lumma | 96e7875d3e0134218c07b6c78da8d5a2e49008cea091c14a854fddf9fc1cec73

Analysis

max time kernel
147s
max time network
109s
platform
windows7_x64
resource
win7-20230220-en
resource tags

arch:x64arch:x86image:win7-20230220-enlocale:en-usos:windows7-x64system
submitted
29-03-2023 06:19

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

cisco_4.x_installer.msi
Size

124.2MB
MD5

7c505e3aab5a2359ea78b1c65bbd92c1
SHA1

a8c6de80c1e5072bdd097110bd9bd41d4fa336fd
SHA256

96e7875d3e0134218c07b6c78da8d5a2e49008cea091c14a854fddf9fc1cec73
SHA512

11f82a93e61f87a34e9b4ae9ea712337a818de1aecc349885057c54735c0094754f2322bf0967e56d6c289f0da06a198f1128b09356b9d49cb069ffd80364258
SSDEEP

3145728:YFIJVEnmGgZM8KmNJTLAH0D2b/l+GBdSORE:YFA2mfZ5KmNtOnbcGBd9RE

Score

10^/10

lumma persistence stealer

Malware Config

Signatures

Lumma Stealer
An infostealer written in C++ first seen in August 2022.
stealer lumma
Blocklisted process makes network request 3 IoCs

Processes:

msiexec.exemsiexec.exe

flow pid process

2 1424 msiexec.exe
4 1424 msiexec.exe
5 1668 msiexec.exe
Executes dropped EXE 7 IoCs

Processes:

ontrade.exeontrade.exetimeout.exeontrade.exeMSI1E6D.tmppython.exepython.exe

pid process

1096 ontrade.exe
556 ontrade.exe
932 timeout.exe
1580 ontrade.exe
1900 MSI1E6D.tmp
1020 python.exe
1124 python.exe

flow	pid	process
2	1424	msiexec.exe
4	1424	msiexec.exe
5	1668	msiexec.exe

Loads dropped DLL 23 IoCs

Processes:

MsiExec.exeMsiExec.exeontrade.exetimeout.execmd.exepython.exepython.exe

pid	process
1544	MsiExec.exe
1544	MsiExec.exe
1544	MsiExec.exe
1544	MsiExec.exe
1544	MsiExec.exe
1056	MsiExec.exe
1056	MsiExec.exe
1056	MsiExec.exe
556	ontrade.exe
556	ontrade.exe
556	ontrade.exe
556	ontrade.exe
556	ontrade.exe
932	timeout.exe
932	timeout.exe
932	timeout.exe
932	timeout.exe
932	timeout.exe
1056	MsiExec.exe
1544	MsiExec.exe
1884	cmd.exe
1020	python.exe
1124	python.exe

Registers COM server for autorun 1 TTPs 10 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Processes:

ontrade.exe

description	ioc	process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{8EC1A250-C769-4E55-A2ED-D7E759F43AE1}\LocalServer32	ontrade.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{8EC1A250-C769-4E55-A2ED-D7E759F43AE1}\LocalServer32\ = "C:\\PROGRA~2\\Ontrade\\ontrade.exe"	ontrade.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{3DA1DC10-B9F1-4B5B-8ED9-2E87A39A1699}\LocalServer32\ = "C:\\PROGRA~2\\Ontrade\\ontrade.exe"	ontrade.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{53387750-7A95-4F5E-B1CC-0B65BB58430E}\LocalServer32\ = "C:\\PROGRA~2\\Ontrade\\ontrade.exe"	ontrade.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{F213E74A-C207-4320-93C6-24613FAFC33D}\LocalServer32	ontrade.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{F213E74A-C207-4320-93C6-24613FAFC33D}\LocalServer32\ = "C:\\PROGRA~2\\Ontrade\\ontrade.exe"	ontrade.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{3DA1DC10-B9F1-4B5B-8ED9-2E87A39A1699}\LocalServer32	ontrade.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{EC07ED40-A510-4856-AE26-752339F64682}\LocalServer32	ontrade.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{EC07ED40-A510-4856-AE26-752339F64682}\LocalServer32\ = "C:\\PROGRA~2\\Ontrade\\ontrade.exe"	ontrade.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{53387750-7A95-4F5E-B1CC-0B65BB58430E}\LocalServer32	ontrade.exe

Enumerates connected drives 3 TTPs 48 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

