90023a29b6f8d025835bdd1849146fc5837ffdd78fe9215b36f384f0d1bdc55e

System Information Discovery

Processes:

cathayfutures5setup.exeterminal64.exeterminal64.exe

description	ioc	process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	cathayfutures5setup.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	terminal64.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	terminal64.exe

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

System Information Discovery

Processes:

cathayfutures5setup.exe

description	ioc	process
Key value queried	\REGISTRY\USER\S-1-5-21-2805025096-2326403612-4231045514-1000\Control Panel\International\Geo\Nation	cathayfutures5setup.exe

Executes dropped EXE 5 IoCs

Processes:

CathayFXConfig.execathayfutures5setup.exeterminal64.exeterminal64.exemetaeditor64.exe

pid process

1884 CathayFXConfig.exe
640 cathayfutures5setup.exe
2740 terminal64.exe
1500 terminal64.exe
2448 metaeditor64.exe
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials in Files
T1081

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

Processes:

CathayFXConfig.exe

description	ioc	process
Set value (str)	\REGISTRY\USER\S-1-5-21-2805025096-2326403612-4231045514-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\AppName = "\"C:\\Program Files (x86)\\CathayFutures_FX\\CathayFXConfig.exe\""	CathayFXConfig.exe

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Checks whether UAC is enabled 1 TTPs 2 IoCs

evasion trojan

System Information Discovery

Processes:

terminal64.exeterminal64.exe

description	ioc	process
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	terminal64.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	terminal64.exe

Writes to the Master Boot Record (MBR) 1 TTPs 4 IoCs

Bootkits write to the MBR to gain persistence at a level below the operating system.

bootkit persistence

Bootkit

T1067

Processes:

cathayfutures5setup.exeterminal64.exeterminal64.exemetaeditor64.exe

description	ioc	process
File opened for modification	\??\PHYSICALDRIVE0	cathayfutures5setup.exe
File opened for modification	\??\PHYSICALDRIVE0	terminal64.exe
File opened for modification	\??\PHYSICALDRIVE0	terminal64.exe
File opened for modification	\??\PHYSICALDRIVE0	metaeditor64.exe

Suspicious use of NtSetInformationThreadHideFromDebugger 6 IoCs

Processes:

terminal64.exeterminal64.exemetaeditor64.exe

pid process

2740 terminal64.exe
2740 terminal64.exe
1500 terminal64.exe
1500 terminal64.exe
2448 metaeditor64.exe
2448 metaeditor64.exe

Drops file in Program Files directory 64 IoCs

Processes:

terminal64.exemetaeditor64.execathayfutures5setup.exeCathayFXConfig.exesetup.exe

description	ioc	process
File created	C:\Program Files\Cathay Futures\MQL5\Include\Controls\res\Right.bmp	terminal64.exe
File created	C:\Program Files\Cathay Futures\MQL5\Include\Math\Alglib\alglibinternal.mqh	terminal64.exe
File created	C:\Program Files\Cathay Futures\MQL5\Include\Math\Stat\Geometric.mqh	terminal64.exe
File created	C:\Program Files\Cathay Futures\MQL5\Indicators\Examples\Gator_2.mq5	terminal64.exe
File created	C:\Program Files\Cathay Futures\MQL5\Indicators\Examples\Gator_2.ex5	metaeditor64.exe
File created	C:\Program Files\Cathay Futures\Bases\Default\Mail\5.freelance.english.welcome	cathayfutures5setup.exe
File created	C:\Program Files\Cathay Futures\Bases\Default\Mail\7.risk-warning.french.welcome	cathayfutures5setup.exe
File created	C:\Program Files\Cathay Futures\Sounds\email.wav	cathayfutures5setup.exe
File created	C:\Program Files\Cathay Futures\MQL5\Indicators\Examples\Panels\ChartPanel\ChartPanel.ex5	metaeditor64.exe
File created	C:\Program Files\Cathay Futures\Bases\Default\Mail\4.mobile.japanese.welcome	cathayfutures5setup.exe
File created	C:\Program Files\Cathay Futures\MQL5\Indicators\Examples\CCI.ex5	metaeditor64.exe
File created	C:\Program Files\Cathay Futures\MQL5\Indicators\Examples\CHO.ex5	metaeditor64.exe
File created	C:\Program Files\Cathay Futures\MQL5\Indicators\Examples\Custom Moving Average.ex5	metaeditor64.exe
File created	C:\Program Files\Cathay Futures\Bases\Default\Mail\1.welcome.arabic.welcome	cathayfutures5setup.exe
File created	C:\Program Files\Cathay Futures\Bases\Default\Mail\2.signals.uzbek.welcome	cathayfutures5setup.exe
File created	C:\Program Files\Cathay Futures\Bases\Default\Mail\4.mobile.bulgarian.welcome	cathayfutures5setup.exe
File created	C:\Program Files\Cathay Futures\MQL5\Include\Math\Alglib\optimization.mqh	terminal64.exe
File created	C:\Program Files\Cathay Futures\MQL5\Include\Math\Alglib\statistics.mqh	terminal64.exe
File created	C:\Program Files\Cathay Futures\Bases\Default\Mail\7.risk-warning.vietnamese.welcome	cathayfutures5setup.exe
File created	C:\Program Files\Cathay Futures\MQL5\Include\Arrays\ArrayInt.mqh	terminal64.exe
File created	C:\Program Files\Cathay Futures\MQL5\Include\Expert\ExpertTrailing.mqh	terminal64.exe
File created	C:\Program Files\Cathay Futures\MQL5\Experts\Examples\Moving Average\Moving Average.mq5	terminal64.exe
File created	C:\Program Files\Cathay Futures\MQL5\Include\Generic\Internal\EqualFunction.mqh	terminal64.exe
File created	C:\Program Files\Cathay Futures\MQL5\Include\Math\Stat\NoncentralChiSquare.mqh	terminal64.exe
File created	C:\Program Files\Cathay Futures\MQL5\Indicators\Examples\Fractals.ex5	metaeditor64.exe
File created	C:\Program Files\Cathay Futures\Bases\Default\Mail\3.market.arabic.welcome	cathayfutures5setup.exe
File created	C:\Program Files\Cathay Futures\MQL5\Profiles\Charts\Market Overview\chart03.chr	terminal64.exe
File created	C:\Program Files\Cathay Futures\MQL5\Experts\Examples\Math 3D Morpher\Textures\checker.bmp	terminal64.exe
File created	C:\Program Files\Cathay Futures\MQL5\Include\Controls\res\ThumbHor.bmp	terminal64.exe
File created	C:\Program Files\Cathay Futures\MQL5\Include\Indicators\Custom.mqh	terminal64.exe
File created	C:\Program Files\Cathay Futures\Bases\Default\Mail\5.freelance.turkish.welcome	cathayfutures5setup.exe
File created	C:\Program Files\Cathay Futures\MQL5\Profiles\Charts\British Pound\chart02.chr	terminal64.exe
File created	C:\Program Files\Cathay Futures\MQL5\Experts\Advisors\ExpertMACD.mq5	terminal64.exe
File created	C:\Program Files\Cathay Futures\Sounds\wait.wav	cathayfutures5setup.exe
File created	C:\Program Files\Cathay Futures\MQL5\Experts\Examples\Math 3D\Sets\Chomolungma.set	terminal64.exe
File created	C:\Program Files\Cathay Futures\Bases\Default\Mail\1.welcome.russian.welcome	cathayfutures5setup.exe
File created	C:\Program Files\Cathay Futures\Profiles\Charts\Euro\chart01.chr	cathayfutures5setup.exe
File created	C:\Program Files\Cathay Futures\Profiles\Templates\Momentum.tpl	cathayfutures5setup.exe
File created	C:\Program Files\Cathay Futures\Config\common.ini	CathayFXConfig.exe
File created	C:\Program Files\Cathay Futures\MQL5\Include\ChartObjects\ChartObjectsArrows.mqh	terminal64.exe
File created	C:\Program Files\Cathay Futures\MQL5\Profiles\Templates\Momentum.tpl	terminal64.exe
File created	C:\Program Files\Cathay Futures\MQL5\Include\Canvas\DX\DXBuffers.mqh	terminal64.exe
File created	C:\Program Files\Cathay Futures\MQL5\Include\Math\Fuzzy\mamdanifuzzysystem.mqh	terminal64.exe
File created	C:\Program Files\Cathay Futures\MQL5\Indicators\Examples\Panels\SimplePanel\SimplePanel.mq5	terminal64.exe
File created	C:\Program Files\Cathay Futures\MQL5\Indicators\Examples\Gator.ex5	metaeditor64.exe
File created	C:\Program Files\Cathay Futures\Bases\Default\Mail\5.freelance.default.welcome	cathayfutures5setup.exe
File created	C:\Program Files\Cathay Futures\Profiles\SymbolSets\forex.crosses.set	cathayfutures5setup.exe
File created	C:\Program Files (x86)\Microsoft\Edge\Application\SetupMetrics\365b4bbc-3f0a-42c7-bfe1-c74ef0e5353f.tmp	setup.exe
File created	C:\Program Files\Cathay Futures\MQL5\Include\Generic\SortedSet.mqh	terminal64.exe
File created	C:\Program Files\Cathay Futures\MQL5\Include\Math\Fuzzy\fuzzyvariable.mqh	terminal64.exe
File created	C:\Program Files\Cathay Futures\Bases\Default\Mail\2.signals.tajik.welcome	cathayfutures5setup.exe
File created	C:\Program Files\Cathay Futures\MQL5\Include\Canvas\DX\DXObject.mqh	terminal64.exe
File created	C:\Program Files\Cathay Futures\MQL5\Include\Expert\Expert.mqh	terminal64.exe
File created	C:\Program Files\Cathay Futures\MQL5\Include\Expert\Signal\SignalMA.mqh	terminal64.exe
File created	C:\Program Files\Cathay Futures\MQL5\Include\Generic\Stack.mqh	terminal64.exe
File created	C:\Program Files\Cathay Futures\MQL5\Include\Graphics\Axis.mqh	terminal64.exe
File created	C:\Program Files\Cathay Futures\MQL5\Scripts\Examples\ObjectSphere\Sphere.mqh	terminal64.exe
File created	C:\Program Files\Cathay Futures\Bases\Default\Mail\5.freelance.japanese.welcome	cathayfutures5setup.exe
File created	C:\Program Files\Cathay Futures\MQL5\Profiles\Charts\Default\chart01.chr	terminal64.exe
File created	C:\Program Files\Cathay Futures\MQL5\Profiles\SymbolSets\forex.major.set	terminal64.exe
File created	C:\Program Files\Cathay Futures\MQL5\Include\Canvas\DX\Shaders\DefaultShaderVertex.hlsl	terminal64.exe
File created	C:\Program Files\Cathay Futures\MQL5\Include\Controls\ListView.mqh	terminal64.exe
File created	C:\Program Files\Cathay Futures\MQL5\Include\WinAPI\winuser.mqh	terminal64.exe
File created	C:\Program Files\Cathay Futures\MQL5\Scripts\Examples\Canvas\Charts\HistogramChartSample.mq5	terminal64.exe

