b3009060355040613025553311330110603550408130a4e6577204a6572736579311430120603550407130b4a65727365792043697479311e301c060355040a131554686520555345525452555354204e6574776f726b312e302c06035504031325555345525472757374204543432043657274696669636174696f6e20417574686f726974793076301006072a8648ce3d020106052b81040022036200041aac545aa9f96823e77ad5246f53c65ad84babc6d5b6d1e67371aedd9cd60c61fddba08903b80514ec57ceee5d3fe221b3cef7d48a79e0a3837e2d97d061c4f199dc259163ab7f30a3b470e2c7a1339cf3bf2e5c53b15fb37d327f8a34e37979a3423040301d0603551d0e041604143ae10986d4cf19c29676744976dce035c663639a300e0603551d0f0101ff040403020106300f0603551d130101ff040530030101ff300a06082a8648ce3d040303036800306502303667a11608dce49700411d4ebee16301cf3baa421164a09d94390211795c7b1dfa64b9ee1642b3bf8ac209c4ece4b14d023100e92a61478c524a4b4e1870f6d644d66ef583ba6d58bd24d95648eaefc4a24681886a3a46d1a99b4dc961dad15d576a18 cathayfutures5setup.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\2B8F1B57330DBBA2D07A6C51F70EE90DDAB9AD8E\Blob = 190000000100000010000000ea6089055218053dd01e37e1d806eedf0f000000010000003000000066b764a96581128168cf208e374dda479d54e311f32457f4aee0dbd2a6c8d171d531289e1cd22bfdbbd4cfd979625483090000000100000054000000305206082b0601050507030206082b06010505070303060a2b0601040182370a030406082b0601050507030406082b0601050507030606082b0601050507030706082b0601050507030106082b0601050507030853000000010000004300000030413022060c2b06010401b231010201050130123010060a2b0601040182373c0101030200c0301b060567810c010330123010060a2b0601040182373c0101030200c0620000000100000020000000e793c9b02fd8aa13e21c31228accb08119643b749c898964b1746d46c3d4cbd21400000001000000140000005379bf5aaa2b4acf5480e1d89bc09df2b20366cb1d0000000100000010000000885010358d29a38f059b028559c95f900b00000001000000100000005300650063007400690067006f0000000300000001000000140000002b8f1b57330dbba2d07a6c51f70ee90ddab9ad8e0400000001000000100000001bfe69d191b71933a372a80fe155e5b52000000001000000e2050000308205de308203c6a003020102021001fd6d30fca3ca51a81bbc640e35032d300d06092a864886f70d01010c0500308188310b3009060355040613025553311330110603550408130a4e6577204a6572736579311430120603550407130b4a65727365792043697479311e301c060355040a131554686520555345525452555354204e6574776f726b312e302c06035504031325555345525472757374205253412043657274696669636174696f6e20417574686f72697479301e170d3130303230313030303030305a170d3338303131383233353935395a308188310b3009060355040613025553311330110603550408130a4e6577204a6572736579311430120603550407130b4a65727365792043697479311e301c060355040a131554686520555345525452555354204e6574776f726b312e302c06035504031325555345525472757374205253412043657274696669636174696f6e20417574686f7269747930820222300d06092a864886f70d01010105000382020f003082020a028202010080126517360ec3db08b3d0ac570d76edcd27d34cad508361e2aa204d092d6409dcce899fcc3da9ecf6cfc1dcf1d3b1d67b3728112b47da39c6bc3a19b45fa6bd7d9da36342b676f2a93b2b91f8e26fd0ec162090093ee2e874c918b491d46264db7fa306f188186a90223cbcfe13f087147bf6e41f8ed4e451c61167460851cb8614543fbc33fe7e6c9cff169d18bd518e35a6a766c87267db2166b1d49b7803c0503ae8ccf0dcbc9e4cfeaf0596351f575ab7ffcef93db72cb6f654ddc8e7123a4dae4c8ab75c9ab4b7203dca7f2234ae7e3b68660144e7014e46539b3360f794be5337907343f332c353efdbaafe744e69c76b8c6093dec4c70cdfe132aecc933b517895678bee3d56fe0cd0690f1b0ff325266b336df76e47fa7343e57e0ea566b1297c3284635589c40dc19354301913acd37d37a7eb5d3a6c355cdb41d712daa9490bdfd8808a0993628eb566cf2588cd84b8b13fa4390fd9029eeb124c957cf36b05a95e1683ccb867e2e8139dcc5b82d34cb3ed5bffdee573ac233b2d00bf3555740949d849581a7f9236e651920ef3267d1c4d17bcc9ec4326d0bf415f40a94444f499e757879e501f5754a83efd74632fb1506509e658422e431a4cb4f0254759fa041e93d426464a5081b2debe78b7fc6715e1c957841e0f63d6e962bad65f552eea5cc62808042539b80e2ba9f24c971c073f0d52f5edef2f820f0203010001a3423040301d0603551d0e041604145379bf5aaa2b4acf5480e1d89bc09df2b20366cb300e0603551d0f0101ff040403020106300f0603551d130101ff040530030101ff300d06092a864886f70d01010c050003820201005cd47c0dcff7017d4199650c73c5529fcbf8cf99067f1bda43159f9e0255579614f1523c27879428ed1f3a0137a276fc5350c0849bc66b4eba8c214fa28e556291f36915d8bc88e3c4aa0bfdefa8e94b552a06206d55782919ee5f305c4b241155ff249a6e5e2a2bee0b4d9f7ff70138941495430709fb60a9ee1cab128ca09a5ea7986a596d8b3f08fbc8d145af18156490120f73282ec5e2244efc58ecf0f445fe22b3eb2f8ed2d9456105c1976fa876728f8b8c36afbf0d05ce718de6a66f1f6ca67162c5d8d083720cf16711890c9c134c7234dfbcd571dfaa71dde1b96c8c3c125d65dabd5712b6436bffe5de4d661151cf99aeec17b6e871918cde49fedd3571a21527941ccf61e326bb6fa36725215de6dd1d0b2e681b3b82afec836785d4985174b1b9998089ff7f78195c794a602e9240ae4c372a2cc9c762c80e5df7365bcae0252501b4dd1a079c77003fd0dcd5ec3dd4fabb3fcc85d66f7fa92ddfb902f7f5979ab535dac367b0874aa9289e238eff5c276be1b04ff307ee002ed45987cb524195eaf447d7ee6441557c8d590295dd629dc2b9ee5a287484a59bb790c70c07dff589367432d628c1b0b00be09c4cc31cd6fce369b54746812fa282abd3634470c48dff2d33baad8f7bb57088ae3e19cf4028d8fcc890bb5d9922f552e658c51f883143ee881dd7c68e3c436a1da718de7d3d16f162f9ca90a8fd terminal64.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\2B8F1B57330DBBA2D07A6C51F70EE90DDAB9AD8E\Blob = 5c0000000100000004000000001000000400000001000000100000001bfe69d191b71933a372a80fe155e5b50300000001000000140000002b8f1b57330dbba2d07a6c51f70ee90ddab9ad8e0b00000001000000100000005300650063007400690067006f0000001d0000000100000010000000885010358d29a38f059b028559c95f901400000001000000140000005379bf5aaa2b4acf5480e1d89bc09df2b20366cb620000000100000020000000e793c9b02fd8aa13e21c31228accb08119643b749c898964b1746d46c3d4cbd253000000010000004300000030413022060c2b06010401b231010201050130123010060a2b0601040182373c0101030200c0301b060567810c010330123010060a2b0601040182373c0101030200c0090000000100000054000000305206082b0601050507030206082b06010505070303060a2b0601040182370a030406082b0601050507030406082b0601050507030606082b0601050507030706082b0601050507030106082b060105050703080f000000010000003000000066b764a96581128168cf208e374dda479d54e311f32457f4aee0dbd2a6c8d171d531289e1cd22bfdbbd4cfd979625483190000000100000010000000ea6089055218053dd01e37e1d806eedf2000000001000000e2050000308205de308203c6a003020102021001fd6d30fca3ca51a81bbc640e35032d300d06092a864886f70d01010c0500308188310b3009060355040613025553311330110603550408130a4e6577204a6572736579311430120603550407130b4a65727365792043697479311e301c060355040a131554686520555345525452555354204e6574776f726b312e302c06035504031325555345525472757374205253412043657274696669636174696f6e20417574686f72697479301e170d3130303230313030303030305a170d3338303131383233353935395a308188310b3009060355040613025553311330110603550408130a4e6577204a6572736579311430120603550407130b4a65727365792043697479311e301c060355040a131554686520555345525452555354204e6574776f726b312e302c06035504031325555345525472757374205253412043657274696669636174696f6e20417574686f7269747930820222300d06092a864886f70d01010105000382020f003082020a028202010080126517360ec3db08b3d0ac570d76edcd27d34cad508361e2aa204d092d6409dcce899fcc3da9ecf6cfc1dcf1d3b1d67b3728112b47da39c6bc3a19b45fa6bd7d9da36342b676f2a93b2b91f8e26fd0ec162090093ee2e874c918b491d46264db7fa306f188186a90223cbcfe13f087147bf6e41f8ed4e451c61167460851cb8614543fbc33fe7e6c9cff169d18bd518e35a6a766c87267db2166b1d49b7803c0503ae8ccf0dcbc9e4cfeaf0596351f575ab7ffcef93db72cb6f654ddc8e7123a4dae4c8ab75c9ab4b7203dca7f2234ae7e3b68660144e7014e46539b3360f794be5337907343f332c353efdbaafe744e69c76b8c6093dec4c70cdfe132aecc933b517895678bee3d56fe0cd0690f1b0ff325266b336df76e47fa7343e57e0ea566b1297c3284635589c40dc19354301913acd37d37a7eb5d3a6c355cdb41d712daa9490bdfd8808a0993628eb566cf2588cd84b8b13fa4390fd9029eeb124c957cf36b05a95e1683ccb867e2e8139dcc5b82d34cb3ed5bffdee573ac233b2d00bf3555740949d849581a7f9236e651920ef3267d1c4d17bcc9ec4326d0bf415f40a94444f499e757879e501f5754a83efd74632fb1506509e658422e431a4cb4f0254759fa041e93d426464a5081b2debe78b7fc6715e1c957841e0f63d6e962bad65f552eea5cc62808042539b80e2ba9f24c971c073f0d52f5edef2f820f0203010001a3423040301d0603551d0e041604145379bf5aaa2b4acf5480e1d89bc09df2b20366cb300e0603551d0f0101ff040403020106300f0603551d130101ff040530030101ff300d06092a864886f70d01010c050003820201005cd47c0dcff7017d4199650c73c5529fcbf8cf99067f1bda43159f9e0255579614f1523c27879428ed1f3a0137a276fc5350c0849bc66b4eba8c214fa28e556291f36915d8bc88e3c4aa0bfdefa8e94b552a06206d55782919ee5f305c4b241155ff249a6e5e2a2bee0b4d9f7ff70138941495430709fb60a9ee1cab128ca09a5ea7986a596d8b3f08fbc8d145af18156490120f73282ec5e2244efc58ecf0f445fe22b3eb2f8ed2d9456105c1976fa876728f8b8c36afbf0d05ce718de6a66f1f6ca67162c5d8d083720cf16711890c9c134c7234dfbcd571dfaa71dde1b96c8c3c125d65dabd5712b6436bffe5de4d661151cf99aeec17b6e871918cde49fedd3571a21527941ccf61e326bb6fa36725215de6dd1d0b2e681b3b82afec836785d4985174b1b9998089ff7f78195c794a602e9240ae4c372a2cc9c762c80e5df7365bcae0252501b4dd1a079c77003fd0dcd5ec3dd4fabb3fcc85d66f7fa92ddfb902f7f5979ab535dac367b0874aa9289e238eff5c276be1b04ff307ee002ed45987cb524195eaf447d7ee6441557c8d590295dd629dc2b9ee5a287484a59bb790c70c07dff589367432d628c1b0b00be09c4cc31cd6fce369b54746812fa282abd3634470c48dff2d33baad8f7bb57088ae3e19cf4028d8fcc890bb5d9922f552e658c51f883143ee881dd7c68e3c436a1da718de7d3d16f162f9ca90a8fd terminal64.