Processes:

msiexec.exemsiexec.exe

description	ioc	process
File opened (read-only)	\??\I:	msiexec.exe
File opened (read-only)	\??\M:	msiexec.exe
File opened (read-only)	\??\Q:	msiexec.exe
File opened (read-only)	\??\R:	msiexec.exe
File opened (read-only)	\??\U:	msiexec.exe
File opened (read-only)	\??\Y:	msiexec.exe
File opened (read-only)	\??\B:	msiexec.exe
File opened (read-only)	\??\H:	msiexec.exe
File opened (read-only)	\??\G:	msiexec.exe
File opened (read-only)	\??\L:	msiexec.exe
File opened (read-only)	\??\T:	msiexec.exe
File opened (read-only)	\??\Z:	msiexec.exe
File opened (read-only)	\??\Q:	msiexec.exe
File opened (read-only)	\??\X:	msiexec.exe
File opened (read-only)	\??\F:	msiexec.exe
File opened (read-only)	\??\J:	msiexec.exe
File opened (read-only)	\??\A:	msiexec.exe
File opened (read-only)	\??\F:	msiexec.exe
File opened (read-only)	\??\K:	msiexec.exe
File opened (read-only)	\??\M:	msiexec.exe
File opened (read-only)	\??\L:	msiexec.exe
File opened (read-only)	\??\P:	msiexec.exe
File opened (read-only)	\??\T:	msiexec.exe
File opened (read-only)	\??\W:	msiexec.exe
File opened (read-only)	\??\B:	msiexec.exe
File opened (read-only)	\??\R:	msiexec.exe
File opened (read-only)	\??\S:	msiexec.exe
File opened (read-only)	\??\E:	msiexec.exe
File opened (read-only)	\??\Z:	msiexec.exe
File opened (read-only)	\??\W:	msiexec.exe
File opened (read-only)	\??\N:	msiexec.exe
File opened (read-only)	\??\O:	msiexec.exe
File opened (read-only)	\??\U:	msiexec.exe
File opened (read-only)	\??\A:	msiexec.exe
File opened (read-only)	\??\S:	msiexec.exe
File opened (read-only)	\??\X:	msiexec.exe
File opened (read-only)	\??\E:	msiexec.exe
File opened (read-only)	\??\I:	msiexec.exe
File opened (read-only)	\??\N:	msiexec.exe
File opened (read-only)	\??\V:	msiexec.exe
File opened (read-only)	\??\V:	msiexec.exe
File opened (read-only)	\??\J:	msiexec.exe
File opened (read-only)	\??\O:	msiexec.exe
File opened (read-only)	\??\P:	msiexec.exe
File opened (read-only)	\??\K:	msiexec.exe
File opened (read-only)	\??\H:	msiexec.exe
File opened (read-only)	\??\G:	msiexec.exe
File opened (read-only)	\??\Y:	msiexec.exe

Drops file in Program Files directory 64 IoCs

Processes:

msiexec.exepowershell.exe

description	ioc	process
File created	C:\Program Files (x86)\Ontrade\Marketpages\tullettprebon_gbp_govdebt.html	msiexec.exe
File created	C:\Program Files (x86)\Ontrade\Marketpages\tullettprebon_jpy_swaptions.html	msiexec.exe
File created	C:\Program Files (x86)\Ontrade\Marketpages\infront_fxfwd_sek.html	msiexec.exe
File opened for modification	C:\Program Files (x86)\Ontrade\%ProgramData%\Microsoft\Windows\Start Menu\Programs\Accessories\Windows PowerShell\Windows PowerShell.lnk	powershell.exe
File created	C:\Program Files (x86)\Ontrade\setup\Holdings Result Basic.MarketGrids.col	msiexec.exe
File created	C:\Program Files (x86)\Ontrade\Marketpages\infront_cz_composite.html	msiexec.exe
File created	C:\Program Files (x86)\Ontrade\Marketpages\infront_liborfixings.html	msiexec.exe
File created	C:\Program Files (x86)\Ontrade\Marketpages\flags_us.png	msiexec.exe
File created	C:\Program Files (x86)\Ontrade\setup\ByMarket.TradesView.gv	msiexec.exe
File created	C:\Program Files (x86)\Ontrade\setup\Blair Williams Alligator.infront-ctf	msiexec.exe
File created	C:\Program Files (x86)\Ontrade\Marketpages\infront_isk_composite.html	msiexec.exe
File created	C:\Program Files (x86)\Ontrade\Marketpages\infront_uk_composite.html	msiexec.exe
File created	C:\Program Files (x86)\Ontrade\Marketpages\swedbank_fx_composite.html	msiexec.exe
File created	C:\Program Files (x86)\Ontrade\Marketpages\tullettprebon_sek_swaptions.html	msiexec.exe
File created	C:\Program Files (x86)\Ontrade\setup\small_intr_template_light-theme.dctf	msiexec.exe
File created	C:\Program Files (x86)\Ontrade\Commands3.ini	msiexec.exe
File created	C:\Program Files (x86)\Ontrade\DynamicOverrides.xml	msiexec.exe
File created	C:\Program Files (x86)\Ontrade\setup\DarkBlue.skn	msiexec.exe
File created	C:\Program Files (x86)\Ontrade\setup\HighContrast.skn	msiexec.exe
File created	C:\Program Files (x86)\Ontrade\setup\MotionDetectorMACross_light.dctf	msiexec.exe
File created	C:\Program Files (x86)\Ontrade\setup\Portfolio Result Extended.Holdings.lay	msiexec.exe
File created	C:\Program Files (x86)\Ontrade\Cef\cef.pak	msiexec.exe
File created	C:\Program Files (x86)\Ontrade\Marketpages\infront_fxfwd_isk.html	msiexec.exe
File created	C:\Program Files (x86)\Ontrade\locale\fi\lc_messages\plurals.mo	msiexec.exe
File created	C:\Program Files (x86)\Ontrade\Marketpages\tullettprebon_usd_composite.html	msiexec.exe
File created	C:\Program Files (x86)\Ontrade\setup\ByBasket.OrdersView.gv	msiexec.exe
File created	C:\Program Files (x86)\Ontrade\locale\en_321\LC_MESSAGES\plurals.mo	msiexec.exe
File created	C:\Program Files (x86)\Ontrade\setup\ByAsset.AssetsView.gv	msiexec.exe
File created	C:\Program Files (x86)\Ontrade\setup\Portfolio.FactoryDefault.lay	msiexec.exe
File created	C:\Program Files (x86)\Ontrade\setup\JPY BMK.slc	msiexec.exe
File created	C:\Program Files (x86)\Ontrade\Marketpages\infront_itraxx_indices.html	msiexec.exe
File created	C:\Program Files (x86)\Ontrade\Marketpages\infront_sek_mortagebonds.html	msiexec.exe
File created	C:\Program Files (x86)\Ontrade\Marketpages\infront_sek_mortageloanfixings.html	msiexec.exe
File created	C:\Program Files (x86)\Ontrade\Marketpages\shadow-right.gif	msiexec.exe
File created	C:\Program Files (x86)\Ontrade\setup\Forex Basic.MarketGrids.col	msiexec.exe
File created	C:\Program Files (x86)\Ontrade\setup\ByStrategy.OrdersView.gv	msiexec.exe
File created	C:\Program Files (x86)\Ontrade\setup\CompanyOverview_Light.dctf	msiexec.exe
File created	C:\Program Files (x86)\Ontrade\Marketpages\infront_fx_composite_mc.html	msiexec.exe
File created	C:\Program Files (x86)\Ontrade\locale\de\LC_MESSAGES\default.mo	msiexec.exe
File created	C:\Program Files (x86)\Ontrade\Cef\chrome_elf.dll	msiexec.exe
File created	C:\Program Files (x86)\Ontrade\setup\small_hist_template_withlast.dctf	msiexec.exe
File created	C:\Program Files (x86)\Ontrade\locale\de\LC_MESSAGES\plurals.mo	msiexec.exe
File created	C:\Program Files (x86)\Ontrade\Marketpages\resource.gif	msiexec.exe
File created	C:\Program Files (x86)\Ontrade\Marketpages\tullettprebon_zar_composite.html	msiexec.exe
File created	C:\Program Files (x86)\Ontrade\setup\MotionDetectorMACross_dark.dctf	msiexec.exe
File created	C:\Program Files (x86)\Ontrade\setup\NLG BMK.slc	msiexec.exe
File created	C:\Program Files (x86)\Ontrade\Marketpages\infront_sa_composite.html	msiexec.exe
File created	C:\Program Files (x86)\Ontrade\Marketpages\tullettprebon_benchmarks_composite.html	msiexec.exe
File created	C:\Program Files (x86)\Ontrade\setup\Whidbey.skn	msiexec.exe
File created	C:\Program Files (x86)\Ontrade\setup\InfrontDefault.skn	msiexec.exe
File created	C:\Program Files (x86)\Ontrade\setup\Portfolio Result.Holdings.lay	msiexec.exe
File created	C:\Program Files (x86)\Ontrade\setup\Mid price charting.infront-ctf	msiexec.exe
File created	C:\Program Files (x86)\Ontrade\setup\Default.IssuerRatings.col	msiexec.exe
File created	C:\Program Files (x86)\Ontrade\setup\ByYearMonth.AssetsView.gv	msiexec.exe
File created	C:\Program Files (x86)\Ontrade\Marketpages\infront_fx_composite.html	msiexec.exe
File created	C:\Program Files (x86)\Ontrade\Marketpages\infront_global_composite.html	msiexec.exe
File created	C:\Program Files (x86)\Ontrade\setup\Fixed Income.MarketGrids.col	msiexec.exe
File created	C:\Program Files (x86)\Ontrade\setup\ByAssetPM.ClosedPosView.gv	msiexec.exe
File created	C:\Program Files (x86)\Ontrade\Marketpages\infront_futures_equities.html	msiexec.exe
File created	C:\Program Files (x86)\Ontrade\setup\Holdings.FactoryDefault.lay	msiexec.exe
File created	C:\Program Files (x86)\Ontrade\setup\Default.FundsPerformance.col	msiexec.exe
File created	C:\Program Files (x86)\Ontrade\Marketpages\tullettprebon_gbp_composite.html	msiexec.exe
File created	C:\Program Files (x86)\Ontrade\pytransform\__init__.py	msiexec.exe
File created	C:\Program Files (x86)\Ontrade\locale\pl\lc_messages\default.mo	msiexec.exe