Drops file in Windows directory 1 IoCs

Processes:

metaeditor64.exe

description ioc process

File opened for modification C:\Windows\ metaeditor64.exe
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

description	ioc	process
File opened for modification	C:\Windows\	metaeditor64.exe

Checks processor information in registry 2 TTPs 4 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

System Information Discovery

Processes:

cathayfutures5setup.exeterminal64.exe

description	ioc	process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	cathayfutures5setup.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	terminal64.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	terminal64.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	cathayfutures5setup.exe

Enumerates system info in registry 2 TTPs 12 IoCs

Query Registry

System Information Discovery

Processes:

cathayfutures5setup.exemsedge.exeterminal64.exeterminal64.exe

description	ioc	process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	cathayfutures5setup.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	terminal64.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	terminal64.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	terminal64.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	terminal64.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	terminal64.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	cathayfutures5setup.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	cathayfutures5setup.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	terminal64.exe

Modifies Internet Explorer settings 1 TTPs 1 IoCs

adware spyware

Modify Registry

Processes:

terminal64.exe

description	ioc	process
Set value (int)	\REGISTRY\USER\S-1-5-21-2805025096-2326403612-4231045514-1000\SOFTWARE\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_BROWSER_EMULATION\terminal64.exe = "11000"	terminal64.exe

Modifies registry class 54 IoCs

Processes:

terminal64.exemsedge.exe

description	ioc	process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\EX5.File\shell\open\command	terminal64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\EX5.File\shell\open\command\ = "C:\\Program Files\\Cathay Futures\\terminal64.exe /ex5:\"%1\""	terminal64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\mql5buy\ = "URL:MQL5 Buy Protocol"	terminal64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\MQL5.File\ = "MQL5 Source File"	terminal64.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\MQL5.File\DefaultIcon	terminal64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\MQL5.Header\ = "MQL5 Header File"	terminal64.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\MetaTrader 5 Export File\shell	terminal64.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.ex5	terminal64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\mql5buy\URL Protocol	terminal64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\EX5.File\DefaultIcon\ = "C:\\Program Files\\Cathay Futures\\terminal64.exe,2"	terminal64.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\MQL5.Header	terminal64.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\MetaTrader 5 Export File\DefaultIcon	terminal64.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\mql5buy\DefaultIcon	terminal64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.mqh\ = "MQL5.Header"	terminal64.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\MQL5.File	terminal64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\MQL5.File\shell\open\command\ = "C:\\Program Files\\Cathay Futures\\metaeditor64.exe \"%1\""	terminal64.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\EX5.File\DefaultIcon	terminal64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.ex5\ = "EX5.File"	terminal64.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\mql5buy	terminal64.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\MQL5.File\shell\open\command	terminal64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.mq5\ = "MQL5.File"	terminal64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.mt5\ = "MetaTrader 5 Export File"	terminal64.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\EX5.File	terminal64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\mql5buy\shell\open\command\ = "C:\\Program Files\\Cathay Futures\\terminal64.exe \"%1\""	terminal64.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.mq5\ShellNew	terminal64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\mql5buy\DefaultIcon\ = "C:\\Program Files\\Cathay Futures\\terminal64.exe,1"	terminal64.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\mql5buy\shell	terminal64.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\MQL5.File\shell	terminal64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\MQL5.File\ShellNew\NullFile	terminal64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\MQL5.Header\shell\open\command\ = "C:\\Program Files\\Cathay Futures\\metaeditor64.exe \"%1\""	terminal64.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\MetaTrader 5 Export File	terminal64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\MetaTrader 5 Export File\ = "MetaTrader 5 Export"	terminal64.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\MetaTrader 5 Export File\shell\open\command	terminal64.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\mql5buy\shell\open\command	terminal64.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.mq5	terminal64.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\MQL5.Header\shell	terminal64.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.mt5	terminal64.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\EX5.File\shell\open	terminal64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\MQL5.File\DefaultIcon\ = "C:\\Program Files\\Cathay Futures\\metaeditor64.exe,1"	terminal64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\EX5.File\ = "MQL5 Program"	terminal64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.mq5\ShellNew\NullFile	terminal64.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\MQL5.Header\shell\open\command	terminal64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\MetaTrader 5 Export File\DefaultIcon\ = "C:\\Program Files\\Cathay Futures\\terminal64.exe,15"	terminal64.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\MetaTrader 5 Export File\shell\open	terminal64.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\EX5.File\shell	terminal64.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\MQL5.File\ShellNew	terminal64.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\MQL5.Header\shell\open	terminal64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\MetaTrader 5 Export File\shell\open\command\ = "C:\\Program Files\\Cathay Futures\\terminal64.exe /import:\"%1\""	terminal64.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\mql5buy\shell\open	terminal64.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\MQL5.File\shell\open	terminal64.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\MQL5.Header\DefaultIcon	terminal64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\MQL5.Header\DefaultIcon\ = "C:\\Program Files\\Cathay Futures\\metaeditor64.exe,2"	terminal64.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.mqh	terminal64.exe