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\91C6D6EE3E8AC86384E548C299295C756C817B81 cathayfutures5setup.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\D1CBCA5DB2D52A7F693B674DE5F05A1D0C957DF0\Blob = 19000000010000001000000076935b5c5a037216daaf8aac76df42c10f00000001000000300000000b043572c899dec43efd590cfce610cf443a6315925ebfe589f7506907e44824608489581c7ca0e041458514cf157614090000000100000054000000305206082b0601050507030206082b06010505070303060a2b0601040182370a030406082b0601050507030406082b0601050507030606082b0601050507030706082b0601050507030106082b0601050507030853000000010000004300000030413022060c2b06010401b231010201050130123010060a2b0601040182373c0101030200c0301b060567810c010330123010060a2b0601040182373c0101030200c06200000001000000200000004ff460d54b9c86dabfbcfc5712e0400d2bed3fbc4d4fbdaa86e06adcd2a9ad7a0b00000001000000180000005300650063007400690067006f00200045004300430000001400000001000000140000003ae10986d4cf19c29676744976dce035c663639a1d0000000100000010000000280cf6042c30a2646644ba7286a3aa97030000000100000014000000d1cbca5db2d52a7f693b674de5f05a1d0c957df0040000000100000010000000fa68bcd9b57fadfdc91d068328cc24c12000000001000000930200003082028f30820215a00302010202105c8b99c55a94c5d27156decd8980cc26300a06082a8648ce3d040303308188310b3009060355040613025553311330110603550408130a4e6577204a6572736579311430120603550407130b4a65727365792043697479311e301c060355040a131554686520555345525452555354204e6574776f726b312e302c06035504031325555345525472757374204543432043657274696669636174696f6e20417574686f72697479301e170d3130303230313030303030305a170d3338303131383233353935395a308188310b3009060355040613025553311330110603550408130a4e6577204a6572736579311430120603550407130b4a65727365792043697479311e301c060355040a131554686520555345525452555354204e6574776f726b312e302c06035504031325555345525472757374204543432043657274696669636174696f6e20417574686f726974793076301006072a8648ce3d020106052b81040022036200041aac545aa9f96823e77ad5246f53c65ad84babc6d5b6d1e67371aedd9cd60c61fddba08903b80514ec57ceee5d3fe221b3cef7d48a79e0a3837e2d97d061c4f199dc259163ab7f30a3b470e2c7a1339cf3bf2e5c53b15fb37d327f8a34e37979a3423040301d0603551d0e041604143ae10986d4cf19c29676744976dce035c663639a300e0603551d0f0101ff040403020106300f0603551d130101ff040530030101ff300a06082a8648ce3d040303036800306502303667a11608dce49700411d4ebee16301cf3baa421164a09d94390211795c7b1dfa64b9ee1642b3bf8ac209c4ece4b14d023100e92a61478c524a4b4e1870f6d644d66ef583ba6d58bd24d95648eaefc4a24681886a3a46d1a99b4dc961dad15d576a18 cathayfutures5setup.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\2B8F1B57330DBBA2D07A6C51F70EE90DDAB9AD8E terminal64.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\2B8F1B57330DBBA2D07A6C51F70EE90DDAB9AD8E\Blob = 0f000000010000003000000066b764a96581128168cf208e374dda479d54e311f32457f4aee0dbd2a6c8d171d531289e1cd22bfdbbd4cfd979625483090000000100000054000000305206082b0601050507030206082b06010505070303060a2b0601040182370a030406082b0601050507030406082b0601050507030606082b0601050507030706082b0601050507030106082b0601050507030853000000010000004300000030413022060c2b06010401b231010201050130123010060a2b0601040182373c0101030200c0301b060567810c010330123010060a2b0601040182373c0101030200c0620000000100000020000000e793c9b02fd8aa13e21c31228accb08119643b749c898964b1746d46c3d4cbd21400000001000000140000005379bf5aaa2b4acf5480e1d89bc09df2b20366cb1d0000000100000010000000885010358d29a38f059b028559c95f900b00000001000000100000005300650063007400690067006f0000000300000001000000140000002b8f1b57330dbba2d07a6c51f70ee90ddab9ad8e2000000001000000e2050000308205de308203c6a003020102021001fd6d30fca3ca51a81bbc640e35032d300d06092a864886f70d01010c0500308188310b3009060355040613025553311330110603550408130a4e6577204a6572736579311430120603550407130b4a65727365792043697479311e301c060355040a131554686520555345525452555354204e6574776f726b312e302c06035504031325555345525472757374205253412043657274696669636174696f6e20417574686f72697479301e170d3130303230313030303030305a170d3338303131383233353935395a308188310b3009060355040613025553311330110603550408130a4e6577204a6572736579311430120603550407130b4a65727365792043697479311e301c060355040a131554686520555345525452555354204e6574776f726b312e302c06035504031325555345525472757374205253412043657274696669636174696f6e20417574686f7269747930820222300d06092a864886f70d01010105000382020f003082020a028202010080126517360ec3db08b3d0ac570d76edcd27d34cad508361e2aa204d092d6409dcce899fcc3da9ecf6cfc1dcf1d3b1d67b3728112b47da39c6bc3a19b45fa6bd7d9da36342b676f2a93b2b91f8e26fd0ec162090093ee2e874c918b491d46264db7fa306f188186a90223cbcfe13f087147bf6e41f8ed4e451c61167460851cb8614543fbc33fe7e6c9cff169d18bd518e35a6a766c87267db2166b1d49b7803c0503ae8ccf0dcbc9e4cfeaf0596351f575ab7ffcef93db72cb6f654ddc8e7123a4dae4c8ab75c9ab4b7203dca7f2234ae7e3b68660144e7014e46539b3360f794be5337907343f332c353efdbaafe744e69c76b8c6093dec4c70cdfe132aecc933b517895678bee3d56fe0cd0690f1b0ff325266b336df76e47fa7343e57e0ea566b1297c3284635589c40dc19354301913acd37d37a7eb5d3a6c355cdb41d712daa9490bdfd8808a0993628eb566cf2588cd84b8b13fa4390fd9029eeb124c957cf36b05a95e1683ccb867e2e8139dcc5b82d34cb3ed5bffdee573ac233b2d00bf3555740949d849581a7f9236e651920ef3267d1c4d17bcc9ec4326d0bf415f40a94444f499e757879e501f5754a83efd74632fb1506509e658422e431a4cb4f0254759fa041e93d426464a5081b2debe78b7fc6715e1c957841e0f63d6e962bad65f552eea5cc62808042539b80e2ba9f24c971c073f0d52f5edef2f820f0203010001a3423040301d0603551d0e041604145379bf5aaa2b4acf5480e1d89bc09df2b20366cb300e0603551d0f0101ff040403020106300f0603551d130101ff040530030101ff300d06092a864886f70d01010c050003820201005cd47c0dcff7017d4199650c73c5529fcbf8cf99067f1bda43159f9e0255579614f1523c27879428ed1f3a0137a276fc5350c0849bc66b4eba8c214fa28e556291f36915d8bc88e3c4aa0bfdefa8e94b552a06206d55782919ee5f305c4b241155ff249a6e5e2a2bee0b4d9f7ff70138941495430709fb60a9ee1cab128ca09a5ea7986a596d8b3f08fbc8d145af18156490120f73282ec5e2244efc58ecf0f445fe22b3eb2f8ed2d9456105c1976fa876728f8b8c36afbf0d05ce718de6a66f1f6ca67162c5d8d083720cf16711890c9c134c7234dfbcd571dfaa71dde1b96c8c3c125d65dabd5712b6436bffe5de4d661151cf99aeec17b6e871918cde49fedd3571a21527941ccf61e326bb6fa36725215de6dd1d0b2e681b3b82afec836785d4985174b1b9998089ff7f78195c794a602e9240ae4c372a2cc9c762c80e5df7365bcae0252501b4dd1a079c77003fd0dcd5ec3dd4fabb3fcc85d66f7fa92ddfb902f7f5979ab535dac367b0874aa9289e238eff5c276be1b04ff307ee002ed45987cb524195eaf447d7ee6441557c8d590295dd629dc2b9ee5a287484a59bb790c70c07dff589367432d628c1b0b00be09c4cc31cd6fce369b54746812fa282abd3634470c48dff2d33baad8f7bb57088ae3e19cf4028d8fcc890bb5d9922f552e658c51f883143ee881dd7c68e3c436a1da718de7d3d16f162f9ca90a8fd terminal64.