Drops file in Windows directory 19 IoCs

Processes:

msiexec.exe

description	ioc	process
File created	C:\Windows\Installer\6c5bf8.ipi	msiexec.exe
File created	C:\Windows\Installer\6c5bf6.msi	msiexec.exe
File opened for modification	C:\Windows\Installer\6c5bf6.msi	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI6FDE.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI7146.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI72BE.tmp	msiexec.exe
File created	C:\Windows\Installer\6c5bfa.msi	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI8E1D.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\	msiexec.exe
File created	C:\Windows\Installer\{E57796A2-EA95-4AF6-9991-C952D68CCE45}\ontrade.exe	msiexec.exe
File opened for modification	C:\Windows\Installer\{E57796A2-EA95-4AF6-9991-C952D68CCE45}\ontrade.exe	msiexec.exe
File opened for modification	C:\Windows\Installer\MSIAFA2.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI1EAE.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI6BD7.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI706B.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI778F.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI147E.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI1E6D.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\6c5bf8.ipi	msiexec.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082
Delays execution with timeout.exe 4 IoCs
evasion

Processes:

timeout.exetimeout.exetimeout.exetimeout.exe

pid process

1728 timeout.exe
932 timeout.exe
1700 timeout.exe
1692 timeout.exe

pid	process
1728	timeout.exe
932	timeout.exe
1700	timeout.exe
1692	timeout.exe

Modifies Internet Explorer settings 1 TTPs 2 IoCs

adware spyware

Modify Registry

T1112

Processes:

ontrade.exe

description	ioc	process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\MAIN\FeatureControl\FEATURE_BROWSER_EMULATION\ontrade.exe = "11000"	ontrade.exe
Key created	\REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_BROWSER_EMULATION	ontrade.exe

Modifies data under HKEY_USERS 64 IoCs

Processes:

ontrade.exemsiexec.exeontrade.exeontrade.exetimeout.exe

description	ioc	process
Set value (int)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Infront\ontrade\Orderbook\Defaults\Width = "250"	ontrade.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Infront\ontrade\SingleClick\Defaults\Top = "4294967295"	ontrade.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Infront\ontrade\Orderbook\Defaults\WidthMM = "475"	ontrade.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\2E	msiexec.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Infront\ontrade\ConsolidatedOrderbook\Defaults\Height = "97"	ontrade.exe
Key created	\REGISTRY\USER\.DEFAULT\Software	ontrade.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows NT	ontrade.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows NT\CurrentVersion	ontrade.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Infront\ontrade\ConsolidatedOrderbook\Defaults\Width = "250"	ontrade.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Infront	ontrade.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Infront\ontrade\Orderbook\Defaults\HeightForex = "110"	ontrade.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Infront\ontrade\ReverseAllLists = "1"	ontrade.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Infront\ontrade\ConsolidatedOrderbook	ontrade.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Infront\ontrade\Orderbook\Defaults\Top = "4294967295"	ontrade.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Infront\ontrade\ConsolidatedOrderbook\Defaults\WidthMMCount = "325"	ontrade.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Infront\ontrade\Portfolio\Defaults\Width = "216"	ontrade.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Infront\ontrade\Portfolio\Defaults	ontrade.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Infront\ontrade\PortfolioChart\Defaults	ontrade.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Infront\ontrade\Orderbook	ontrade.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Infront\ontrade\PortfolioChart	ontrade.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Infront\ontrade\PortfolioChart\Defaults	ontrade.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Infront\ontrade\Orderbook\Defaults\WidthMMCount = "325"	ontrade.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Infront\ontrade\Portfolio\Defaults\Width = "216"	ontrade.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Infront\ontrade\Orderbook	ontrade.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Infront\ontrade\PortfolioChart\Defaults\Width = "350"	ontrade.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Infront\ontrade\Orderbook\Defaults\Height = "137"	ontrade.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Infront\ontrade\PortfolioChart	ontrade.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Infront\ontrade\Orderbook\Defaults\Top = "4294967295"	ontrade.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Direct3D\MostRecentApplication\Name = "ontrade.exe"	ontrade.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Infront\ontrade\SingleClick\Defaults\HorizHeight = "0"	ontrade.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Infront\ontrade	ontrade.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Infront\ontrade\Portfolio	ontrade.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Infront\ontrade\Orderbook\Defaults\WidthMM = "475"	ontrade.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Infront\ontrade\SingleClick\Defaults\Left = "4294967295"	ontrade.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Network\Location Awareness	ontrade.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Infront\ontrade\Orderbook\Defaults\WidthMM = "475"	ontrade.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Infront\ontrade\Portfolio\Defaults	ontrade.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Infront\ontrade\Orderbook\Defaults	ontrade.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Infront\ontrade\OrderEntry	ontrade.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Direct3D\MostRecentApplication	ontrade.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Infront\ontrade\Orderbook\Defaults\WidthMMCount = "325"	ontrade.exe
Key deleted	\REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\2D\52C64B7E	msiexec.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Infront\ontrade\OrderEntry\BasketTrading	ontrade.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Infront\ontrade\Orderbook\Defaults\Left = "4294967295"	ontrade.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Infront\ontrade\Orderbook\Defaults\WidthForex = "190"	ontrade.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Infront\ontrade\SingleClick\Defaults	ontrade.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Infront\ontrade\SingleClick	ontrade.exe
Key created	\REGISTRY\USER\S-1-5-18\	ontrade.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Infront\ontrade\OrderEntry	ontrade.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Infront\ontrade\SingleClick\Defaults\VertHeight = "0"	ontrade.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Infront\ontrade\ConsolidatedOrderbook	ontrade.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Infront\ontrade\Orderbook\Defaults\Width = "250"	ontrade.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Infront\ontrade\Orderbook\Defaults\WidthMMCount = "325"	ontrade.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Infront\ontrade\PortfolioChart\Defaults\Height = "300"	ontrade.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Infront\ontrade\ConsolidatedOrderbook\Defaults	ontrade.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Infront\ontrade\ConsolidatedOrderbook\Defaults\WidthMM = "475"	ontrade.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Infront\ontrade\OrderEntry\ProgramTrading	ontrade.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Infront\ontrade\Orderbook	ontrade.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Infront\ontrade\SingleClick\Defaults\Top = "4294967295"	ontrade.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Infront\ontrade\SingleClick\Defaults\HorizHeight = "0"	ontrade.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Infront\ontrade\OrderEntry\ProgramTrading	ontrade.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Direct3D\MostRecentApplication\Name = "OntradeCEF.exe"	timeout.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Infront\ontrade\Orderbook	ontrade.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Infront\ontrade\Orderbook\Defaults\Left = "4294967295"	ontrade.exe