Modifies system certificate store 2 TTPs 10 IoCs

evasion spyware trojan

Install Root Certificate

T1130

Modify Registry

Processes:

terminal64.execathayfutures5setup.exe

description	ioc	process
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\2B8F1B57330DBBA2D07A6C51F70EE90DDAB9AD8E\Blob = 190000000100000010000000ea6089055218053dd01e37e1d806eedf0f000000010000003000000066b764a96581128168cf208e374dda479d54e311f32457f4aee0dbd2a6c8d171d531289e1cd22bfdbbd4cfd979625483090000000100000054000000305206082b0601050507030206082b06010505070303060a2b0601040182370a030406082b0601050507030406082b0601050507030606082b0601050507030706082b0601050507030106082b0601050507030853000000010000004300000030413022060c2b06010401b231010201050130123010060a2b0601040182373c0101030200c0301b060567810c010330123010060a2b0601040182373c0101030200c0620000000100000020000000e793c9b02fd8aa13e21c31228accb08119643b749c898964b1746d46c3d4cbd21400000001000000140000005379bf5aaa2b4acf5480e1d89bc09df2b20366cb1d0000000100000010000000885010358d29a38f059b028559c95f900b00000001000000100000005300650063007400690067006f0000000300000001000000140000002b8f1b57330dbba2d07a6c51f70ee90ddab9ad8e0400000001000000100000001bfe69d191b71933a372a80fe155e5b52000000001000000e2050000308205de308203c6a003020102021001fd6d30fca3ca51a81bbc640e35032d300d06092a864886f70d01010c0500308188310b3009060355040613025553311330110603550408130a4e6577204a6572736579311430120603550407130b4a65727365792043697479311e301c060355040a131554686520555345525452555354204e6574776f726b312e302c06035504031325555345525472757374205253412043657274696669636174696f6e20417574686f72697479301e170d3130303230313030303030305a170d3338303131383233353935395a308188310b3009060355040613025553311330110603550408130a4e6577204a6572736579311430120603550407130b4a65727365792043697479311e301c060355040a131554686520555345525452555354204e6574776f726b312e302c06035504031325555345525472757374205253412043657274696669636174696f6e20417574686f7269747930820222300d06092a864886f70d01010105000382020f003082020a028202010080126517360ec3db08b3d0ac570d76edcd27d34cad508361e2aa204d092d6409dcce899fcc3da9ecf6cfc1dcf1d3b1d67b3728112b47da39c6bc3a19b45fa6bd7d9da36342b676f2a93b2b91f8e26fd0ec162090093ee2e874c918b491d46264db7fa306f188186a90223cbcfe13f087147bf6e41f8ed4e451c61167460851cb8614543fbc33fe7e6c9cff169d18bd518e35a6a766c87267db2166b1d49b7803c0503ae8ccf0dcbc9e4cfeaf0596351f575ab7ffcef93db72cb6f654ddc8e7123a4dae4c8ab75c9ab4b7203dca7f2234ae7e3b68660144e7014e46539b3360f794be5337907343f332c353efdbaafe744e69c76b8c6093dec4c70cdfe132aecc933b517895678bee3d56fe0cd0690f1b0ff325266b336df76e47fa7343e57e0ea566b1297c3284635589c40dc19354301913acd37d37a7eb5d3a6c355cdb41d712daa9490bdfd8808a0993628eb566cf2588cd84b8b13fa4390fd9029eeb124c957cf36b05a95e1683ccb867e2e8139dcc5b82d34cb3ed5bffdee573ac233b2d00bf3555740949d849581a7f9236e651920ef3267d1c4d17bcc9ec4326d0bf415f40a94444f499e757879e501f5754a83efd74632fb1506509e658422e431a4cb4f0254759fa041e93d426464a5081b2debe78b7fc6715e1c957841e0f63d6e962bad65f552eea5cc62808042539b80e2ba9f24c971c073f0d52f5edef2f820f0203010001a3423040301d0603551d0e041604145379bf5aaa2b4acf5480e1d89bc09df2b20366cb300e0603551d0f0101ff040403020106300f0603551d130101ff040530030101ff300d06092a864886f70d01010c050003820201005cd47c0dcff7017d4199650c73c5529fcbf8cf99067f1bda43159f9e0255579614f1523c27879428ed1f3a0137a276fc5350c0849bc66b4eba8c214fa28e556291f36915d8bc88e3c4aa0bfdefa8e94b552a06206d55782919ee5f305c4b241155ff249a6e5e2a2bee0b4d9f7ff70138941495430709fb60a9ee1cab128ca09a5ea7986a596d8b3f08fbc8d145af18156490120f73282ec5e2244efc58ecf0f445fe22b3eb2f8ed2d9456105c1976fa876728f8b8c36afbf0d05ce718de6a66f1f6ca67162c5d8d083720cf16711890c9c134c7234dfbcd571dfaa71dde1b96c8c3c125d65dabd5712b6436bffe5de4d661151cf99aeec17b6e871918cde49fedd3571a21527941ccf61e326bb6fa36725215de6dd1d0b2e681b3b82afec836785d4985174b1b9998089ff7f78195c794a602e9240ae4c372a2cc9c762c80e5df7365bcae0252501b4dd1a079c77003fd0dcd5ec3dd4fabb3fcc85d66f7fa92ddfb902f7f5979ab535dac367b0874aa9289e238eff5c276be1b04ff307ee002ed45987cb524195eaf447d7ee6441557c8d590295dd629dc2b9ee5a287484a59bb790c70c07dff589367432d628c1b0b00be09c4cc31cd6fce369b54746812fa282abd3634470c48dff2d33baad8f7bb57088ae3e19cf4028d8fcc890bb5d9922f552e658c51f883143ee881dd7c68e3c436a1da718de7d3d16f162f9ca90a8fd	terminal64.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\2B8F1B57330DBBA2D07A6C51F70EE90DDAB9AD8E\Blob = 5c0000000100000004000000001000000400000001000000100000001bfe69d191b71933a372a80fe155e5b50300000001000000140000002b8f1b57330dbba2d07a6c51f70ee90ddab9ad8e0b00000001000000100000005300650063007400690067006f0000001d0000000100000010000000885010358d29a38f059b028559c95f901400000001000000140000005379bf5aaa2b4acf5480e1d89bc09df2b20366cb620000000100000020000000e793c9b02fd8aa13e21c31228accb08119643b749c898964b1746d46c3d4cbd253000000010000004300000030413022060c2b06010401b231010201050130123010060a2b0601040182373c0101030200c0301b060567810c010330123010060a2b0601040182373c0101030200c0090000000100000054000000305206082b0601050507030206082b06010505070303060a2b0601040182370a030406082b0601050507030406082b0601050507030606082b0601050507030706082b0601050507030106082b060105050703080f000000010000003000000066b764a96581128168cf208e374dda479d54e311f32457f4aee0dbd2a6c8d171d531289e1cd22bfdbbd4cfd979625483190000000100000010000000ea6089055218053dd01e37e1d806eedf2000000001000000e2050000308205de308203c6a003020102021001fd6d30fca3ca51a81bbc640e35032d300d06092a864886f70d01010c0500308188310b3009060355040613025553311330110603550408130a4e6577204a6572736579311430120603550407130b4a65727365792043697479311e301c060355040a131554686520555345525452555354204e6574776f726b312e302c06035504031325555345525472757374205253412043657274696669636174696f6e20417574686f72697479301e170d3130303230313030303030305a170d3338303131383233353935395a308188310b3009060355040613025553311330110603550408130a4e6577204a6572736579311430120603550407130b4a65727365792043697479311e301c060355040a131554686520555345525452555354204e6574776f726b312e302c06035504031325555345525472757374205253412043657274696669636174696f6e20417574686f7269747930820222300d06092a864886f70d01010105000382020f003082020a028202010080126517360ec3db08b3d0ac570d76edcd27d34cad508361e2aa204d092d6409dcce899fcc3da9ecf6cfc1dcf1d3b1d67b3728112b47da39c6bc3a19b45fa6bd7d9da36342b676f2a93b2b91f8e26fd0ec162090093ee2e874c918b491d46264db7fa306f188186a90223cbcfe13f087147bf6e41f8ed4e451c61167460851cb8614543fbc33fe7e6c9cff169d18bd518e35a6a766c87267db2166b1d49b7803c0503ae8ccf0dcbc9e4cfeaf0596351f575ab7ffcef93db72cb6f654ddc8e7123a4dae4c8ab75