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\2B8F1B57330DBBA2D07A6C51F70EE90DDAB9AD8E\Blob = 0400000001000000100000001bfe69d191b71933a372a80fe155e5b50300000001000000140000002b8f1b57330dbba2d07a6c51f70ee90ddab9ad8e0b00000001000000100000005300650063007400690067006f0000001d0000000100000010000000885010358d29a38f059b028559c95f901400000001000000140000005379bf5aaa2b4acf5480e1d89bc09df2b20366cb620000000100000020000000e793c9b02fd8aa13e21c31228accb08119643b749c898964b1746d46c3d4cbd253000000010000004300000030413022060c2b06010401b231010201050130123010060a2b0601040182373c0101030200c0301b060567810c010330123010060a2b0601040182373c0101030200c0090000000100000054000000305206082b0601050507030206082b06010505070303060a2b0601040182370a030406082b0601050507030406082b0601050507030606082b0601050507030706082b0601050507030106082b060105050703080f000000010000003000000066b764a96581128168cf208e374dda479d54e311f32457f4aee0dbd2a6c8d171d531289e1cd22bfdbbd4cfd9796254832000000001000000e2050000308205de308203c6a003020102021001fd6d30fca3ca51a81bbc640e35032d300d06092a864886f70d01010c0500308188310b3009060355040613025553311330110603550408130a4e6577204a6572736579311430120603550407130b4a65727365792043697479311e301c060355040a131554686520555345525452555354204e6574776f726b312e302c06035504031325555345525472757374205253412043657274696669636174696f6e20417574686f72697479301e170d3130303230313030303030305a170d3338303131383233353935395a308188310b3009060355040613025553311330110603550408130a4e6577204a6572736579311430120603550407130b4a65727365792043697479311e301c060355040a131554686520555345525452555354204e6574776f726b312e302c06035504031325555345525472757374205253412043657274696669636174696f6e20417574686f7269747930820222300d06092a864886f70d01010105000382020f003082020a028202010080126517360ec3db08b3d0ac570d76edcd27d34cad508361e2aa204d092d6409dcce899fcc3da9ecf6cfc1dcf1d3b1d67b3728112b47da39c6bc3a19b45fa6bd7d9da36342b676f2a93b2b91f8e26fd0ec162090093ee2e874c918b491d46264db7fa306f188186a90223cbcfe13f087147bf6e41f8ed4e451c61167460851cb8614543fbc33fe7e6c9cff169d18bd518e35a6a766c87267db2166b1d49b7803c0503ae8ccf0dcbc9e4cfeaf0596351f575ab7ffcef93db72cb6f654ddc8e7123a4dae4c8ab75c9ab4b7203dca7f2234ae7e3b68660144e7014e46539b3360f794be5337907343f332c353efdbaafe744e69c76b8c6093dec4c70cdfe132aecc933b517895678bee3d56fe0cd0690f1b0ff325266b336df76e47fa7343e57e0ea566b1297c3284635589c40dc19354301913acd37d37a7eb5d3a6c355cdb41d712daa9490bdfd8808a0993628eb566cf2588cd84b8b13fa4390fd9029eeb124c957cf36b05a95e1683ccb867e2e8139dcc5b82d34cb3ed5bffdee573ac233b2d00bf3555740949d849581a7f9236e651920ef3267d1c4d17bcc9ec4326d0bf415f40a94444f499e757879e501f5754a83efd74632fb1506509e658422e431a4cb4f0254759fa041e93d426464a5081b2debe78b7fc6715e1c957841e0f63d6e962bad65f552eea5cc62808042539b80e2ba9f24c971c073f0d52f5edef2f820f0203010001a3423040301d0603551d0e041604145379bf5aaa2b4acf5480e1d89bc09df2b20366cb300e0603551d0f0101ff040403020106300f0603551d130101ff040530030101ff300d06092a864886f70d01010c050003820201005cd47c0dcff7017d4199650c73c5529fcbf8cf99067f1bda43159f9e0255579614f1523c27879428ed1f3a0137a276fc5350c0849bc66b4eba8c214fa28e556291f36915d8bc88e3c4aa0bfdefa8e94b552a06206d55782919ee5f305c4b241155ff249a6e5e2a2bee0b4d9f7ff70138941495430709fb60a9ee1cab128ca09a5ea7986a596d8b3f08fbc8d145af18156490120f73282ec5e2244efc58ecf0f445fe22b3eb2f8ed2d9456105c1976fa876728f8b8c36afbf0d05ce718de6a66f1f6ca67162c5d8d083720cf16711890c9c134c7234dfbcd571dfaa71dde1b96c8c3c125d65dabd5712b6436bffe5de4d661151cf99aeec17b6e871918cde49fedd3571a21527941ccf61e326bb6fa36725215de6dd1d0b2e681b3b82afec836785d4985174b1b9998089ff7f78195c794a602e9240ae4c372a2cc9c762c80e5df7365bcae0252501b4dd1a079c77003fd0dcd5ec3dd4fabb3fcc85d66f7fa92ddfb902f7f5979ab535dac367b0874aa9289e238eff5c276be1b04ff307ee002ed45987cb524195eaf447d7ee6441557c8d590295dd629dc2b9ee5a287484a59bb790c70c07dff589367432d628c1b0b00be09c4cc31cd6fce369b54746812fa282abd3634470c48dff2d33baad8f7bb57088ae3e19cf4028d8fcc890bb5d9922f552e658c51f883143ee881dd7c68e3c436a1da718de7d3d16f162f9ca90a8fd terminal64.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\91C6D6EE3E8AC86384E548C299295C756C817B81\Blob = 0f000000010000001400000085fef11b4f47fe3952f98301c9f98976fefee0ce7f000000010000002a000000302806082b0601050507030206082b0601050507030306082b0601050507030406082b0601050507030109000000010000002a000000302806082b0601050507030206082b0601050507030306082b0601050507030406082b0601050507030153000000010000002500000030233021060b6086480186f8450107300130123010060a2b0601040182373c0101030200c06200000001000000200000008d722f81a9c113c0791df136a2966db26c950a971db46b4199f4ea54b78bfb9f1400000001000000140000007b5b45cfafcecb7afd31921a6ab6f346eb5748501d00000001000000100000005b3b67000eeb80022e42605b6b3b72400b000000010000000e00000074006800610077007400650000007e000000010000000800000000c0032f2df8d60103000000010000001400000091c6d6ee3e8ac86384e548c299295c756c817b812000000001000000240400003082042030820308a0030201020210344ed55720d5edec49f42fce37db2b6d300d06092a864886f70d01010505003081a9310b300906035504061302555331153013060355040a130c7468617774652c20496e632e31283026060355040b131f43657274696669636174696f6e205365727669636573204469766973696f6e31383036060355040b132f2863292032303036207468617774652c20496e632e202d20466f7220617574686f72697a656420757365206f6e6c79311f301d06035504031316746861777465205072696d61727920526f6f74204341301e170d3036313131373030303030305a170d3336303731363233353935395a3081a9310b300906035504061302555331153013060355040a130c7468617774652c20496e632e31283026060355040b131f43657274696669636174696f6e205365727669636573204469766973696f6e31383036060355040b132f2863292032303036207468617774652c20496e632e202d20466f7220617574686f72697a656420757365206f6e6c79311f301d06035504031316746861777465205072696d61727920526f6f7420434130820122300d06092a864886f70d01010105000382010f003082010a0282010100aca0f0fb8059d49cc7a4cf9da159730910450c0d2c6e68f16c5b4868495937fc0b3319c2777fcc102d95341ce6eb4d09a71cd2b8c9973602b789d4245f06c0cc4494948d02626feb5add118d289a5c8490107a0dbd74662f6a38a0e2d55444eb1d079f07ba6feee9fd4e0b29f53e84a001f19cabf81c7e89a4e8a1d871650da3517beebcd222600db95b9ddfbafc515b0baf98b2e92ee904e86287de2bc8d74ec14c641eddcf8758ba4a4fca68071d1c9d4ac6d52f91cc7c71721cc5c067eb32fdc9925c94da85c09bbf537d2b09f48c9d911f976a52cbde0936a477d87b875044d53e6e2969fb3949261e09a5807b402debe82785c9fe61fd7ee67c971dd59d0203010001a3423040300f0603551d130101ff040530030101ff300e0603551d0f0101ff040403020106301d0603551d0e041604147b5b45cfafcecb7afd31921a6ab6f346eb574850300d06092a864886f70d010105050003820101007911c04bb391b6fcf0e967d40d6e45be55e893d2ce033fedda25b01d57cb1e3a76a04cec5076e864720ca4a9f1b88bd6d68784bb32e54111c077d9b3609deb1bd5d16e4444a9a601ec55621d77b85c8e48497c9c3b5711acad73378e2f785c906847d96060e6fc073d222017c4f716e9c4d872f9c8737cdf162f15a93efd6a27b6a1eb5aba981fd5e34d640a9d13c861baf5391c87bab8bd7b227ff6feac4079e5ac106f3d8f1b79768bc437b3211884e53600eb632099b9e9fe3304bb41c8c102f94463209e81ce42d3d63f2c76d3639c59dd8fa6e10ea02e41f72e9547cfbcfd33f3f60b617e7e912b8147c22730eea7105d378f5c392be404f07b8d568c68 cathayfutures5setup.exe -
Suspicious behavior: EnumeratesProcesses 64 IoCs
Processes:
CathayFXConfig.exeterminal64.exepid process 4492 CathayFXConfig.exe 4492 CathayFXConfig.exe 4492 CathayFXConfig.exe 4492 CathayFXConfig.exe 4492 CathayFXConfig.exe 4492 CathayFXConfig.exe 4492 CathayFXConfig.exe 4492 CathayFXConfig.exe 4492 CathayFXConfig.exe 4492 CathayFXConfig.exe 4492 CathayFXConfig.exe 4492 CathayFXConfig.exe 4492 CathayFXConfig.exe 4492 CathayFXConfig.exe 4492 CathayFXConfig.exe 4492 CathayFXConfig.exe 4492 CathayFXConfig.exe 4492 CathayFXConfig.exe 4492 CathayFXConfig.exe 4492 CathayFXConfig.exe 4492 CathayFXConfig.exe 4492 CathayFXConfig.exe 4492 CathayFXConfig.exe 4492 CathayFXConfig.exe 4492 CathayFXConfig.exe 4492 CathayFXConfig.exe 4492 CathayFXConfig.exe 4492 CathayFXConfig.exe 4492 CathayFXConfig.exe 4492 CathayFXConfig.exe 4492 CathayFXConfig.exe 4492 CathayFXConfig.exe 4492 CathayFXConfig.exe 4492 CathayFXConfig.exe 4492 CathayFXConfig.exe 4492 CathayFXConfig.exe 4492 CathayFXConfig.exe 4492 CathayFXConfig.exe 4492 CathayFXConfig.exe 4492 CathayFXConfig.exe 4492 CathayFXConfig.exe 4492 CathayFXConfig.exe 4492 CathayFXConfig.exe 4492 CathayFXConfig.exe 4492 CathayFXConfig.exe 4492 CathayFXConfig.exe 4492 CathayFXConfig.exe 4492 CathayFXConfig.exe 4492 CathayFXConfig.exe 4492 CathayFXConfig.exe 4492 CathayFXConfig.exe 4492 CathayFXConfig.exe 4492 CathayFXConfig.exe 4492 CathayFXConfig.exe 4492 CathayFXConfig.exe 4492 CathayFXConfig.exe 4492 CathayFXConfig.exe 652 terminal64.exe 652 terminal64.exe 4492 CathayFXConfig.exe 4492 CathayFXConfig.exe 4492 CathayFXConfig.exe 4492 CathayFXConfig.exe 4492 CathayFXConfig.exe -
Suspicious behavior: MapViewOfSection 2 IoCs
Processes:
MicrosoftEdgeCP.exepid process 3928 MicrosoftEdgeCP.exe 3928 MicrosoftEdgeCP.exe -
Suspicious use of AdjustPrivilegeToken 11 IoCs