Modifies registry class 64 IoCs

Processes:

ontrade.exemsiexec.exeontrade.exerundll32.exe

description	ioc	process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{EC07ED40-A510-4856-AE26-752339F64682}\Version	ontrade.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{258A436E-5CAA-4034-BA55-F1F44EF278AA}\1.0\FLAGS\ = "0"	ontrade.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{258A436E-5CAA-4034-BA55-F1F44EF278AA}\1.0\HELPDIR\ = "C:\\Program Files (x86)\\Ontrade\\"	ontrade.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{3DE392B4-0A67-47FA-882C-A688A0F536E8}\ProxyStubClsid32\ = "{00020424-0000-0000-C000-000000000046}"	ontrade.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{3DE392B4-0A67-47FA-882C-A688A0F536E8}\TypeLib\Version = "1.0"	ontrade.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{8EC1A250-C769-4E55-A2ED-D7E759F43AE1}	ontrade.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\2A69775E59AE6FA499199C256DC8EC54\PackageCode = "DB4FB4A8E0157AA4496088A978AC8822"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{03D6675B-8494-4D9E-A3B6-D4435ABAAB75}	ontrade.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{3DA1DC10-B9F1-4B5B-8ED9-2E87A39A1699}\ = "BrokerStats Object"	ontrade.exe
Key created	\REGISTRY\MACHINE\Software\Classes\infront\shell\open\command	ontrade.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{B52C974C-D966-4E3B-8DB4-A1AA3CEC9697}\ProxyStubClsid32	ontrade.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{EC07ED40-A510-4856-AE26-752339F64682}\Version	ontrade.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{53387750-7A95-4F5E-B1CC-0B65BB58430E}\TypeLib\ = "{258A436E-5CAA-4034-BA55-F1F44EF278AA}"	ontrade.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\infront\shell\open\command\ = "\"C:\\Program Files (x86)\\Ontrade\\ontrade.exe\" /shared-form=\"%1\""	ontrade.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{35E08438-FCD3-4533-8818-E68AEB793E93}	ontrade.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\2A69775E59AE6FA499199C256DC8EC54\Feature_10 = "Feature"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{B52C974C-D966-4E3B-8DB4-A1AA3CEC9697}\ProxyStubClsid32	ontrade.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{F213E74A-C207-4320-93C6-24613FAFC33D}	ontrade.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{F213E74A-C207-4320-93C6-24613FAFC33D}\ProgID\ = "Ontrade.Hist"	ontrade.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{EC07ED40-A510-4856-AE26-752339F64682}\ = "Estimates Object"	ontrade.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\2A69775E59AE6FA499199C256DC8EC54\Assignment = "1"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{258A436E-5CAA-4034-BA55-F1F44EF278AA}\1.0\0	ontrade.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{53387750-7A95-4F5E-B1CC-0B65BB58430E}\LocalServer32	ontrade.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{BAFFF425-15DE-4028-A7CA-635890C50F15}\TypeLib	ontrade.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{F213E74A-C207-4320-93C6-24613FAFC33D}\ = "Hist Object"	ontrade.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{F213E74A-C207-4320-93C6-24613FAFC33D}\LocalServer32	ontrade.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Ontrade.Estimates	ontrade.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\UpgradeCodes\64E4E4290A4D8CC4DAD4CC131F1A50A2	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{39A2DFD8-019F-496A-A7E4-D860B1F912D3}\TypeLib\Version = "1.0"	ontrade.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{B52C974C-D966-4E3B-8DB4-A1AA3CEC9697}\ = "IEstimates"	ontrade.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{03D6675B-8494-4D9E-A3B6-D4435ABAAB75}\TypeLib\Version = "1.0"	ontrade.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{8EC1A250-C769-4E55-A2ED-D7E759F43AE1}\LocalServer32\ = "C:\\PROGRA~2\\Ontrade\\ontrade.exe"	ontrade.