c9ab4b7203dca7f2234ae7e3b68660144e7014e46539b3360f794be5337907343f332c353efdbaafe744e69c76b8c6093dec4c70cdfe132aecc933b517895678bee3d56fe0cd0690f1b0ff325266b336df76e47fa7343e57e0ea566b1297c3284635589c40dc19354301913acd37d37a7eb5d3a6c355cdb41d712daa9490bdfd8808a0993628eb566cf2588cd84b8b13fa4390fd9029eeb124c957cf36b05a95e1683ccb867e2e8139dcc5b82d34cb3ed5bffdee573ac233b2d00bf3555740949d849581a7f9236e651920ef3267d1c4d17bcc9ec4326d0bf415f40a94444f499e757879e501f5754a83efd74632fb1506509e658422e431a4cb4f0254759fa041e93d426464a5081b2debe78b7fc6715e1c957841e0f63d6e962bad65f552eea5cc62808042539b80e2ba9f24c971c073f0d52f5edef2f820f0203010001a3423040301d0603551d0e041604145379bf5aaa2b4acf5480e1d89bc09df2b20366cb300e0603551d0f0101ff040403020106300f0603551d130101ff040530030101ff300d06092a864886f70d01010c050003820201005cd47c0dcff7017d4199650c73c5529fcbf8cf99067f1bda43159f9e0255579614f1523c27879428ed1f3a0137a276fc5350c0849bc66b4eba8c214fa28e556291f36915d8bc88e3c4aa0bfdefa8e94b552a06206d55782919ee5f305c4b241155ff249a6e5e2a2bee0b4d9f7ff70138941495430709fb60a9ee1cab128ca09a5ea7986a596d8b3f08fbc8d145af18156490120f73282ec5e2244efc58ecf0f445fe22b3eb2f8ed2d9456105c1976fa876728f8b8c36afbf0d05ce718de6a66f1f6ca67162c5d8d083720cf16711890c9c134c7234dfbcd571dfaa71dde1b96c8c3c125d65dabd5712b6436bffe5de4d661151cf99aeec17b6e871918cde49fedd3571a21527941ccf61e326bb6fa36725215de6dd1d0b2e681b3b82afec836785d4985174b1b9998089ff7f78195c794a602e9240ae4c372a2cc9c762c80e5df7365bcae0252501b4dd1a079c77003fd0dcd5ec3dd4fabb3fcc85d66f7fa92ddfb902f7f5979ab535dac367b0874aa9289e238eff5c276be1b04ff307ee002ed45987cb524195eaf447d7ee6441557c8d590295dd629dc2b9ee5a287484a59bb790c70c07dff589367432d628c1b0b00be09c4cc31cd6fce369b54746812fa282abd3634470c48dff2d33baad8f7bb57088ae3e19cf4028d8fcc890bb5d9922f552e658c51f883143ee881dd7c68e3c436a1da718de7d3d16f162f9ca90a8fd	terminal64.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\D1CBCA5DB2D52A7F693B674DE5F05A1D0C957DF0\Blob = 040000000100000010000000fa68bcd9b57fadfdc91d068328cc24c1030000000100000014000000d1cbca5db2d52a7f693b674de5f05a1d0c957df01d0000000100000010000000280cf6042c30a2646644ba7286a3aa971400000001000000140000003ae10986d4cf19c29676744976dce035c663639a0b00000001000000180000005300650063007400690067006f00200045004300430000006200000001000000200000004ff460d54b9c86dabfbcfc5712e0400d2bed3fbc4d4fbdaa86e06adcd2a9ad7a53000000010000004300000030413022060c2b06010401b231010201050130123010060a2b0601040182373c0101030200c0301b060567810c010330123010060a2b0601040182373c0101030200c0090000000100000054000000305206082b0601050507030206082b06010505070303060a2b0601040182370a030406082b0601050507030406082b0601050507030606082b0601050507030706082b0601050507030106082b060105050703080f00000001000000300000000b043572c899dec43efd590cfce610cf443a6315925ebfe589f7506907e44824608489581c7ca0e041458514cf1576142000000001000000930200003082028f30820215a00302010202105c8b99c55a94c5d27156decd8980cc26300a06082a8648ce3d040303308188310b3009060355040613025553311330110603550408130a4e6577204a6572736579311430120603550407130b4a65727365792043697479311e301c060355040a131554686520555345525452555354204e6574776f726b312e302c06035504031325555345525472757374204543432043657274696669636174696f6e20417574686f72697479301e170d3130303230313030303030305a170d3338303131383233353935395a308188310b3009060355040613025553311330110603550408130a4e6577204a6572736579311430120603550407130b4a65727365792043697479311e301c060355040a131554686520555345525452555354204e6574776f726b312e302c06035504031325555345525472757374204543432043657274696669636174696f6e20417574686f726974793076301006072a8648ce3d020106052b81040022036200041aac545aa9f96823e77ad5246f53c65ad84babc6d5b6d1e67371aedd9cd60c61fddba08903b80514ec57ceee5d3fe221b3cef7d48a79e0a3837e2d97d061c4f199dc259163ab7f30a3b470e2c7a1339cf3bf2e5c53b15fb37d327f8a34e37979a3423040301d0603551d0e041604143ae10986d4cf19c29676744976dce035c663639a300e0603551d0f0101ff040403020106300f0603551d130101ff040530030101ff300a06082a8648ce3d040303036800306502303667a11608dce49700411d4ebee16301cf3baa421164a09d94390211795c7b1dfa64b9ee1642b3bf8ac209c4ece4b14d023100e92a61478c524a4b4e1870f6d644d66ef583ba6d58bd24d95648eaefc4a24681886a3a46d1a99b4dc961dad15d576a18	cathayfutures5setup.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\D1CBCA5DB2D52A7F693B674DE5F05A1D0C957DF0\Blob = 19000000010000001000000076935b5c5a037216daaf8aac76df42c10f00000001000000300000000b043572c899dec43efd590cfce610cf443a6315925ebfe589f7506907e44824608489581c7ca0e041458514cf157614090000000100000054000000305206082b0601050507030206082b06010505070303060a2b0601040182370a030406082b0601050507030406082b0601050507030606082b0601050507030706082b0601050507030106082b0601050507030853000000010000004300000030413022060c2b06010401b231010201050130123010060a2b0601040182373c0101030200c0301b060567810c010330123010060a2b0601040182373c0101030200c06200000001000000200000004ff460d54b9c86dabfbcfc5712e0400d2bed3fbc4d4fbdaa86e06adcd2a9ad7a0b00000001000000180000005300650063007400690067006f00200045004300430000001400000001000000140000003ae10986d4cf19c29676744976dce035c663639a1d0000000100000010000000280cf6042c30a2646644ba7286a3aa97030000000100000014000000d1cbca5db2d52a7f693b674de5f05a1d0c957df0040000000100000010000000fa68bcd9b57fadfdc91d068328cc24c12000000001000000930200003082028f30820215a00302010202105c8b99c55a94c5d27156decd8980cc26300a06082a8648ce3d040303308188310b3009060355040613025553311330110603550408130a4e6577204a6572736579311430120603550407130b4a65727365792043697479311e301c060355040a131554686520555345525452555354204e6574776f726b312e302c06035504031325555345525472757374204543432043657274696669636174696f6e20417574686f72697479301e170d3130303230313030303030305a170d3338303131383233353935395a308188310b3009060355040613025553311330110603550408130a4e6577204a6572736579311430120603550407130b4a65727365792043697479311e301c060355040a131554686520555345525452555354204e6574776f726b312e302c06035504031325555345525472757374204543432043657274696669636174696f6e20417574686f726974793076301006072a8648ce3d020106052b81040022036200041aac545aa9f96823e77ad5246f53c65ad84babc6d5b6d1e67371aedd9cd60c61fddba08903b80514ec57ceee5d3fe221b3cef7d48a79e0a3837e2d97d061c4f199dc259163ab7f30a3b470e2c7a1339cf3bf2e5c53b15fb37d327f8a34e37979a3423040301d0603551d0e041604143ae10986d4cf19c29676744976dce035c663639a300e0603551d0f0101ff040403020106300f0603551d130101ff040530030101ff300a06082a8648ce3d040303036800306502303667a11608dce49700411d4ebee16301cf3baa421164a09d94390211795c7b1dfa64b9ee1642b3bf8ac209c4ece4b14d023100e92a61478c524a4b4e1870f6d644d66ef583ba6d58bd24d95648eaefc4a24681886a3a46d1a99b4dc961dad15d576a18	cathayfutures5setup.