Processes:
CathayFXConfig.exeMicrosoftEdge.exeMicrosoftEdgeCP.exeMicrosoftEdgeCP.exedescription pid process Token: SeDebugPrivilege 4492 CathayFXConfig.exe Token: SeDebugPrivilege 2884 MicrosoftEdge.exe Token: SeDebugPrivilege 2884 MicrosoftEdge.exe Token: SeDebugPrivilege 2884 MicrosoftEdge.exe Token: SeDebugPrivilege 2884 MicrosoftEdge.exe Token: SeDebugPrivilege 3716 MicrosoftEdgeCP.exe Token: SeDebugPrivilege 3716 MicrosoftEdgeCP.exe Token: SeDebugPrivilege 3716 MicrosoftEdgeCP.exe Token: SeDebugPrivilege 3716 MicrosoftEdgeCP.exe Token: SeDebugPrivilege 4840 MicrosoftEdgeCP.exe Token: SeDebugPrivilege 4840 MicrosoftEdgeCP.exe -
Suspicious use of SetWindowsHookEx 52 IoCs
Processes:
terminal64.exeMicrosoftEdge.exeterminal64.exeMicrosoftEdgeCP.exemetaeditor64.exepid process 652 terminal64.exe 2884 MicrosoftEdge.exe 8 terminal64.exe 8 terminal64.exe 8 terminal64.exe 8 terminal64.exe 8 terminal64.exe 8 terminal64.exe 8 terminal64.exe 8 terminal64.exe 8 terminal64.exe 8 terminal64.exe 8 terminal64.exe 8 terminal64.exe 8 terminal64.exe 8 terminal64.exe 8 terminal64.exe 8 terminal64.exe 8 terminal64.exe 8 terminal64.exe 8 terminal64.exe 8 terminal64.exe 8 terminal64.exe 8 terminal64.exe 8 terminal64.exe 8 terminal64.exe 8 terminal64.exe 8 terminal64.exe 8 terminal64.exe 8 terminal64.exe 8 terminal64.exe 8 terminal64.exe 8 terminal64.exe 8 terminal64.exe 8 terminal64.exe 8 terminal64.exe 8 terminal64.exe 8 terminal64.exe 8 terminal64.exe 8 terminal64.exe 8 terminal64.exe 8 terminal64.exe 8 terminal64.exe 8 terminal64.exe 8 terminal64.exe 8 terminal64.exe 8 terminal64.exe 8 terminal64.exe 3928 MicrosoftEdgeCP.exe 8 terminal64.exe 4680 metaeditor64.exe 3928 MicrosoftEdgeCP.exe -
Suspicious use of WriteProcessMemory 18 IoCs
Processes:
a8d746ad75f60881430ff0fd0f8f51e8e013953113811a0ed4cd944fdbd09330.execathayfutures5setup.exeexplorer.exeterminal64.exeMicrosoftEdgeCP.exedescription pid process target process PID 4052 wrote to memory of 4492 4052 a8d746ad75f60881430ff0fd0f8f51e8e013953113811a0ed4cd944fdbd09330.exe CathayFXConfig.exe PID 4052 wrote to memory of 4492 4052 a8d746ad75f60881430ff0fd0f8f51e8e013953113811a0ed4cd944fdbd09330.exe CathayFXConfig.exe PID 4052 wrote to memory of 4248 4052 a8d746ad75f60881430ff0fd0f8f51e8e013953113811a0ed4cd944fdbd09330.exe cathayfutures5setup.exe PID 4052 wrote to memory of 4248 4052 a8d746ad75f60881430ff0fd0f8f51e8e013953113811a0ed4cd944fdbd09330.exe cathayfutures5setup.exe PID 4248 wrote to memory of 652 4248 cathayfutures5setup.exe terminal64.exe PID 4248 wrote to memory of 652 4248 cathayfutures5setup.exe terminal64.exe PID 4248 wrote to memory of 4820 4248 cathayfutures5setup.exe explorer.exe PID 4248 wrote to memory of 4820 4248 cathayfutures5setup.exe explorer.exe PID 656 wrote to memory of 8 656 explorer.exe terminal64.exe PID 656 wrote to memory of 8 656 explorer.exe terminal64.exe PID 8 wrote to memory of 4680 8 terminal64.exe metaeditor64.exe PID 8 wrote to memory of 4680 8 terminal64.exe metaeditor64.exe PID 3928 wrote to memory of 912 3928 MicrosoftEdgeCP.exe MicrosoftEdgeCP.exe PID 3928 wrote to memory of 912 3928 MicrosoftEdgeCP.exe MicrosoftEdgeCP.exe PID 3928 wrote to memory of 912 3928 MicrosoftEdgeCP.exe MicrosoftEdgeCP.exe PID 3928 wrote to memory of 912 3928 MicrosoftEdgeCP.exe MicrosoftEdgeCP.exe PID 3928 wrote to memory of 912 3928 MicrosoftEdgeCP.exe MicrosoftEdgeCP.exe PID 3928 wrote to memory of 912 3928 MicrosoftEdgeCP.exe MicrosoftEdgeCP.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\a8d746ad75f60881430ff0fd0f8f51e8e013953113811a0ed4cd944fdbd09330.exe"C:\Users\Admin\AppData\Local\Temp\a8d746ad75f60881430ff0fd0f8f51e8e013953113811a0ed4cd944fdbd09330.exe"1⤵
- Suspicious use of WriteProcessMemory
-
C:\Program Files (x86)\CathayFutures_FX\CathayFXConfig.exe"C:\Program Files (x86)\CathayFutures_FX\CathayFXConfig.exe"2⤵
- Drops file in Drivers directory
- Executes dropped EXE
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Program Files (x86)\CathayFutures_FX\cathayfutures5setup.exe"C:\Program Files (x86)\CathayFutures_FX\cathayfutures5setup.exe"2⤵
- Checks BIOS information in registry
- Checks computer location settings
- Executes dropped EXE
- Writes to the Master Boot Record (MBR)
- Drops file in Program Files directory
- Checks processor information in registry
- Enumerates system info in registry
- Modifies system certificate store
- Suspicious use of WriteProcessMemory
-
C:\Program Files\Cathay Futures\terminal64.exe"C:\Program Files\Cathay Futures\terminal64.exe" /install3⤵
- Checks BIOS information in registry
- Executes dropped EXE
- Checks whether UAC is enabled
- Writes to the Master Boot Record (MBR)
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Enumerates system info in registry
- Modifies Internet Explorer settings
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
-
C:\Windows\explorer.exe"C:\Windows\explorer.exe" "C:\Program Files\Cathay Futures\terminal64.exe"3⤵
-
C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdge.exe"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdge.exe" -ServerName:MicrosoftEdge.AppXdnhjhccw3zf0j06tkg3jtqr00qdm0khc.mca1⤵
- Drops file in Windows directory
- Modifies Internet Explorer settings
- Modifies registry class
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
-
C:\Windows\system32\browser_broker.exeC:\Windows\system32\browser_broker.exe -Embedding1⤵
- Modifies Internet Explorer settings
-
C:\Windows\explorer.exeC:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding1⤵
- Suspicious use of WriteProcessMemory
-
C:\Program Files\Cathay Futures\terminal64.exe"C:\Program Files\Cathay Futures\terminal64.exe"2⤵
- Checks BIOS information in registry
- Checks computer location settings
- Executes dropped EXE
- Checks whether UAC is enabled
- Writes to the Master Boot Record (MBR)
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Drops file in Program Files directory
- Checks processor information in registry
- Enumerates system info in registry
- Modifies system certificate store
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Program Files\Cathay Futures\metaeditor64.exe"C:\Program Files\Cathay Futures\metaeditor64.exe" /portable /compile:"C:\Program Files\Cathay Futures\MQL5" /inc:"C:\Program Files\Cathay Futures\MQL5" /time:0 /flg:0 /stop:se3968_2406258753⤵
- Executes dropped EXE
- Writes to the Master Boot Record (MBR)
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious use of SetWindowsHookEx
-
C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca1⤵
- Modifies registry class
- Suspicious behavior: MapViewOfSection
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca1⤵
- Drops file in Windows directory
- Modifies Internet Explorer settings
- Modifies registry class
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca1⤵
- Modifies registry class
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca1⤵
- Drops file in Windows directory
- Modifies registry class
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Program Files (x86)\CathayFutures_FX\CathayFXConfig.exeFilesize
13KB
MD53cc551c34d632e97a738654da88b6a6f
SHA1002fbcc1431d19373bc5e374fa0b4faae4d635e8
SHA256f513bcd0af5ea53dd6b5261fb7d0b1e5680093a852a8ffad724ac2c42b8852a2
SHA5125feed9524313982a04f412444e830d40a649d1755622a30218f4f9fb072b69e3bcc88b0e42716031f027ba205d35ab14665143864595ae1e93f82d9459413c21
-
C:\Program Files (x86)\CathayFutures_FX\CathayFXConfig.exeFilesize
13KB
MD53cc551c34d632e97a738654da88b6a6f
SHA1002fbcc1431d19373bc5e374fa0b4faae4d635e8
SHA256f513bcd0af5ea53dd6b5261fb7d0b1e5680093a852a8ffad724ac2c42b8852a2
SHA5125feed9524313982a04f412444e830d40a649d1755622a30218f4f9fb072b69e3bcc88b0e42716031f027ba205d35ab14665143864595ae1e93f82d9459413c21
-
C:\Program Files (x86)\CathayFutures_FX\cathayfutures5setup.exeFilesize
3.2MB
MD5040ea631816d4e633dcd474234166afc
SHA168fa6b03207d1c309227d1c6ee3a139110dd0f67
SHA2569aeed6e78d292d03eb09c8ade57ef76043281782c2862b063116b2aecf3b1b3b
SHA512b1cf28e2ebdfa4ab84d914bb17a5548287193af192ce7d1be4f23126ba86c6e465cd6773788dbf3e6496ed0d37b208a843facfa68ecc1d1454116c1c6099759f
-
C:\Program Files (x86)\CathayFutures_FX\cathayfutures5setup.exeFilesize