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\2A69775E59AE6FA499199C256DC8EC54\Version = "134611706"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{B52C974C-D966-4E3B-8DB4-A1AA3CEC9697}	ontrade.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{BAFFF425-15DE-4028-A7CA-635890C50F15}\TypeLib\Version = "1.0"	ontrade.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{8AD68CDC-DF0B-4BE1-BC28-F7928DC73FE3}\TypeLib\ = "{258A436E-5CAA-4034-BA55-F1F44EF278AA}"	ontrade.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\2A69775E59AE6FA499199C256DC8EC54	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{8AD68CDC-DF0B-4BE1-BC28-F7928DC73FE3}\ = "ISonjaRTD"	ontrade.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{8EC1A250-C769-4E55-A2ED-D7E759F43AE1}\TypeLib	ontrade.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{53387750-7A95-4F5E-B1CC-0B65BB58430E}\LocalServer32\ = "C:\\PROGRA~2\\Ontrade\\ontrade.exe"	ontrade.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Ontrade.BrokerStats\Clsid\ = "{3DA1DC10-B9F1-4B5B-8ED9-2E87A39A1699}"	ontrade.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{3DA1DC10-B9F1-4B5B-8ED9-2E87A39A1699}\Version\ = "1.0"	ontrade.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Ontrade.Quotes\Clsid\ = "{53387750-7A95-4F5E-B1CC-0B65BB58430E}"	ontrade.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{8AD68CDC-DF0B-4BE1-BC28-F7928DC73FE3}\TypeLib\Version = "1.0"	ontrade.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{3DE392B4-0A67-47FA-882C-A688A0F536E8}\ProxyStubClsid32	ontrade.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Ontrade.Hist\Clsid\ = "{F213E74A-C207-4320-93C6-24613FAFC33D}"	ontrade.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{3DA1DC10-B9F1-4B5B-8ED9-2E87A39A1699}\ProgID\ = "Ontrade.BrokerStats"	ontrade.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{EC07ED40-A510-4856-AE26-752339F64682}	ontrade.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{EC07ED40-A510-4856-AE26-752339F64682}\ProgID\ = "Ontrade.Estimates"	ontrade.exe
Key created	\REGISTRY\USER\S-1-5-21-1563773381-2037468142-1146002597-1000_CLASSES\py_auto_file\shell	rundll32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{B52C974C-D966-4E3B-8DB4-A1AA3CEC9697}\TypeLib	ontrade.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{03D6675B-8494-4D9E-A3B6-D4435ABAAB75}\TypeLib	ontrade.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{8AD68CDC-DF0B-4BE1-BC28-F7928DC73FE3}	ontrade.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{8EC1A250-C769-4E55-A2ED-D7E759F43AE1}\LocalServer32\ = "C:\\PROGRA~2\\Ontrade\\ontrade.exe"	ontrade.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{8EC1A250-C769-4E55-A2ED-D7E759F43AE1}\Version	ontrade.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{EC07ED40-A510-4856-AE26-752339F64682}	ontrade.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{53387750-7A95-4F5E-B1CC-0B65BB58430E}\Version	ontrade.exe
Key created	\REGISTRY\MACHINE\Software\Classes\infront	ontrade.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{03D6675B-8494-4D9E-A3B6-D4435ABAAB75}\ProxyStubClsid32\ = "{00020424-0000-0000-C000-000000000046}"	ontrade.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{35E08438-FCD3-4533-8818-E68AEB793E93}\ = "IInfrontApplication"	ontrade.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{8AD68CDC-DF0B-4BE1-BC28-F7928DC73FE3}\TypeLib	ontrade.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{8EC1A250-C769-4E55-A2ED-D7E759F43AE1}\Version\ = "1.0"	ontrade.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{3DE392B4-0A67-47FA-882C-A688A0F536E8}\TypeLib	ontrade.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{3DE392B4-0A67-47FA-882C-A688A0F536E8}\TypeLib\ = "{258A436E-5CAA-4034-BA55-F1F44EF278AA}"	ontrade.exe