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\D1CBCA5DB2D52A7F693B674DE5F05A1D0C957DF0\Blob = 5c000000010000000400000080010000040000000100000010000000fa68bcd9b57fadfdc91d068328cc24c1030000000100000014000000d1cbca5db2d52a7f693b674de5f05a1d0c957df01d0000000100000010000000280cf6042c30a2646644ba7286a3aa971400000001000000140000003ae10986d4cf19c29676744976dce035c663639a0b00000001000000180000005300650063007400690067006f00200045004300430000006200000001000000200000004ff460d54b9c86dabfbcfc5712e0400d2bed3fbc4d4fbdaa86e06adcd2a9ad7a53000000010000004300000030413022060c2b06010401b231010201050130123010060a2b0601040182373c0101030200c0301b060567810c010330123010060a2b0601040182373c0101030200c0090000000100000054000000305206082b0601050507030206082b06010505070303060a2b0601040182370a030406082b0601050507030406082b0601050507030606082b0601050507030706082b0601050507030106082b060105050703080f00000001000000300000000b043572c899dec43efd590cfce610cf443a6315925ebfe589f7506907e44824608489581c7ca0e041458514cf15761419000000010000001000000076935b5c5a037216daaf8aac76df42c12000000001000000930200003082028f30820215a00302010202105c8b99c55a94c5d27156decd8980cc26300a06082a8648ce3d040303308188310b3009060355040613025553311330110603550408130a4e6577204a6572736579311430120603550407130b4a65727365792043697479311e301c060355040a131554686520555345525452555354204e6574776f726b312e302c06035504031325555345525472757374204543432043657274696669636174696f6e20417574686f72697479301e170d3130303230313030303030305a170d3338303131383233353935395a308188310b3009060355040613025553311330110603550408130a4e6577204a6572736579311430120603550407130b4a65727365792043697479311e301c060355040a131554686520555345525452555354204e6574776f726b312e302c06035504031325555345525472757374204543432043657274696669636174696f6e20417574686f726974793076301006072a8648ce3d020106052b81040022036200041aac545aa9f96823e77ad5246f53c65ad84babc6d5b6d1e67371aedd9cd60c61fddba08903b80514ec57ceee5d3fe221b3cef7d48a79e0a3837e2d97d061c4f199dc259163ab7f30a3b470e2c7a1339cf3bf2e5c53b15fb37d327f8a34e37979a3423040301d0603551d0e041604143ae10986d4cf19c29676744976dce035c663639a300e0603551d0f0101ff040403020106300f0603551d130101ff040530030101ff300a06082a8648ce3d040303036800306502303667a11608dce49700411d4ebee16301cf3baa421164a09d94390211795c7b1dfa64b9ee1642b3bf8ac209c4ece4b14d023100e92a61478c524a4b4e1870f6d644d66ef583ba6d58bd24d95648eaefc4a24681886a3a46d1a99b4dc961dad15d576a18	cathayfutures5setup.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\2B8F1B57330DBBA2D07A6C51F70EE90DDAB9AD8E\Blob = 0f000000010000003000000066b764a96581128168cf208e374dda479d54e311f32457f4aee0dbd2a6c8d171d531289e1cd22bfdbbd4cfd979625483090000000100000054000000305206082b0601050507030206082b06010505070303060a2b0601040182370a030406082b0601050507030406082b0601050507030606082b0601050507030706082b0601050507030106082b0601050507030853000000010000004300000030413022060c2b06010401b231010201050130123010060a2b0601040182373c0101030200c0301b060567810c010330123010060a2b0601040182373c0101030200c0620000000100000020000000e793c9b02fd8aa13e21c31228accb08119643b749c898964b1746d46c3d4cbd21400000001000000140000005379bf5aaa2b4acf5480e1d89bc09df2b20366cb1d0000000100000010000000885010358d29a38f059b028559c95f900b00000001000000100000005300650063007400690067006f0000000300000001000000140000002b8f1b57330dbba2d07a6c51f70ee90ddab9ad8e2000000001000000e2050000308205de308203c6a003020102021001fd6d30fca3ca51a81bbc640e35032d300d06092a864886f70d01010c0500308188310b3009060355040613025553311330110603550408130a4e6577204a6572736579311430120603550407130b4a65727365792043697479311e301c060355040a131554686520555345525452555354204e6574776f726b312e302c06035504031325555345525472757374205253412043657274696669636174696f6e20417574686f72697479301e170d3130303230313030303030305a170d3338303131383233353935395a308188310b3009060355040613025553311330110603550408130a4e6577204a6572736579311430120603550407130b4a65727365792043697479311e301c060355040a131554686520555345525452555354204e6574776f726b312e302c06035504031325555345525472757374205253412043657274696669636174696f6e20417574686f7269747930820222300d06092a864886f70d01010105000382020f003082020a028202010080126517360ec3db08b3d0ac570d76edcd27d34cad508361e2aa204d092d6409dcce899fcc3da9ecf6cfc1dcf1d3b1d67b3728112b47da39c6bc3a19b45fa6bd7d9da36342b676f2a93b2b91f8e26fd0ec162090093ee2e874c918b491d46264db7fa306f188186a90223cbcfe13f087147bf6e41f8ed4e451c61167460851cb8614543fbc33fe7e6c9cff169d18bd518e35a6a766c87267db2166b1d49b7803c0503ae8ccf0dcbc9e4cfeaf0596351f575ab7ffcef93db72cb6f654ddc8e7123a4dae4c8ab75c9ab4b7203dca7f2234ae7e3b68660144e7014e46539b3360f794be5337907343f332c353efdbaafe744e69c76b8c6093dec4c70cdfe132aecc933b517895678bee3d56fe0cd0690f1b0ff325266b336df76e47fa7343e57e0ea566b1297c3284635589c40dc19354301913acd37d37a7eb5d3a6c355cdb41d712daa9490bdfd8808a0993628eb566cf2588cd84b8b13fa4390fd9029eeb124c957cf36b05a95e1683ccb867e2e8139dcc5b82d34cb3ed5bffdee573ac233b2d00bf3555740949d849581a7f9236e651920ef3267d1c4d17bcc9ec4326d0bf415f40a94444f499e757879e501f5754a83efd74632fb1506509e658422e431a4cb4f0254759fa041e93d426464a5081b2debe78b7fc6715e1c957841e0f63d6e962bad65f552eea5cc62808042539b80e2ba9f24c971c073f0d52f5edef2f820f0203010001a3423040301d0603551d0e041604145379bf5aaa2b4acf5480e1d89bc09df2b20366cb300e0603551d0f0101ff040403020106300f0603551d130101ff040530030101ff300d06092a864886f70d01010c050003820201005cd47c0dcff7017d4199650c73c5529fcbf8cf99067f1bda43159f9e0255579614f1523c27879428ed1f3a0137a276fc5350c0849bc66b4eba8c214fa28e556291f36915d8bc88e3c4aa0bfdefa8e94b552a06206d55782919ee5f305c4b241155ff249a6e5e2a2bee0b4d9f7ff70138941495430709fb60a9ee1cab128ca09a5ea7986a596d8b3f08fbc8d145af18156490120f73282ec5e2244efc58ecf0f445fe22b3eb2f8ed2d9456105c1976fa876728f8b8c36afbf0d05ce718de6a66f1f6ca67162c5d8d083720cf16711890c9c134c7234dfbcd571dfaa71dde1b96c8c3c125d65dabd5712b6436bffe5de4d661151cf99aeec17b6e871918cde49fedd3571a21527941ccf61e326bb6fa36725215de6dd1d0b2e681b3b82afec836785d4985174b1b9998089ff7f78195c794a602e9240ae4c372a2cc9c762c80e5df7365bcae0252501b4dd1a079c77003fd0dcd5ec3dd4fabb3fcc85d66f7fa92ddfb902f7f5979ab535dac367b0874aa9289e238eff5c276be1b04ff307ee002ed45987cb524195eaf447d7ee6441557c8d590295dd629dc2b9ee5a287484a59bb790c70c07dff589367432d628c1b0b00be09c4cc31cd6fce369b54746812fa282abd3634470c48dff2d33baad8f7bb57088ae3e19cf4028d8fcc890bb5d9922f552e658c51f883143ee881dd7c68e3c436a1da718de7d3d16f162f9ca90a8fd	terminal64.