3.2MB
MD5040ea631816d4e633dcd474234166afc
SHA168fa6b03207d1c309227d1c6ee3a139110dd0f67
SHA2569aeed6e78d292d03eb09c8ade57ef76043281782c2862b063116b2aecf3b1b3b
SHA512b1cf28e2ebdfa4ab84d914bb17a5548287193af192ce7d1be4f23126ba86c6e465cd6773788dbf3e6496ed0d37b208a843facfa68ecc1d1454116c1c6099759f
-
C:\Program Files\Cathay Futures\Bases\Default\Mail\mail-0.datFilesize
22KB
MD5df4a0e5b0426d748663ff0eb62e027e8
SHA158097fc2b01bc0f089dbf912b8c7d3e63989bd54
SHA256877d26ee9467425272f7d80aa94d5c63b2c09f5f2a2d4f14c83579e4a567fbcf
SHA5125d6a245c90e0273a9a63cfd9b2f69ac8f14809c3b214fc772732e280ad3e2160b6168df6d8e7b9475082faa1388823ae2b3a84cc7dde22775c182c2ff03ee442
-
C:\Program Files\Cathay Futures\Bases\Default\mail\1.welcome.english.welcomeFilesize
10KB
MD50e91b8022d0831e85836f7e0a037ffd8
SHA1684fe5d6dccabd0845929137aab92d8d4dbc9bd1
SHA256f37218b1a6c40fdbbf5dae0d3fac2aa8476ef693550c1f977880cdc5e7e99e2b
SHA512355e87ff9fdfd3b71bf37e2722a1421fd8352d8726856a2d5579c4c77aff95111bb7cd34a40dd43f007440bd834c53fdcdabcafea0f771458f764497d232288b
-
C:\Program Files\Cathay Futures\Bases\Default\mail\2.signals.english.welcomeFilesize
8KB
MD534fa0ab9072cf6ab1fafe19899a5b537
SHA14367430bac684dfe5bf542ca0d5a403dba759eec
SHA256606facecb2d62b921e69e3ca0e6f078b086162bbe5f2f84062aff44de22f1c9c
SHA5122c6dd2b9460f4abc405f4476d5bed8e67cf8d59d21075deaceac5df4c61fffeb7f90dcaf350ef054fcc75c28dc130f1189ff43c065d3fa66b640fc6332e324ee
-
C:\Program Files\Cathay Futures\Bases\Default\mail\3.market.english.welcomeFilesize
8KB
MD5e127a5f0fc6f6075239024a2331bdb9c
SHA1ca5da0d65e15aa080bf97870b3e0ef3b8b16eb37
SHA256d4f18c75a42bb37af1c048a6917ed2d407bf30f5693c5ddff76193b8256a846b
SHA512802b33f8663dfaa8bddec7c4c2be0ca75bc309e2bef5f2984af8885ecd20392d52fcf4add32ddc9c97614fa63b2cc5d2f08f23969f9e2abbd52ae995952c10b4
-
C:\Program Files\Cathay Futures\Bases\Default\mail\4.mobile.english.welcomeFilesize
8KB
MD5ac4df097a953b04a6070fcf5e373dd46
SHA1f8f868e6b765350a4faea6991e046a10fb0ccfe2
SHA256a78107df49d95e8727fc8482711d217cd4930533571c2f9777b866c60f631ea4
SHA5128174b483c61690eb0ae623bdfb94f1431c693675effc662ca83e1f047d03fa3b6738175793b1981011d30d47770a17e6d401a1d6a591d51eddcc93c3e9acd2d9
-
C:\Program Files\Cathay Futures\Bases\Default\mail\5.freelance.english.welcomeFilesize
8KB
MD57f3cd66e5646b6ca3a953291d95e2829
SHA1b5dc498474b0fb06568b0bba7b73012a40368056
SHA256ecba047f70b7e741e1b6e8d95894953f1f9676f3eef45c76b0db2850d4dae19d
SHA51215b9b2686ae5d33027cf4e0fd54514a2e146248b7c2b7f956bba328b7f91c13c1131087be370b5e6ed5a4736283bbb0217f7176d2b830e0bd8a4996390e40233
-
C:\Program Files\Cathay Futures\Bases\Default\mail\6.virtualhosting.english.welcomeFilesize
9KB
MD5710186c29dc07cea41f274fb2ac296de
SHA19f98ebe4f05847f1d38f5e3e68eb3555401e2325
SHA256cbb50ea59ec71285dab14d71392b3ed807a13660e21496627cc6da0878b5d2be
SHA512accfdd68e63b723693192709743e8694f1a9c19006598b6dbe482c4a8cd3ea36d531c2fe84a2f8f6b56cba5a51e4c1876ca02e34244e2783bfeed9f556e7e6bf
-
C:\Program Files\Cathay Futures\Bases\Default\mail\7.risk-warning.english.welcomeFilesize
9KB
MD559f014c5c4de767f5ee2ebca8f38c105
SHA1cff6228b59c398c2c728e16904fbba413917a5cb
SHA2564e7f56e2e8e3862859d6cece476130f8b517caa98098960f3abe96ef75e07afe
SHA51217e3f8bdfc953ffa99bb006c5b76a5e2da24743fcaff2d50b186d32c2d2edaf1693793d1a08b05e0c603d9ff2cedf524cb58bf58a06abbba232166a811ab9fbc
-
C:\Program Files\Cathay Futures\Config\common.iniFilesize
141B
MD586c0f2b74e3ef99e27c26b4b4344c8c5
SHA1697a01192363f5203a1448f83dcdb7be65b6a127
SHA2569a865086f45617875c1913aa86b01290b4484d89525c94c99c258e1172c03888
SHA512aa811b0b9735a70f86cca72e3ace0970243e13e9e89aec9e3a2393fc0d7f2dc0ed26cf436501ce135c4a4b238e945bd046ed1b6c622c953c50768f8493bdc8cf
-
C:\Program Files\Cathay Futures\Config\common.iniFilesize
141B
MD586c0f2b74e3ef99e27c26b4b4344c8c5
SHA1697a01192363f5203a1448f83dcdb7be65b6a127
SHA2569a865086f45617875c1913aa86b01290b4484d89525c94c99c258e1172c03888
SHA512aa811b0b9735a70f86cca72e3ace0970243e13e9e89aec9e3a2393fc0d7f2dc0ed26cf436501ce135c4a4b238e945bd046ed1b6c622c953c50768f8493bdc8cf
-
C:\Program Files\Cathay Futures\Config\common.iniFilesize
313B
MD50b619f79623e6d2c3348145df8593142
SHA1cea36dda113253fd8555b59718aa9226e9679347
SHA256b73419d6cf359ffa1fdf5225316d100d1163c7794cd8908e2dcf20d77c5a4434
SHA5128ea99be60ef7d3e48430289977e91e675d5c4bcaa5b8ec0b8208fbbfdac7f806e5f48a6b9afb899f3b15cd45b51e2f7f417f5eb8a120bb73475ee0b5811211cb
-
C:\Program Files\Cathay Futures\Config\common.iniFilesize
313B
MD50b619f79623e6d2c3348145df8593142
SHA1cea36dda113253fd8555b59718aa9226e9679347
SHA256b73419d6cf359ffa1fdf5225316d100d1163c7794cd8908e2dcf20d77c5a4434
SHA5128ea99be60ef7d3e48430289977e91e675d5c4bcaa5b8ec0b8208fbbfdac7f806e5f48a6b9afb899f3b15cd45b51e2f7f417f5eb8a120bb73475ee0b5811211cb
-
C:\Program Files\Cathay Futures\Config\common.iniFilesize
31B
MD5a07c893edfc444988c21c4e8f5e653ab
SHA17d87a9c768c456b58e3e1575aabd6ea1007cc714
SHA256f3463f5d061c04205d9db6a058cef55500a21ad20cfeff463509edfef16109e9
SHA512d50f1d6d5212a64c8a498b3773910ff091cc74e8a42da92ee67bf13c2c69d14c118d4cff5ab6bf4de22e82085b74b386ec56f42acff79e0bf83b7b947779d598
-
C:\Program Files\Cathay Futures\Config\terminal.iniFilesize
8KB
MD50cac4277f4ef75427aa3c378bab815c3
SHA137eca0d859bbbc3fd32e822e15a0824600a119cf
SHA256bf6053e823a54dc57a14499a2255a3d931b60890d99c05e5f80b68b7464519c4
SHA512adec56cc43116dc51f8c1db81a02decebc0ffb541b89b1a46019c5b99a5c4c24fc9d06747fb323f100d89a78a49751f0c3f64288e6f9a913e061f43ae9e35b51
-
C:\Program Files\Cathay Futures\Config\terminal.iniFilesize
8KB
MD509ac1d8715a768f045ca2b5d3c9d4903
SHA1682cb18f74c44368bf7172b895c3c1621ab09c23
SHA25619f86b4f08920156026c24a6fe0c6042c08e99227fc16f6e02df35bd03957466
SHA51274c66d162db643021c69c4cd6b0dd8eb5a55c84079b2ac7ee0a59b615c86488da0cddc74083d0ff5eedf17c1ec735fc7371cdb1e59345415476d602571cbb871
-
C:\Program Files\Cathay Futures\MQL5\Experts\Advisors\ExpertMACD.mq5Filesize
5KB
MD51771d966f1694a6c020c68a81d8c5d19
SHA12a844e5a5b2f6c43078a7b23cad60cefa4d21b12
SHA25628df02cb227d11fc65b8be6605348350fdd076879b5b462f94459f77cbc91534
SHA512fd3db5c20c08db2134d9a336e2e5bbbde44d0ca404a60463afd3f068a0c1caba2a27f9bd6878d2e79181386ea7a70d3b12d531a9b62d3b7a0ffe36df1f731aec
-
C:\Program Files\Cathay Futures\MQL5\Include\Expert\Expert.mqhFilesize
119KB
MD5baee1334a7508a92c31929ad633486d2
SHA1af33a85c109ee76259e23f11951f5081ffc0396a
SHA25623a2ee06d0cee8f7722a8734b602b50f3911472c822e8f2478ad941d5ed37433
SHA5128268b99626c12059c66e9bab389dec2eab109b5fa179ba7da4a78923e308ade30f1d8ce3bbc2eba343a8b08f731f346639817f9905dd71fb511868f795ed6069
-
C:\Program Files\Cathay Futures\MQL5\Include\Expert\ExpertBase.mqhFilesize
26KB
MD52dd2adb5767ba6688d90468140708a7b
SHA15fecfb7ef5ac46884150bf735e9eaaf08c8fa29d
SHA256601168c3e392265bd7ffed132d3c0733c37047a8b7a733195d543c41a48ef600
SHA51252777851274a7a341b4d179673eaa23e7a680f65b64a1b441365b6519b75cc3575bb460f1701268dc0ba688a351596da276b58bae528ff403cf12cac570e405c
-
C:\Program Files\Cathay Futures\MQL5\Include\Object.mqhFilesize
1KB
MD542157e351ee3a0bb23477efb72e7d679
SHA158a05018124b41b1ebd54de4aa1b5b58f34bbb84
SHA25656de3babb195fa1f2f84d6d7b06ebc49817629ace43a290a8f3b5c0db1febb1c
SHA512c0b8412c8e5fe1ccf2647a301519ff68e2eb294ca4b5b45a0a1651eebea021eb367447b293bcb55fae0605537195e06a42f31e4289f2d009e507f74fcba96556
-
C:\Program Files\Cathay Futures\MQL5\Include\StdLibErr.mqhFilesize
683B
MD5ff36fb91ea81e0f885e624f5283f7888
SHA1af55cf3b9cea49fc60fa91faf20fe1d208739e7b
SHA2569ba8633e9a42a39c448d1a35ec82dfb09948cc17223291b7f3cccf4e04a33f40
SHA5124cc9a1338fc885b22a1831c7a43009e341638f383db87d28e350a4ff70df01f93421f1d3e052fde694be4942df88a7fbac7c2ca87e80b9394bb7ca4258bd52ab
-
C:\Program Files\Cathay Futures\MQL5\Include\Trade\AccountInfo.mqhFilesize
17KB
MD572b256a8db4805c637e7b4ff01bdc05a
SHA1ec006fa5408f23c992a5307e21ba32f3208cdcdf
SHA2569902714607922dc9707bd89e6c174c982798ec0f2755b5e5ecf10538fb4cd537
SHA5123ba7b43dc5fc78c282490e33a0cce2048b4226b2888d8624a1b5476b615d6b8fd7ce3a434aa45282b912bb3f75e5fc974d87efc4979de1250221d3eff01e6c5e
-
C:\Program Files\Cathay Futures\MQL5\Include\Trade\OrderInfo.mqhFilesize
21KB
MD51f4134f4ae60518ce9a7cc9ca59dc45b
SHA1a7aa7cfd9faae700c641e0fdf916c6bb6e227d77