Suspicious behavior: EnumeratesProcesses 14 IoCs

Processes:

msiexec.exeontrade.exeontrade.exetimeout.exeontrade.exepowershell.exepowershell.exepowershell.exe

pid	process
1668	msiexec.exe
1668	msiexec.exe
1096	ontrade.exe
1096	ontrade.exe
556	ontrade.exe
556	ontrade.exe
932	timeout.exe
932	timeout.exe
932	timeout.exe
1580	ontrade.exe
1580	ontrade.exe
1560	powershell.exe
1232	powershell.exe
1640	powershell.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

Processes:

msiexec.exemsiexec.exe

description	pid	process
Token: SeShutdownPrivilege	1424	msiexec.exe
Token: SeIncreaseQuotaPrivilege	1424	msiexec.exe
Token: SeRestorePrivilege	1668	msiexec.exe
Token: SeTakeOwnershipPrivilege	1668	msiexec.exe
Token: SeSecurityPrivilege	1668	msiexec.exe
Token: SeCreateTokenPrivilege	1424	msiexec.exe
Token: SeAssignPrimaryTokenPrivilege	1424	msiexec.exe
Token: SeLockMemoryPrivilege	1424	msiexec.exe
Token: SeIncreaseQuotaPrivilege	1424	msiexec.exe
Token: SeMachineAccountPrivilege	1424	msiexec.exe
Token: SeTcbPrivilege	1424	msiexec.exe
Token: SeSecurityPrivilege	1424	msiexec.exe
Token: SeTakeOwnershipPrivilege	1424	msiexec.exe
Token: SeLoadDriverPrivilege	1424	msiexec.exe
Token: SeSystemProfilePrivilege	1424	msiexec.exe
Token: SeSystemtimePrivilege	1424	msiexec.exe
Token: SeProfSingleProcessPrivilege	1424	msiexec.exe
Token: SeIncBasePriorityPrivilege	1424	msiexec.exe
Token: SeCreatePagefilePrivilege	1424	msiexec.exe
Token: SeCreatePermanentPrivilege	1424	msiexec.exe
Token: SeBackupPrivilege	1424	msiexec.exe
Token: SeRestorePrivilege	1424	msiexec.exe
Token: SeShutdownPrivilege	1424	msiexec.exe
Token: SeDebugPrivilege	1424	msiexec.exe
Token: SeAuditPrivilege	1424	msiexec.exe
Token: SeSystemEnvironmentPrivilege	1424	msiexec.exe
Token: SeChangeNotifyPrivilege	1424	msiexec.exe
Token: SeRemoteShutdownPrivilege	1424	msiexec.exe
Token: SeUndockPrivilege	1424	msiexec.exe
Token: SeSyncAgentPrivilege	1424	msiexec.exe
Token: SeEnableDelegationPrivilege	1424	msiexec.exe
Token: SeManageVolumePrivilege	1424	msiexec.exe
Token: SeImpersonatePrivilege	1424	msiexec.exe
Token: SeCreateGlobalPrivilege	1424	msiexec.exe
Token: SeRestorePrivilege	1668	msiexec.exe
Token: SeTakeOwnershipPrivilege	1668	msiexec.exe
Token: SeRestorePrivilege	1668	msiexec.exe
Token: SeTakeOwnershipPrivilege	1668	msiexec.exe
Token: SeRestorePrivilege	1668	msiexec.exe
Token: SeTakeOwnershipPrivilege	1668	msiexec.exe
Token: SeRestorePrivilege	1668	msiexec.exe
Token: SeTakeOwnershipPrivilege	1668	msiexec.exe
Token: SeRestorePrivilege	1668	msiexec.exe
Token: SeTakeOwnershipPrivilege	1668	msiexec.exe
Token: SeRestorePrivilege	1668	msiexec.exe
Token: SeTakeOwnershipPrivilege	1668	msiexec.exe
Token: SeRestorePrivilege	1668	msiexec.exe
Token: SeTakeOwnershipPrivilege	1668	msiexec.exe
Token: SeRestorePrivilege	1668	msiexec.exe
Token: SeTakeOwnershipPrivilege	1668	msiexec.exe
Token: SeRestorePrivilege	1668	msiexec.exe
Token: SeTakeOwnershipPrivilege	1668	msiexec.exe
Token: SeRestorePrivilege	1668	msiexec.exe
Token: SeTakeOwnershipPrivilege	1668	msiexec.exe
Token: SeRestorePrivilege	1668	msiexec.exe
Token: SeTakeOwnershipPrivilege	1668	msiexec.exe
Token: SeRestorePrivilege	1668	msiexec.exe
Token: SeTakeOwnershipPrivilege	1668	msiexec.exe
Token: SeRestorePrivilege	1668	msiexec.exe
Token: SeTakeOwnershipPrivilege	1668	msiexec.exe
Token: SeRestorePrivilege	1668	msiexec.exe
Token: SeTakeOwnershipPrivilege	1668	msiexec.exe
Token: SeRestorePrivilege	1668	msiexec.exe
Token: SeTakeOwnershipPrivilege	1668	msiexec.exe