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\2B8F1B57330DBBA2D07A6C51F70EE90DDAB9AD8E\Blob = 0400000001000000100000001bfe69d191b71933a372a80fe155e5b50300000001000000140000002b8f1b57330dbba2d07a6c51f70ee90ddab9ad8e0b00000001000000100000005300650063007400690067006f0000001d0000000100000010000000885010358d29a38f059b028559c95f901400000001000000140000005379bf5aaa2b4acf5480e1d89bc09df2b20366cb620000000100000020000000e793c9b02fd8aa13e21c31228accb08119643b749c898964b1746d46c3d4cbd253000000010000004300000030413022060c2b06010401b231010201050130123010060a2b0601040182373c0101030200c0301b060567810c010330123010060a2b0601040182373c0101030200c0090000000100000054000000305206082b0601050507030206082b06010505070303060a2b0601040182370a030406082b0601050507030406082b0601050507030606082b0601050507030706082b0601050507030106082b060105050703080f000000010000003000000066b764a96581128168cf208e374dda479d54e311f32457f4aee0dbd2a6c8d171d531289e1cd22bfdbbd4cfd9796254832000000001000000e2050000308205de308203c6a003020102021001fd6d30fca3ca51a81bbc640e35032d300d06092a864886f70d01010c0500308188310b3009060355040613025553311330110603550408130a4e6577204a6572736579311430120603550407130b4a65727365792043697479311e301c060355040a131554686520555345525452555354204e6574776f726b312e302c06035504031325555345525472757374205253412043657274696669636174696f6e20417574686f72697479301e170d3130303230313030303030305a170d3338303131383233353935395a308188310b3009060355040613025553311330110603550408130a4e6577204a6572736579311430120603550407130b4a65727365792043697479311e301c060355040a131554686520555345525452555354204e6574776f726b312e302c06035504031325555345525472757374205253412043657274696669636174696f6e20417574686f7269747930820222300d06092a864886f70d01010105000382020f003082020a028202010080126517360ec3db08b3d0ac570d76edcd27d34cad508361e2aa204d092d6409dcce899fcc3da9ecf6cfc1dcf1d3b1d67b3728112b47da39c6bc3a19b45fa6bd7d9da36342b676f2a93b2b91f8e26fd0ec162090093ee2e874c918b491d46264db7fa306f188186a90223cbcfe13f087147bf6e41f8ed4e451c61167460851cb8614543fbc33fe7e6c9cff169d18bd518e35a6a766c87267db2166b1d49b7803c0503ae8ccf0dcbc9e4cfeaf0596351f575ab7ffcef93db72cb6f654ddc8e7123a4dae4c8ab75c9ab4b7203dca7f2234ae7e3b68660144e7014e46539b3360f794be5337907343f332c353efdbaafe744e69c76b8c6093dec4c70cdfe132aecc933b517895678bee3d56fe0cd0690f1b0ff325266b336df76e47fa7343e57e0ea566b1297c3284635589c40dc19354301913acd37d37a7eb5d3a6c355cdb41d712daa9490bdfd8808a0993628eb566cf2588cd84b8b13fa4390fd9029eeb124c957cf36b05a95e1683ccb867e2e8139dcc5b82d34cb3ed5bffdee573ac233b2d00bf3555740949d849581a7f9236e651920ef3267d1c4d17bcc9ec4326d0bf415f40a94444f499e757879e501f5754a83efd74632fb1506509e658422e431a4cb4f0254759fa041e93d426464a5081b2debe78b7fc6715e1c957841e0f63d6e962bad65f552eea5cc62808042539b80e2ba9f24c971c073f0d52f5edef2f820f0203010001a3423040301d0603551d0e041604145379bf5aaa2b4acf5480e1d89bc09df2b20366cb300e0603551d0f0101ff040403020106300f0603551d130101ff040530030101ff300d06092a864886f70d01010c050003820201005cd47c0dcff7017d4199650c73c5529fcbf8cf99067f1bda43159f9e0255579614f1523c27879428ed1f3a0137a276fc5350c0849bc66b4eba8c214fa28e556291f36915d8bc88e3c4aa0bfdefa8e94b552a06206d55782919ee5f305c4b241155ff249a6e5e2a2bee0b4d9f7ff70138941495430709fb60a9ee1cab128ca09a5ea7986a596d8b3f08fbc8d145af18156490120f73282ec5e2244efc58ecf0f445fe22b3eb2f8ed2d9456105c1976fa876728f8b8c36afbf0d05ce718de6a66f1f6ca67162c5d8d083720cf16711890c9c134c7234dfbcd571dfaa71dde1b96c8c3c125d65dabd5712b6436bffe5de4d661151cf99aeec17b6e871918cde49fedd3571a21527941ccf61e326bb6fa36725215de6dd1d0b2e681b3b82afec836785d4985174b1b9998089ff7f78195c794a602e9240ae4c372a2cc9c762c80e5df7365bcae0252501b4dd1a079c77003fd0dcd5ec3dd4fabb3fcc85d66f7fa92ddfb902f7f5979ab535dac367b0874aa9289e238eff5c276be1b04ff307ee002ed45987cb524195eaf447d7ee6441557c8d590295dd629dc2b9ee5a287484a59bb790c70c07dff589367432d628c1b0b00be09c4cc31cd6fce369b54746812fa282abd3634470c48dff2d33baad8f7bb57088ae3e19cf4028d8fcc890bb5d9922f552e658c51f883143ee881dd7c68e3c436a1da718de7d3d16f162f9ca90a8fd	terminal64.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\D1CBCA5DB2D52A7F693B674DE5F05A1D0C957DF0	cathayfutures5setup.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\D1CBCA5DB2D52A7F693B674DE5F05A1D0C957DF0\Blob = 0f00000001000000300000000b043572c899dec43efd590cfce610cf443a6315925ebfe589f7506907e44824608489581c7ca0e041458514cf157614090000000100000054000000305206082b0601050507030206082b06010505070303060a2b0601040182370a030406082b0601050507030406082b0601050507030606082b0601050507030706082b0601050507030106082b0601050507030853000000010000004300000030413022060c2b06010401b231010201050130123010060a2b0601040182373c0101030200c0301b060567810c010330123010060a2b0601040182373c0101030200c06200000001000000200000004ff460d54b9c86dabfbcfc5712e0400d2bed3fbc4d4fbdaa86e06adcd2a9ad7a0b00000001000000180000005300650063007400690067006f00200045004300430000001400000001000000140000003ae10986d4cf19c29676744976dce035c663639a1d0000000100000010000000280cf6042c30a2646644ba7286a3aa97030000000100000014000000d1cbca5db2d52a7f693b674de5f05a1d0c957df02000000001000000930200003082028f30820215a00302010202105c8b99c55a94c5d27156decd8980cc26300a06082a8648ce3d040303308188310b3009060355040613025553311330110603550408130a4e6577204a6572736579311430120603550407130b4a65727365792043697479311e301c060355040a131554686520555345525452555354204e6574776f726b312e302c06035504031325555345525472757374204543432043657274696669636174696f6e20417574686f72697479301e170d3130303230313030303030305a170d3338303131383233353935395a308188310b3009060355040613025553311330110603550408130a4e6577204a6572736579311430120603550407130b4a65727365792043697479311e301c060355040a131554686520555345525452555354204e6574776f726b312e302c06035504031325555345525472757374204543432043657274696669636174696f6e20417574686f726974793076301006072a8648ce3d020106052b81040022036200041aac545aa9f96823e77ad5246f53c65ad84babc6d5b6d1e67371aedd9cd60c61fddba08903b80514ec57ceee5d3fe221b3cef7d48a79e0a3837e2d97d061c4f199dc259163ab7f30a3b470e2c7a1339cf3bf2e5c53b15fb37d327f8a34e37979a3423040301d0603551d0e041604143ae10986d4cf19c29676744976dce035c663639a300e0603551d0f0101ff040403020106300f0603551d130101ff040530030101ff300a06082a8648ce3d040303036800306502303667a11608dce49700411d4ebee16301cf3baa421164a09d94390211795c7b1dfa64b9ee1642b3bf8ac209c4ece4b14d023100e92a61478c524a4b4e1870f6d644d66ef583ba6d58bd24d95648eaefc4a24681886a3a46d1a99b4dc961dad15d576a18	cathayfutures5setup.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\2B8F1B57330DBBA2D07A6C51F70EE90DDAB9AD8E	terminal64.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