SHA256a9096de28ca2d5a636a299b2243095ac6228a9fdea4a47e86220fc9226a168c5
SHA5123e1819ef489101b8d290a95cee94b694591ecc7ca99430f7914b9b0d08da6d85e3a3eb0908d162c69992044022238507ef859511d09d1696ba245a2436355159
-
C:\Program Files\Cathay Futures\MQL5\Include\Trade\PositionInfo.mqhFilesize
15KB
MD5d00ba9d219e9bbf574afd3531ef1cf28
SHA13712226979ac3fad1f7c114d81c59eac26443826
SHA25694ef45350a78814be095b4a0d425f7a72ffd3993f0f6db1e38e4a4ede1075ca6
SHA512909f3f867c5d797a835188e0c289aed67392ffd1727d80a87689b36bc3d6e06434660843cbb25c197d9ef09fed6fee834fc427a90257c3248a98e32dc910b0ad
-
C:\Program Files\Cathay Futures\MQL5\Include\Trade\SymbolInfo.mqhFilesize
35KB
MD57e63e7c80e9b74b108ad6509d573eaeb
SHA13dd78a1f266e8b6b366db3025e19235e5ce37423
SHA256faef9815da8557d8c3802591e9d7e15aba388e759329059748425289facec84a
SHA512865ee71920ffee328913c70919b29244a6b8ba2f2203fe3c6b11ab324a0b8f7bbdba5c4f4d3897430fcac9760fb6c62a6821ff44686d84d85edc43aa89a05f9a
-
C:\Program Files\Cathay Futures\MetaEditor64.exeFilesize
49.2MB
MD573dc6f7e5e2a8b01971566274b9b432a
SHA156128b7c3268f6430b0b9b5699c9c8eaade17d50
SHA2561e3ab1d8ecc1f53c0003a9e424fdd26cd956963a782daefc7c2ca969e403d196
SHA512c27b229eeadbfbbcfc3803897da3b02378f90f346b9da9b0b6df930df644a013242a072e8ce4ef5e7013abfe4107eb1a72a7e39f7bd4e632719abd146fe2c559
-
C:\Program Files\Cathay Futures\MetaEditor64.exeFilesize
49.2MB
MD573dc6f7e5e2a8b01971566274b9b432a
SHA156128b7c3268f6430b0b9b5699c9c8eaade17d50
SHA2561e3ab1d8ecc1f53c0003a9e424fdd26cd956963a782daefc7c2ca969e403d196
SHA512c27b229eeadbfbbcfc3803897da3b02378f90f346b9da9b0b6df930df644a013242a072e8ce4ef5e7013abfe4107eb1a72a7e39f7bd4e632719abd146fe2c559
-
C:\Program Files\Cathay Futures\bases\Default\symbols\selected-0.datFilesize
11KB
MD56d74ab180772ab01acef226aa2a63de0
SHA1bf2c86e38e4897b88d54185394ca68f6525ae8cc
SHA256445de0cfefb1376ea7e7dea0dc7f7d2473214b177159ddd5de8aa3230e9d73fb
SHA51256b7bc75ef4f978df0a25f3bcbb8fe1965d85c00ecf0753ff7828cc7468ce55f5a5acba5dd2441843e78ba4ce1542903389e60884c25f4f26a96504f3a9ed7d9
-
C:\Program Files\Cathay Futures\bases\Default\symbols\symbols-0.datFilesize
24KB
MD5c9688f0b21a99019600ed62a855d0516
SHA1096b1a329f6bf6ed63027af974827e749e5aa564
SHA256cbfdb00cb0793b2c54efa316cea61b0b2bb12adaf3875ee0cfdba8e56c7d3003
SHA5124c2f57e5ca1921906484757ad4c7d9e95d11937b1159bb3cb2e251164980ecef28d7338c70ff86a4d12adfe264a482ebde625a7152b33682874d500c1c43b527
-
C:\Program Files\Cathay Futures\config\common.iniFilesize
141B
MD586c0f2b74e3ef99e27c26b4b4344c8c5
SHA1697a01192363f5203a1448f83dcdb7be65b6a127
SHA2569a865086f45617875c1913aa86b01290b4484d89525c94c99c258e1172c03888
SHA512aa811b0b9735a70f86cca72e3ace0970243e13e9e89aec9e3a2393fc0d7f2dc0ed26cf436501ce135c4a4b238e945bd046ed1b6c622c953c50768f8493bdc8cf
-
C:\Program Files\Cathay Futures\config\common.iniFilesize
313B
MD50b619f79623e6d2c3348145df8593142
SHA1cea36dda113253fd8555b59718aa9226e9679347
SHA256b73419d6cf359ffa1fdf5225316d100d1163c7794cd8908e2dcf20d77c5a4434
SHA5128ea99be60ef7d3e48430289977e91e675d5c4bcaa5b8ec0b8208fbbfdac7f806e5f48a6b9afb899f3b15cd45b51e2f7f417f5eb8a120bb73475ee0b5811211cb
-
C:\Program Files\Cathay Futures\config\servers.datFilesize
2KB
MD59da5adad35cc87188b21e26f22ba1ae9
SHA1dea5c8796ccc46bafa55958c1cf031dc5baf823e
SHA25621883b264184a46a6d61d7dcda535607ad88a394d31891143b825698d88e768a
SHA51200fc7bb17dbc0862c657cefcabc2594b387e0bcf28fb2d084c78bf1823d0a3378c5e1767481caf782e745fe94f60731def761bd6cebf6a65fbab1409dace180c
-
C:\Program Files\Cathay Futures\config\settings.iniFilesize
5KB
MD59c939c065eeccaf69a913d8568111877
SHA1034d7ada071c811e45f2a79aa467fd638d2d5039
SHA25695818cbb32bda3acb776ce177f462762455c3d8a87b2d3ab0c9820cc6ba84bf2
SHA512b2f5cf63579b0d37b63633fc473840da7bd10160609b209bbd9b178ab61c307a93d5e536689fe99003debd1b70f39e2e745cb7d7a590c6b131fe46de894905a2
-
C:\Program Files\Cathay Futures\config\terminal.licFilesize
21KB
MD5c1181d52fc235d76a22a9d472d5aa921
SHA19d644074c371dc3a91287309a58339d97cb1b518
SHA2565adc64dc11352c494c4198a3766481d9867584e4cd78279cb06d6d9e5eeb7c7b
SHA512e6e926c14b3248a32ab78efaa5ffaccd5ae60a73e8b61d5744b2b11d8ab681b6c0315d8cd870184fe4324175c9d3396bb86102d71eeabd7e5ca1cf27b1daeca8
-
C:\Program Files\Cathay Futures\logs\20230324.logFilesize
440B
MD5ac92dde308b381595a79ba36b2e1ec61
SHA1b05363167258fe185d63d092f8b0984e5d912772
SHA25620b6deebec8d10a70a6c89a79e82aac2271c1823bb14dad778c8d4d199ba256b
SHA5128d763f591c163d25422964f59694bded13e9c03abc67c8cb070824d66c4e5875d4dee318679a8d75d03af358a52f64c739ccc4d945299e73bf134cde7e9f5d8f
-
C:\Program Files\Cathay Futures\metaeditor64.exeFilesize
49.2MB
MD573dc6f7e5e2a8b01971566274b9b432a
SHA156128b7c3268f6430b0b9b5699c9c8eaade17d50
SHA2561e3ab1d8ecc1f53c0003a9e424fdd26cd956963a782daefc7c2ca969e403d196
SHA512c27b229eeadbfbbcfc3803897da3b02378f90f346b9da9b0b6df930df644a013242a072e8ce4ef5e7013abfe4107eb1a72a7e39f7bd4e632719abd146fe2c559
-
C:\Program Files\Cathay Futures\metatester64.exeFilesize
25.2MB
MD5ca2d94e858b1bd70d2779f05e05ee7f2
SHA1031e371f2cb453fcc19b8a5c4fe7c8d94b613562
SHA256f11017b14a4f384e91bec1afa35b9273cc7b7e6b519c483f4ae6c034fd843af7
SHA5120edd3773edc3a48ba841a451bfeb05b9b309664cc93de552b7e4fd2a35c8da327af068a4f957d5975ec642f95b530f43e7b5a15f2677c7b188100022184b5dae
-
C:\Program Files\Cathay Futures\profiles\Charts\British Pound\chart01.chrFilesize
4KB
MD5b2cfa6007c87e8d2a840ca0f0e77ac33
SHA148e343fa5924c1561390ba8f79ac46371f53c3f5
SHA256074c0cdb0d67bb4f343ba87e605124cc097016f77afc3e208f5765bcb8788906
SHA5127d6536d329e91ca58347885a5244d408deb2ce604cbc09a9c691ab35f02cbc49923e7cd1a5122bbe78d5bd8d8261428a9eee5ad1e3743f1ad8a9e3bcb7ec2b30
-
C:\Program Files\Cathay Futures\profiles\Charts\British Pound\chart02.chrFilesize
4KB
MD531c047d58884c871c2e1252fa927532d
SHA18dcd59b06b0488f9d4e7d056e82180b619f75f8d
SHA25662f347bfa85e9d8974a5bf0c8feb81f7cf8a5757be3fef5190c4ced757256aff
SHA512e281466a544b4c6415f501249d18142cd35936339f475bd64b10275d94824c8fa6f7def82487ca0f2d570b4efc9d01bf3b1e6fa963419df65fc3bced29de7ae4
-
C:\Program Files\Cathay Futures\profiles\Charts\British Pound\chart03.chrFilesize
4KB
MD5112922787ad3fa848865605831b81884
SHA1e445f0bdbb629ebf34499a516c43562cc12c857f
SHA25691ef37d31e90242d34c5844b42c6d50214efa91f402268be5462028f52d356b2
SHA512e28db5da3b6c1e0a4880795a61cff8efee568e96d609e1e118d361deadc4169001767d9167abdb649a5cbaa7e7c277460e8a8df7017506dd0ec97429c58e1c44
-
C:\Program Files\Cathay Futures\profiles\Charts\British Pound\chart04.chrFilesize
4KB
MD511ee1f515055e93f0e810f5228050b36
SHA1ec151685a379dfe8531a230beeeb679f2f9a9920
SHA256c86795c22143cb9bf82790233cceba70ae966c2a9ca0f679634ac4cdb847d32c
SHA5122a36ae76c37dda43339a43dd951d7df6580a2bf369531518cf69a48fcfce3ba59005e3d0921b4e6e65cd09ea3854ec223d66a5dffeb10761764dbcc6aa62d2a7
-
C:\Program Files\Cathay Futures\profiles\Charts\British Pound\order.wndFilesize
106B
MD5e6b06f612a351deaa8cda0836b25a4ce
SHA14739f8cecd1d075689730cfbc9140b13681832ff
SHA256bb2aae933928e009b82803d3ce2a3aa464861cf5c51e9a9af1cb25fc5923ee11
SHA5121f7a5c137fea0cd56b2c5676b6a038c15795f09fdff5efd50d9ed11ea102517fd4d5df5d7f1aedf2ecdd3e2a92e459b640f57eecaa5150ee759026aff273ab39
-
C:\Program Files\Cathay Futures\profiles\Charts\Default\chart01.chrFilesize
2KB
MD5cbcb207b4eca61983c2bc6be8fa2cb6b
SHA1a7c6fda5154230e176b2efd94078dc8e4b2c97f5
SHA256ecd135cab470d4a90979027d44b73ad512039187fd19ed69ff7372a52b27b766
SHA51200db4573d986f7ffacc792ea28d5c548a14c9eff85b33722c144b6dba1b41af50e7cbbd33b25bb8536ed40716c70421112d4a0b9c394f7759e6aaf9287d769a2
-
C:\Program Files\Cathay Futures\profiles\Charts\Default\chart02.chrFilesize
2KB
MD5c6dbfbb29c324c008696d1f044042bd4
SHA1d9e2f67944be3a6b904c6a66599eb13ba34199a0
SHA256dae31e1135021dfb18e71fa94dd42c7c4a231a302238db84e36afeb8d1eec08b
SHA512449cc241f5f480b38e89a6e84b9611f338d279952195a3a7805ed0eb30e922eabdfa1ea7b4466680e88f173a808d45b50d1e99e076267cde1a0471533ab5c0fd
-
C:\Program Files\Cathay Futures\profiles\Charts\Default\chart03.chrFilesize
3KB
MD5c83dff4b48cd69721ae542f1deb6bef3
SHA1edc884426ebdc9f7cab0d046b0547b80ebfbba63
SHA2567b341556d2e6d41c34583479d01bc6142c97b740fd205409f88c9a7eeca12e4f
SHA512448df704047cb145d3b91e8cb5a2cc4f6f65f26cd943ee23c28e489435b781f6c1c37ebbe53f75a97129a808cd1ed0332e788e38d646852b2c682006ac589d7c
-
C:\Program Files\Cathay Futures\profiles\Charts\Default\chart04.chrFilesize
2KB
MD510b587d941321e1ca2b37027d96adbdd
SHA1284e2b33c5d953d9449ad380969e09d7a42ec08b
SHA2565b99490c026f03727d529803079d5457bfbf02573f880e334fb8191e45c7a8b0
SHA512f774d21cde508076a53d28b3357ff9ae622b3171b08b85e918a83c87e29b18d3b2f4ff6f092bbc351f9132d0fa4d3ccff2ed2a61b6ff0640c7a80d94d82433e4
-
C:\Program Files\Cathay Futures\profiles\Charts\Default\order.wndFilesize
106B
MD571cf7ef63820a018a5fe3eeb974a64b4
SHA17bb5057c3d259da7f59d3cce99ac5bd44fde097d
SHA25651b82b4d0db003a43f32b8719e50a0412b55efe52887b7df76d7a27a0703244d
SHA5120452e3659fd9f1cc557ed9c4633c7cace04ea3dbeac098def8a97db38a91a1e858327fd009245e10e8ed25baa65885c03636f29a085a605c2d44da1fc201a507
-
C:\Program Files\Cathay Futures\profiles\Charts\Euro\chart01.chrFilesize
4KB
MD56336e04febd73bd5260a2d974817a9cd
SHA1774e1beed401346784f4a63e8d30adffc697bf77
SHA2565b67146285c97192c6ce453a84e0cafadc3d2a8bd1c0fd5e7800db24aa2a0185
SHA51234b7bce124e872d20b529e3675e0a32fdf0528d28be1d1a78c0c1bb724166f640ade32e713f8c3d138409baa505a7b41cfc4a2c3152a9cd39d8f62f122e5f12b
-
C:\Program Files\Cathay Futures\profiles\Charts\Euro\chart02.chrFilesize
4KB
MD5e4ee631b69c84953eb70b5be19e80178
SHA1ffad8ebe062e6e484365d7f9761642303217175b
SHA2564811b15a515522d3fece37b4a9089112011bd62d62652b295e14bb74aa63fa6e
SHA512e98cfe41b726000a8c629ce418dc0944cb53c738af67b1d60a2abcff6b3f629c46b755b364320a03ddfd8ffa11049124b12cf4c657373abc891182a24909726d
-
C:\Program Files\Cathay Futures\profiles\Charts\Euro\chart03.chrFilesize
4KB
MD51d317dea4589acf40cc4396102c0c963
SHA11972cd214e9e9940b84dfd97bc6ebc2b908589f8
SHA2563fd62a7084445a99b60b8dceb28c85d4533fadcc5bc90934dcdd6e8e7025f866
SHA5125447b13a0e1fbbee4f080d0fe2512759f21fe5261e3c11099bcd4db42db69a891d526e363fe2e749bbf858a167d95471c842a050ed1fca3ae92593d93c583e31
-
C:\Program Files\Cathay Futures\profiles\Charts\Euro\chart04.chrFilesize
4KB
MD5dda95b8c2f418bffd481d4ba463526a8
SHA1c4b72025363e869e181d74d212dd54b2b751502c
SHA2564c41121051b008ccc758ec19c0250db78cb98c563283d8747dea9a11956564ce
SHA512bba961dc748661843d0e0ae4a329b7c5fc041ceac58ca97e98bf173234dc0ddf86370f477aed68f81951b414caabcbcd7187db21873fca638f39b5d6708092c2
-
C:\Program Files\Cathay Futures\profiles\Charts\Euro\order.wndFilesize
106B
MD5e6b06f612a351deaa8cda0836b25a4ce
SHA14739f8cecd1d075689730cfbc9140b13681832ff
SHA256bb2aae933928e009b82803d3ce2a3aa464861cf5c51e9a9af1cb25fc5923ee11
SHA5121f7a5c137fea0cd56b2c5676b6a038c15795f09fdff5efd50d9ed11ea102517fd4d5df5d7f1aedf2ecdd3e2a92e459b640f57eecaa5150ee759026aff273ab39
-
C:\Program Files\Cathay Futures\profiles\Charts\Market Overview\chart01.chrFilesize
5KB
MD50415270ec850a613df4e9c96e0f3d0c2
SHA15a22493dbbf2207e0fac23217f1b87574a5624d2
SHA2567b0d5a4ae505f98dcd667da733541501c4bf49b8139076156868c8f37573a071
SHA512dcf5026493e54aae6b4ca5823ef52793fb590ed03b26a584534d26dc0c82fe008cda43ce78c4f30f06469e8caf89093cce70f7d7e022a9b842cb97071b1195f8
-
C:\Program Files\Cathay Futures\profiles\Charts\Market Overview\chart02.chrFilesize
3KB
MD5a10290e8f40a09abd794779fdfe3b53a
SHA16755e2f6ccba07b57cd0421c93f8cd59d80f993a
SHA256193cc0eb1a419a84422d7e55a51dd81e38cc691cf3b89020868f6ee4ac8156b3
SHA512e42ee9a631439a0c13f54ee530cc55485a892cdb9e23e91bb95b1c5c63389d534916210e612f887c8f2040bf06d17f881f6de35fde55d82ce297cbf2087fd37b
-
C:\Program Files\Cathay Futures\profiles\Charts\Market Overview\chart03.chrFilesize
2KB
MD50059904b9856356a2a9cf9fc7b29e473
SHA12d2957fcb64c1853b4291986c181ee729db464e7
SHA25606c5bb507d83bfb9e853e8e660daa09192428cb59007ac23a9bafc97f329967e
SHA51211f8e14e5f6c398259aff9b9484ab7893502a1d2bfed035bf081c614aae6a54a73f36a4eda25e00049bc42f438a407218a2fd6c12a3e4b06871c02c3df4933d0
-
C:\Program Files\Cathay Futures\profiles\Charts\Market Overview\chart04.chrFilesize
3KB
MD5811c149ea405e13325467dceafae0c74
SHA18810462e3e23d9c9aabc241092ea59d835ae9198
SHA256fe5a8378274ae12a008942ae8d568b88ebc42354214c5c2082be2f85a7232c68
SHA512d10cac190c92690e0cf919f1c08932d5950ca706ccb443af4bb82e1a5fef46175a2b4f99d7ddcc19e5422a45c52946c6dc35227037f2553a392075020712f42b
-
C:\Program Files\Cathay Futures\profiles\Charts\Market Overview\order.wndFilesize
106B
MD506ff51fc2a91c09cf9bb43e654a17ad8
SHA1cc27a22873d1f2a53521ba0644b8ff9b0bd37ab7
SHA25692d54f3324fa315c03360a09ad4021b5f54da068397caf3966d4d73066d7839a
SHA512c88c0305dc577a2b74828f0048812cff7ef269f4efd2f0290afe27168e7d3eebee02ce59de9fd89eb3af85579f1c64ead61f11489995987a2d4fdd1a981e83bf
-
C:\Program Files\Cathay Futures\profiles\SymbolSets\forex.all.setFilesize
288B
MD5207307971b3cdd0a2cdd503759f7b527
SHA14984f6c2476e0018447804ee99b5781b0416d511
SHA256960e8672ba9df5a8d5325bdee8976703c3fc263ab7881c6772efc3433055a28a
SHA5125285844469287df619032dfbf46861448c277bfca06b3a363c11f9ade787afb7efc7dfa7b4503b719161f3d8bbbd557e6777c0b4faf20ffd7de088656ffe4709
-
C:\Program Files\Cathay Futures\profiles\SymbolSets\forex.crosses.setFilesize
218B
MD5a8c0ac3e5be4a1011a09f316c1bfabd3
SHA1a0a52c5c9780405917c5a402cc928cc10cfc4b48
SHA256c95a2b57f4de8504d8cafd99de6049d49df31e0a86466c0fae55008bec9e1736
SHA512124f8bef314415e390a5906f9b98bc3c9619df6302e9a15881d82928d8a9fd00606e895ff1a3909e3a51354c2aa915b2aca91081d5de5320748c1754bb4aa112
-
C:\Program Files\Cathay Futures\profiles\SymbolSets\forex.major.setFilesize
64B
MD582aef6cfea3aeea241c6240f2ac9a779
SHA19e2a01aeed78c853915bd1d3a0df8a6188bd079e
SHA256c5b114b137a44c5c93ad16c4befe696280ca069b4f4dd6ac7db2b66825ea4804
SHA512ed3f38f5152e7f2fb71e479cd07e9a6f1cce0c62ec02ce05cd9bbc2bd67c4a22273d986f846e307261ccf7582ca60de5e65bb84efb24ea5a11ee27b22d6b0278
-
C:\Program Files\Cathay Futures\profiles\Templates\ADX.tplFilesize
3KB
MD504fc692a8433953d5da484a7fce1293a
SHA1664e5683afb88ff8227e1d01207f7ea84195cc64
SHA2562e024d06758c05d7a2900f450e0456a696b4ec62c3684ed9b5983e6866516070
SHA512b6ea72ca5ecd338a77db07a2312ec7725ed06c1be6f098f17edca5751053e27db9b24e58eb2e87767acbbcfdaf6256f9cf3a75c7f71374e07c59161ec9c831fa
-
C:\Program Files\Cathay Futures\profiles\Templates\BollingerBands.tplFilesize
4KB
MD51f89f726613edeebe6201e1395e990ac
SHA1f1d178204fa3ceea0f7efaf62ac54a46a38f6076
SHA25671cecd467b9e7a0fe41723e815ceb00624ba1cee4d07102a0154096a50eb369f
SHA512a3fc403ca0728d6da7ad838f746569eb0df838943d9d95db7dc31753a9bda0d855790803201af98eabd0aaa6de4a35178b846efb2ed1a408e02e06934c6992d1
-
C:\Program Files\Cathay Futures\profiles\Templates\Momentum.tplFilesize
7KB
MD5f35cf96f510f5a2775b0867e9a689934
SHA18272482322dcdfdae839939b8154bb4dbc06f81d
SHA256f0fc8b8e4cb5de6b7b93ba356c4bac4e9b0d52cf589048e30aea39b9c0ea9845
SHA5126f9b9522bdd324e0771152a94294e447adee403567bd4da775eadae865e59be1bade60d71376308df3a7f7009c80dc2e5379190d475f27a570c0e29f26d6fe6c
-
C:\Program Files\Cathay Futures\terminal.icoFilesize
44KB
MD53aec171f22d1ea0958db2529976a17a3
SHA1dfb7f164f92aaeb776c129710b4b577c909d796c
SHA25633b87a8e0013b8ff53ca89bf7b17f3167b372bff131e3d96076c6450f9a39c55
SHA512c3dee0b41d9728239542733251075c331612d6f6ad07a69358068d4aa571e604f89b8357dea2a0bd09f485a65257f128705b79f08156ae00c7c47e1b658fce3b
-
C:\Program Files\Cathay Futures\terminal64.exeFilesize
76.9MB
MD5d0569c2096ade6071ce9ec0b68464d42
SHA1e3bebd772fd4139c219ca3d2fd172a4b928dbfda
SHA256a4eb8b65134fa070e2778c32d34ba21c69f7d778fefdad9ff7a9b46b81fa8d35
SHA51281f6bb3c4ca0ec4ce08856a0357971d33d1ce7524c2eb7f650a0a4fc90f8982809554f633b6a3d97162d599bfc85cec64c4d394d7583b1ab161a01a8a7828f4f
-
C:\Program Files\Cathay Futures\terminal64.exeFilesize
76.9MB
MD5d0569c2096ade6071ce9ec0b68464d42
SHA1e3bebd772fd4139c219ca3d2fd172a4b928dbfda
SHA256a4eb8b65134fa070e2778c32d34ba21c69f7d778fefdad9ff7a9b46b81fa8d35
SHA51281f6bb3c4ca0ec4ce08856a0357971d33d1ce7524c2eb7f650a0a4fc90f8982809554f633b6a3d97162d599bfc85cec64c4d394d7583b1ab161a01a8a7828f4f
-
C:\Program Files\Cathay Futures\terminal64.exeFilesize
76.9MB
MD5d0569c2096ade6071ce9ec0b68464d42
SHA1e3bebd772fd4139c219ca3d2fd172a4b928dbfda
SHA256a4eb8b65134fa070e2778c32d34ba21c69f7d778fefdad9ff7a9b46b81fa8d35
SHA51281f6bb3c4ca0ec4ce08856a0357971d33d1ce7524c2eb7f650a0a4fc90f8982809554f633b6a3d97162d599bfc85cec64c4d394d7583b1ab161a01a8a7828f4f
-