Processes:

CathayFXConfig.exe

pid	process
1884	CathayFXConfig.exe
1884	CathayFXConfig.exe
1884	CathayFXConfig.exe
1884	CathayFXConfig.exe
1884	CathayFXConfig.exe
1884	CathayFXConfig.exe
1884	CathayFXConfig.exe
1884	CathayFXConfig.exe
1884	CathayFXConfig.exe
1884	CathayFXConfig.exe
1884	CathayFXConfig.exe
1884	CathayFXConfig.exe
1884	CathayFXConfig.exe
1884	CathayFXConfig.exe
1884	CathayFXConfig.exe
1884	CathayFXConfig.exe
1884	CathayFXConfig.exe
1884	CathayFXConfig.exe
1884	CathayFXConfig.exe
1884	CathayFXConfig.exe
1884	CathayFXConfig.exe
1884	CathayFXConfig.exe
1884	CathayFXConfig.exe
1884	CathayFXConfig.exe
1884	CathayFXConfig.exe
1884	CathayFXConfig.exe
1884	CathayFXConfig.exe
1884	CathayFXConfig.exe
1884	CathayFXConfig.exe
1884	CathayFXConfig.exe
1884	CathayFXConfig.exe
1884	CathayFXConfig.exe
1884	CathayFXConfig.exe
1884	CathayFXConfig.exe
1884	CathayFXConfig.exe
1884	CathayFXConfig.exe
1884	CathayFXConfig.exe
1884	CathayFXConfig.exe
1884	CathayFXConfig.exe
1884	CathayFXConfig.exe
1884	CathayFXConfig.exe
1884	CathayFXConfig.exe
1884	CathayFXConfig.exe
1884	CathayFXConfig.exe
1884	CathayFXConfig.exe
1884	CathayFXConfig.exe
1884	CathayFXConfig.exe
1884	CathayFXConfig.exe
1884	CathayFXConfig.exe
1884	CathayFXConfig.exe
1884	CathayFXConfig.exe
1884	CathayFXConfig.exe
1884	CathayFXConfig.exe
1884	CathayFXConfig.exe
1884	CathayFXConfig.exe
1884	CathayFXConfig.exe
1884	CathayFXConfig.exe
1884	CathayFXConfig.exe
1884	CathayFXConfig.exe
1884	CathayFXConfig.exe
1884	CathayFXConfig.exe
1884	CathayFXConfig.exe
1884	CathayFXConfig.exe
1884	CathayFXConfig.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 9 IoCs

Processes:

msedge.exe

pid process

2140 msedge.exe
2140 msedge.exe
2140 msedge.exe
2140 msedge.exe
2140 msedge.exe
2140 msedge.exe
2140 msedge.exe
2140 msedge.exe
2140 msedge.exe
Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes:

CathayFXConfig.exe

description pid process

Token: SeDebugPrivilege 1884 CathayFXConfig.exe
Suspicious use of FindShellTrayWindow 3 IoCs

Processes:

cathayfutures5setup.exemsedge.exe

pid process

640 cathayfutures5setup.exe
2140 msedge.exe
2140 msedge.exe

pid	process
2140	msedge.exe
2140	msedge.exe
2140	msedge.exe
2140	msedge.exe
2140	msedge.exe
2140	msedge.exe
2140	msedge.exe
2140	msedge.exe
2140	msedge.exe

description	pid	process
Token: SeDebugPrivilege	1884	CathayFXConfig.exe

pid	process
640	cathayfutures5setup.exe
2140	msedge.exe
2140	msedge.exe

Suspicious use of SetWindowsHookEx 49 IoCs

Processes:

terminal64.exeterminal64.exemetaeditor64.exe

pid	process
2740	terminal64.exe
1500	terminal64.exe
1500	terminal64.exe
1500	terminal64.exe
1500	terminal64.exe
1500	terminal64.exe
1500	terminal64.exe
1500	terminal64.exe
1500	terminal64.exe
1500	terminal64.exe
1500	terminal64.exe
1500	terminal64.exe
1500	terminal64.exe
1500	terminal64.exe
1500	terminal64.exe
1500	terminal64.exe
1500	terminal64.exe
1500	terminal64.exe
1500	terminal64.exe
1500	terminal64.exe
1500	terminal64.exe
1500	terminal64.exe
1500	terminal64.exe
1500	terminal64.exe
1500	terminal64.exe
1500	terminal64.exe
1500	terminal64.exe
1500	terminal64.exe
1500	terminal64.exe
1500	terminal64.exe
1500	terminal64.exe
1500	terminal64.exe
1500	terminal64.exe
1500	terminal64.exe
1500	terminal64.exe
1500	terminal64.exe
1500	terminal64.exe
1500	terminal64.exe
1500	terminal64.exe
1500	terminal64.exe
1500	terminal64.exe
1500	terminal64.exe
1500	terminal64.exe
1500	terminal64.exe
1500	terminal64.exe
1500	terminal64.exe
1500	terminal64.exe
1500	terminal64.exe
2448	metaeditor64.exe

Suspicious use of WriteProcessMemory 64 IoCs

Processes:

a8d746ad75f60881430ff0fd0f8f51e8e013953113811a0ed4cd944fdbd09330.execathayfutures5setup.exemsedge.exe

description	pid	process	target process
PID 1840 wrote to memory of 1884	1840	a8d746ad75f60881430ff0fd0f8f51e8e013953113811a0ed4cd944fdbd09330.exe	CathayFXConfig.exe
PID 1840 wrote to memory of 1884	1840	a8d746ad75f60881430ff0fd0f8f51e8e013953113811a0ed4cd944fdbd09330.exe	CathayFXConfig.exe
PID 1840 wrote to memory of 640	1840	a8d746ad75f60881430ff0fd0f8f51e8e013953113811a0ed4cd944fdbd09330.exe	cathayfutures5setup.exe
PID 1840 wrote to memory of 640	1840	a8d746ad75f60881430ff0fd0f8f51e8e013953113811a0ed4cd944fdbd09330.exe	cathayfutures5setup.exe
PID 640 wrote to memory of 2140	640	cathayfutures5setup.exe	msedge.exe
PID 640 wrote to memory of 2140	640	cathayfutures5setup.exe	msedge.exe
PID 2140 wrote to memory of 4780	2140	msedge.exe	msedge.exe
PID 2140 wrote to memory of 4780	2140	msedge.exe	msedge.exe
PID 2140 wrote to memory of 3680	2140	msedge.exe	msedge.exe
PID 2140 wrote to memory of 3680	2140	msedge.exe	msedge.exe
PID 2140 wrote to memory of 3680	2140	msedge.exe	msedge.exe
PID 2140 wrote to memory of 3680	2140	msedge.exe	msedge.exe
PID 2140 wrote to memory of 3680	2140	msedge.exe	msedge.exe
PID 2140 wrote to memory of 3680	2140	msedge.exe	msedge.exe
PID 2140 wrote to memory of 3680	2140	msedge.exe	msedge.exe
PID 2140 wrote to memory of 3680	2140	msedge.exe	msedge.exe
PID 2140 wrote to memory of 3680	2140	msedge.exe	msedge.exe
PID 2140 wrote to memory of 3680	2140	msedge.exe	msedge.exe
PID 2140 wrote to memory of 3680	2140	msedge.exe	msedge.exe
PID 2140 wrote to memory of 3680	2140	msedge.exe	msedge.exe
PID 2140 wrote to memory of 3680	2140	msedge.exe	msedge.exe
PID 2140 wrote to memory of 3680	2140	msedge.exe	msedge.exe
PID 2140 wrote to memory of 3680	2140	msedge.exe	msedge.exe
PID 2140 wrote to memory of 3680	2140	msedge.exe	msedge.exe
PID 2140 wrote to memory of 3680	2140	msedge.exe	msedge.exe
PID 2140 wrote to memory of 3680	2140	msedge.exe	msedge.exe
PID 2140 wrote to memory of 3680	2140	msedge.exe	msedge.exe
PID 2140 wrote to memory of 3680	2140	msedge.exe	msedge.exe
PID 2140 wrote to memory of 3680	2140	msedge.exe	msedge.exe
PID 2140 wrote to memory of 3680	2140	msedge.exe	msedge.exe
PID 2140 wrote to memory of 3680	2140	msedge.exe	msedge.exe
PID 2140 wrote to memory of 3680	2140	msedge.exe	msedge.exe
PID 2140 wrote to memory of 3680	2140	msedge.exe	msedge.exe
PID 2140 wrote to memory of 3680	2140	msedge.exe	msedge.exe
PID 2140 wrote to memory of 3680	2140	msedge.exe	msedge.exe
PID 2140 wrote to memory of 3680	2140	msedge.exe	msedge.exe
PID 2140 wrote to memory of 3680	2140	msedge.exe	msedge.exe
PID 2140 wrote to memory of 3680	2140	msedge.exe	msedge.exe
PID 2140 wrote to memory of 3680	2140	msedge.exe	msedge.exe
PID 2140 wrote to memory of 3680	2140	msedge.exe	msedge.exe
PID 2140 wrote to memory of 3680	2140	msedge.exe	msedge.exe
PID 2140 wrote to memory of 3680	2140	msedge.exe	msedge.exe
PID 2140 wrote to memory of 3680	2140	msedge.exe	msedge.exe
PID 2140 wrote to memory of 3680	2140	msedge.exe	msedge.exe
PID 2140 wrote to memory of 3680	2140	msedge.exe	msedge.exe
PID 2140 wrote to memory of 3680	2140	msedge.exe	msedge.exe
PID 2140 wrote to memory of 3680	2140	msedge.exe	msedge.exe
PID 2140 wrote to memory of 3680	2140	msedge.exe	msedge.exe
PID 2140 wrote to memory of 4896	2140	msedge.exe	msedge.exe
PID 2140 wrote to memory of 4896	2140	msedge.exe	msedge.exe
PID 2140 wrote to memory of 1796	2140	msedge.exe	msedge.exe
PID 2140 wrote to memory of 1796	2140	msedge.exe	msedge.exe
PID 2140 wrote to memory of 1796	2140	msedge.exe	msedge.exe
PID 2140 wrote to memory of 1796	2140	msedge.exe	msedge.exe
PID 2140 wrote to memory of 1796	2140	msedge.exe	msedge.exe
PID 2140 wrote to memory of 1796	2140	msedge.exe	msedge.exe
PID 2140 wrote to memory of 1796	2140	msedge.exe	msedge.exe
PID 2140 wrote to memory of 1796	2140	msedge.exe	msedge.exe
PID 2140 wrote to memory of 1796	2140	msedge.exe	msedge.exe
PID 2140 wrote to memory of 1796	2140	msedge.exe	msedge.exe
PID 2140 wrote to memory of 1796	2140	msedge.exe	msedge.exe
PID 2140 wrote to memory of 1796	2140	msedge.exe	msedge.exe
PID 2140 wrote to memory of 1796	2140	msedge.exe	msedge.exe
PID 2140 wrote to memory of 1796	2140	msedge.exe	msedge.exe