C:\Program Files\Cathay Futures\terminal64.exeFilesize
76.9MB
MD5d0569c2096ade6071ce9ec0b68464d42
SHA1e3bebd772fd4139c219ca3d2fd172a4b928dbfda
SHA256a4eb8b65134fa070e2778c32d34ba21c69f7d778fefdad9ff7a9b46b81fa8d35
SHA51281f6bb3c4ca0ec4ce08856a0357971d33d1ce7524c2eb7f650a0a4fc90f8982809554f633b6a3d97162d599bfc85cec64c4d394d7583b1ab161a01a8a7828f4f
-
C:\Program Files\Cathay Futures\uninstall.exeFilesize
3.2MB
MD5040ea631816d4e633dcd474234166afc
SHA168fa6b03207d1c309227d1c6ee3a139110dd0f67
SHA2569aeed6e78d292d03eb09c8ade57ef76043281782c2862b063116b2aecf3b1b3b
SHA512b1cf28e2ebdfa4ab84d914bb17a5548287193af192ce7d1be4f23126ba86c6e465cd6773788dbf3e6496ed0d37b208a843facfa68ecc1d1454116c1c6099759f
-
C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\6FGHNCOX\edgecompatviewlist[1].xmlFilesize
74KB
MD5d4fc49dc14f63895d997fa4940f24378
SHA13efb1437a7c5e46034147cbbc8db017c69d02c31
SHA256853d2f4eb81c9fdcea2ee079f6faf98214b111b77cdf68709b38989d123890f1
SHA512cc60d79b4afe5007634ac21dc4bc92081880be4c0d798a1735b63b27e936c02f399964f744dc73711987f01e8a1064b02a4867dd6cac27538e5fbe275cc61e0a
-
C:\Users\Admin\AppData\Local\Packages\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\AC\MicrosoftEdge\Cache\XDKPR1ZM\suggestions[1].en-USFilesize
17KB
MD55a34cb996293fde2cb7a4ac89587393a
SHA13c96c993500690d1a77873cd62bc639b3a10653f
SHA256c6a5377cbc07eece33790cfc70572e12c7a48ad8296be25c0cc805a1f384dbad
SHA512e1b7d0107733f81937415104e70f68b1be6fd0ca65dccf4ff72637943d44278d3a77f704aedff59d2dbc0d56a609b2590c8ec0dd6bc48ab30f1dad0c07a0a3ee
-
C:\Users\Admin\AppData\Local\Packages\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\AC\Microsoft\Windows\3720402701\2219095117.priFilesize
207KB
MD5e2b88765ee31470114e866d939a8f2c6
SHA1e0a53b8511186ff308a0507b6304fb16cabd4e1f
SHA256523e419d2fa2e780239812d36caa37e92f8c3e6a5cd9f18f0d807c593effa45e
SHA512462e8e6b4e63fc6781b6a9935b332a1dc77bfb88e1de49134f86fd46bd1598d2e842902dd9415a328e325bd7cdee766bd9473f2695acdfa769ffe7ba9ae1953d
-
C:\Users\Admin\AppData\Roaming\MetaQuotes\Terminal\Community\Labels\3A\3AEC171F22D1EA0958DB2529976A17A3.pngFilesize
1KB
MD5864d377ee80959b24c26d6579e854464
SHA139054057dd452d155a89824ee4e11d81ae35d795
SHA256071bb147b68418a3b853531c05be99cd6bb3c4fcd1bcdfa01b386865be19a361
SHA51242ac9fc3dde7705a5b4a2474feac41e1fa612ebec14e4a3b93d3f44b869893a073d1829b64fdcf3df5cbc7bf2700b9bbb45b306a495077e828c863326328dbdc
-
C:\Users\Admin\AppData\Roaming\MetaQuotes\Terminal\Community\dns.datFilesize
13KB
MD5eb734d96c7b82d00b0577394d2d473e9
SHA1e81ce972ea31c22a669b2204205eacd92d7baf04
SHA2561c0d825cfa406b6e109446bb7a9d8509b9145ddc9c18ec1eaa80d4e497bf5775
SHA512865e6566cd89be6726389bc4a24ff587316b2219e20cbc2ed691ee5bac7b3b29f95335708b5a94e0080484a1f1b24e86f986a8c58e7316aa088611be352d6e80
-
memory/4248-164-0x0000000005360000-0x00000000053CA000-memory.dmpFilesize
424KB
-
memory/4248-179-0x0000000007D00000-0x0000000007D0B000-memory.dmpFilesize
44KB
-
memory/4248-190-0x000000000CCF0000-0x000000000CD1A000-memory.dmpFilesize
168KB
-
memory/4248-189-0x000000000CC00000-0x000000000CC0B000-memory.dmpFilesize
44KB
-
memory/4248-188-0x0000000009310000-0x0000000009331000-memory.dmpFilesize
132KB
-
memory/4248-187-0x00000000092D0000-0x0000000009306000-memory.dmpFilesize
216KB
-
memory/4248-186-0x00000000092A0000-0x00000000092C5000-memory.dmpFilesize
148KB
-
memory/4248-160-0x0000000005230000-0x00000000052CA000-memory.dmpFilesize
616KB
-
memory/4248-184-0x0000000009000000-0x000000000907C000-memory.dmpFilesize
496KB
-
memory/4248-182-0x0000000008FA0000-0x0000000008FC2000-memory.dmpFilesize
136KB
-
memory/4248-183-0x0000000008FD0000-0x0000000008FFF000-memory.dmpFilesize
188KB
-
memory/4248-181-0x0000000008E30000-0x0000000008E9B000-memory.dmpFilesize
428KB
-
memory/4248-180-0x0000000007F10000-0x0000000007F2D000-memory.dmpFilesize
116KB
-
memory/4248-159-0x0000000005130000-0x0000000005226000-memory.dmpFilesize
984KB
-
memory/4248-178-0x0000000007CC0000-0x0000000007CF4000-memory.dmpFilesize
208KB
-
memory/4248-177-0x0000000007B50000-0x0000000007CB6000-memory.dmpFilesize
1.4MB
-
memory/4248-175-0x00000000076F0000-0x0000000007707000-memory.dmpFilesize
92KB
-
memory/4248-158-0x0000000004630000-0x0000000004929000-memory.dmpFilesize
3.0MB
-
memory/4248-173-0x00000000071F0000-0x00000000071F8000-memory.dmpFilesize
32KB
-
memory/4248-174-0x00000000076B0000-0x00000000076E7000-memory.dmpFilesize
220KB
-
memory/4248-172-0x0000000008040000-0x00000000080E4000-memory.dmpFilesize
656KB
-
memory/4248-171-0x0000000007650000-0x00000000076AC000-memory.dmpFilesize
368KB
-
memory/4248-170-0x00000000072B0000-0x0000000007345000-memory.dmpFilesize
596KB
-
memory/4248-169-0x0000000007200000-0x000000000729E000-memory.dmpFilesize
632KB
-
memory/4248-168-0x0000000005640000-0x000000000566D000-memory.dmpFilesize
180KB
-
memory/4248-167-0x0000000005400000-0x0000000005429000-memory.dmpFilesize
164KB
-
memory/4248-166-0x00000000053D0000-0x0000000005400000-memory.dmpFilesize
192KB
-
memory/4248-165-0x0000000005340000-0x0000000005355000-memory.dmpFilesize
84KB
-
memory/4248-195-0x000000000E6D0000-0x000000000E6E5000-memory.dmpFilesize
84KB
-
memory/4248-163-0x0000000005320000-0x0000000005331000-memory.dmpFilesize
68KB
-
memory/4248-162-0x00000000052D0000-0x000000000531C000-memory.dmpFilesize
304KB
-
memory/4248-161-0x0000000004A10000-0x0000000004A21000-memory.dmpFilesize
68KB
-
memory/4248-185-0x0000000009280000-0x0000000009294000-memory.dmpFilesize
80KB
-
memory/4248-191-0x000000000E230000-0x000000000E2B2000-memory.dmpFilesize
520KB
-
memory/4248-176-0x0000000007B40000-0x0000000007B4A000-memory.dmpFilesize
40KB
-
memory/4248-157-0x0000000004A30000-0x0000000005122000-memory.dmpFilesize
6.9MB
-
memory/4248-156-0x0000000004580000-0x000000000462A000-memory.dmpFilesize
680KB
-
memory/4248-155-0x0000000003DA0000-0x0000000003DE9000-memory.dmpFilesize
292KB
-
memory/4248-154-0x00000000044E0000-0x000000000457D000-memory.dmpFilesize
628KB
-
memory/4248-153-0x00000000042B0000-0x0000000004439000-memory.dmpFilesize
1.5MB
-
memory/4248-152-0x0000000003D80000-0x0000000003D9E000-memory.dmpFilesize
120KB
-
memory/4248-151-0x0000000004180000-0x00000000042A5000-memory.dmpFilesize
1.1MB
-
memory/4248-150-0x0000000003D20000-0x0000000003D79000-memory.dmpFilesize
356KB
-
memory/4248-149-0x0000000003B10000-0x0000000003CB9000-memory.dmpFilesize
1.7MB
-
memory/4248-148-0x0000000003EB0000-0x0000000004045000-memory.dmpFilesize
1.6MB
-
memory/4248-147-0x0000000003E10000-0x0000000003E1A000-memory.dmpFilesize
40KB
-
memory/4248-146-0x0000000003890000-0x000000000389C000-memory.dmpFilesize
48KB
-
memory/4248-145-0x00000000038A0000-0x0000000003B07000-memory.dmpFilesize
2.4MB
-
memory/4248-144-0x0000000003860000-0x0000000003885000-memory.dmpFilesize
148KB
-
memory/4248-143-0x0000000003350000-0x00000000033A6000-memory.dmpFilesize
344KB
-
memory/4248-142-0x0000000003690000-0x0000000003859000-memory.dmpFilesize
1.8MB
-
memory/4248-141-0x0000000003290000-0x00000000032E1000-memory.dmpFilesize
324KB
-
memory/4248-140-0x00000000030B0000-0x000000000316F000-memory.dmpFilesize
764KB
-
memory/4248-139-0x0000000002F60000-0x00000000030A3000-memory.dmpFilesize
1.3MB
-
memory/4248-138-0x0000000001B20000-0x0000000002F57000-memory.dmpFilesize
20.2MB
-
memory/4248-136-0x0000000001A40000-0x0000000001A67000-memory.dmpFilesize
156KB
-
memory/4248-137-0x0000000001A70000-0x0000000001B11000-memory.dmpFilesize
644KB
-
memory/4248-135-0x00000000018F0000-0x0000000001A3A000-memory.dmpFilesize
1.3MB
-
memory/4248-134-0x0000000000D90000-0x0000000000DFC000-memory.dmpFilesize
432KB
-
memory/4248-133-0x00000000012D0000-0x0000000001519000-memory.dmpFilesize
2.3MB
-
memory/4248-132-0x0000000001100000-0x00000000011AE000-memory.dmpFilesize
696KB
-
memory/4248-194-0x000000000E690000-0x000000000E6C1000-memory.dmpFilesize
196KB
-
memory/4248-193-0x000000000E3B0000-0x000000000E682000-memory.dmpFilesize
2.8MB
-
memory/4248-192-0x000000000E2C0000-0x000000000E3A3000-memory.dmpFilesize
908KB
-
memory/4492-125-0x0000029153070000-0x0000029153078000-memory.dmpFilesize
32KB
-
memory/4492-129-0x0000029154E30000-0x0000029154E40000-memory.dmpFilesize
64KB
-
memory/4492-198-0x0000029154E30000-0x0000029154E40000-memory.dmpFilesize
64KB