C:\Users\Admin\AppData\Local\Temp\a8d746ad75f60881430ff0fd0f8f51e8e013953113811a0ed4cd944fdbd09330.exe
"C:\Users\Admin\AppData\Local\Temp\a8d746ad75f60881430ff0fd0f8f51e8e013953113811a0ed4cd944fdbd09330.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1840

C:\Program Files (x86)\CathayFutures_FX\CathayFXConfig.exe
"C:\Program Files (x86)\CathayFutures_FX\CathayFXConfig.exe"
2⤵
- Drops file in Drivers directory
- Executes dropped EXE
- Adds Run key to start application
- Drops file in Program Files directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1884

C:\Program Files (x86)\CathayFutures_FX\cathayfutures5setup.exe
"C:\Program Files (x86)\CathayFutures_FX\cathayfutures5setup.exe"
2⤵
- Checks BIOS information in registry
- Checks computer location settings
- Executes dropped EXE
- Writes to the Master Boot Record (MBR)
- Drops file in Program Files directory
- Checks processor information in registry
- Enumerates system info in registry
- Modifies system certificate store
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
PID:640

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://content.mql5.com/go?v=1&link=https%3A//www.mql5.com/en/auth_register&id=ykuizkyahdaqpjsdhdpvmsmoqpfaqjhdcb&a=ccgidfqshcoacujujprnhtfkqctiqgnc&s=fa340bacde3ca2bbaab1856a37465d0a3823b161d1ae476a2ecd3c7b1ba349a1&uid=amqgrvhuyfktdxchdzawcfsrvcnqwhfh&scr_res=1280x720&ref=install.metatrader5.com&ac=167967677031137&utm_codepage=1033&utm_uniq=5000600603034470242&utm_link=A80CB678C59F814BE7DF336C74C3EB4A&ref=www.cathayfut.com.tw
3⤵
- Enumerates system info in registry
- Modifies registry class
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
PID:2140

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xf8,0xfc,0x100,0xd4,0x104,0x7ffbf46446f8,0x7ffbf4644708,0x7ffbf4644718
4⤵
PID:4780

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2128,16849936749109049005,10625914830107086154,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2240 /prefetch:3
4⤵
PID:4896

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2128,16849936749109049005,10625914830107086154,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2188 /prefetch:2
4⤵
PID:3680

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2128,16849936749109049005,10625914830107086154,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2672 /prefetch:8
4⤵
PID:1796

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2128,16849936749109049005,10625914830107086154,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3648 /prefetch:1
4⤵
PID:1668

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2128,16849936749109049005,10625914830107086154,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3640 /prefetch:1
4⤵
PID:1888

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2128,16849936749109049005,10625914830107086154,131072 --disable-gpu-compositing --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4708 /prefetch:1
4⤵
PID:1612

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2128,16849936749109049005,10625914830107086154,131072 --disable-gpu-compositing --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3648 /prefetch:1
4⤵
PID:3280

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2128,16849936749109049005,10625914830107086154,131072 --disable-gpu-compositing --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5152 /prefetch:1
4⤵
PID:760

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2128,16849936749109049005,10625914830107086154,131072 --disable-gpu-compositing --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5688 /prefetch:1
4⤵
PID:1428

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2128,16849936749109049005,10625914830107086154,131072 --disable-gpu-compositing --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5676 /prefetch:1
4⤵
PID:2424

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2128,16849936749109049005,10625914830107086154,131072 --disable-gpu-compositing --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4040 /prefetch:1
4⤵
PID:1032

C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2128,16849936749109049005,10625914830107086154,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5824 /prefetch:8
4⤵
PID:3568

C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\Installer\setup.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\Installer\setup.exe" --configure-user-settings --verbose-logging --system-level --msedge --force-configure-user-settings
4⤵
- Drops file in Program Files directory
PID:2404

C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\Installer\setup.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\Installer\setup.exe" --type=crashpad-handler /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler --database=C:\Windows\TEMP\MsEdgeCrashpad --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\Installer\setup.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0x220,0x224,0x228,0x1fc,0x22c,0x7ff79f495460,0x7ff79f495470,0x7ff79f495480
5⤵
PID:3896

C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2128,16849936749109049005,10625914830107086154,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5824 /prefetch:8
4⤵
PID:760

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2128,16849936749109049005,10625914830107086154,131072 --disable-gpu-compositing --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3420 /prefetch:1
4⤵
PID:6556

C:\Program Files\Cathay Futures\terminal64.exe
"C:\Program Files\Cathay Futures\terminal64.exe" /install
3⤵
- Checks BIOS information in registry
- Executes dropped EXE
- Checks whether UAC is enabled
- Writes to the Master Boot Record (MBR)
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Enumerates system info in registry
- Modifies Internet Explorer settings
- Modifies registry class
- Suspicious use of SetWindowsHookEx
PID:2740

C:\Windows\explorer.exe
"C:\Windows\explorer.exe" "C:\Program Files\Cathay Futures\terminal64.exe"
3⤵
PID:4828

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4204

C:\Windows\explorer.exe
C:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding
1⤵
PID:4580

C:\Program Files\Cathay Futures\terminal64.exe
"C:\Program Files\Cathay Futures\terminal64.exe"
2⤵
- Checks BIOS information in registry
- Executes dropped EXE
- Checks whether UAC is enabled
- Writes to the Master Boot Record (MBR)
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Drops file in Program Files directory
- Checks processor information in registry
- Enumerates system info in registry
- Modifies system certificate store
- Suspicious use of SetWindowsHookEx
PID:1500

C:\Program Files\Cathay Futures\metaeditor64.exe
"C:\Program Files\Cathay Futures\metaeditor64.exe" /portable /compile:"C:\Program Files\Cathay Futures\MQL5" /inc:"C:\Program Files\Cathay Futures\MQL5" /time:0 /flg:0 /stop:se5404_240662000
3⤵
- Executes dropped EXE
- Writes to the Master Boot Record (MBR)
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious use of SetWindowsHookEx
PID:2448

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

T1060

Bootkit

T1067

Privilege Escalation

Defense Evasion

Modify Registry

Install Root Certificate

T1130

Credential Access

Credentials in Files

T1081

Discovery

Query Registry

System Information Discovery