Suspicious use of FindShellTrayWindow 2 IoCs

Processes:

msiexec.exe

pid process

1424 msiexec.exe
1424 msiexec.exe

pid	process
1424	msiexec.exe
1424	msiexec.exe

Suspicious use of SetWindowsHookEx 11 IoCs

Processes:

ontrade.exeontrade.exeontrade.exeAcroRd32.exe

pid	process
1096	ontrade.exe
1096	ontrade.exe
1096	ontrade.exe
556	ontrade.exe
556	ontrade.exe
556	ontrade.exe
1580	ontrade.exe
1580	ontrade.exe
1580	ontrade.exe
1504	AcroRd32.exe
1504	AcroRd32.exe

Suspicious use of WriteProcessMemory 64 IoCs

Processes:

msiexec.exeMsiExec.exeontrade.exeMSI1E6D.tmpcmd.exepython.exe

description	pid	process	target process
PID 1668 wrote to memory of 1544	1668	msiexec.exe	MsiExec.exe
PID 1668 wrote to memory of 1544	1668	msiexec.exe	MsiExec.exe
PID 1668 wrote to memory of 1544	1668	msiexec.exe	MsiExec.exe
PID 1668 wrote to memory of 1544	1668	msiexec.exe	MsiExec.exe
PID 1668 wrote to memory of 1544	1668	msiexec.exe	MsiExec.exe
PID 1668 wrote to memory of 1544	1668	msiexec.exe	MsiExec.exe
PID 1668 wrote to memory of 1544	1668	msiexec.exe	MsiExec.exe
PID 1668 wrote to memory of 1056	1668	msiexec.exe	MsiExec.exe
PID 1668 wrote to memory of 1056	1668	msiexec.exe	MsiExec.exe
PID 1668 wrote to memory of 1056	1668	msiexec.exe	MsiExec.exe
PID 1668 wrote to memory of 1056	1668	msiexec.exe	MsiExec.exe
PID 1668 wrote to memory of 1056	1668	msiexec.exe	MsiExec.exe
PID 1668 wrote to memory of 1056	1668	msiexec.exe	MsiExec.exe
PID 1668 wrote to memory of 1056	1668	msiexec.exe	MsiExec.exe
PID 1056 wrote to memory of 1096	1056	MsiExec.exe	ontrade.exe
PID 1056 wrote to memory of 1096	1056	MsiExec.exe	ontrade.exe
PID 1056 wrote to memory of 1096	1056	MsiExec.exe	ontrade.exe
PID 1056 wrote to memory of 1096	1056	MsiExec.exe	ontrade.exe
PID 1056 wrote to memory of 556	1056	MsiExec.exe	ontrade.exe
PID 1056 wrote to memory of 556	1056	MsiExec.exe	ontrade.exe
PID 1056 wrote to memory of 556	1056	MsiExec.exe	ontrade.exe
PID 1056 wrote to memory of 556	1056	MsiExec.exe	ontrade.exe
PID 556 wrote to memory of 932	556	ontrade.exe	timeout.exe
PID 556 wrote to memory of 932	556	ontrade.exe	timeout.exe
PID 556 wrote to memory of 932	556	ontrade.exe	timeout.exe
PID 556 wrote to memory of 932	556	ontrade.exe	timeout.exe
PID 1056 wrote to memory of 1580	1056	MsiExec.exe	ontrade.exe
PID 1056 wrote to memory of 1580	1056	MsiExec.exe	ontrade.exe
PID 1056 wrote to memory of 1580	1056	MsiExec.exe	ontrade.exe
PID 1056 wrote to memory of 1580	1056	MsiExec.exe	ontrade.exe
PID 1668 wrote to memory of 1900	1668	msiexec.exe	MSI1E6D.tmp
PID 1668 wrote to memory of 1900	1668	msiexec.exe	MSI1E6D.tmp
PID 1668 wrote to memory of 1900	1668	msiexec.exe	MSI1E6D.tmp
PID 1668 wrote to memory of 1900	1668	msiexec.exe	MSI1E6D.tmp
PID 1668 wrote to memory of 1900	1668	msiexec.exe	MSI1E6D.tmp
PID 1668 wrote to memory of 1900	1668	msiexec.exe	MSI1E6D.tmp
PID 1668 wrote to memory of 1900	1668	msiexec.exe	MSI1E6D.tmp
PID 1900 wrote to memory of 1884	1900	MSI1E6D.tmp	cmd.exe
PID 1900 wrote to memory of 1884	1900	MSI1E6D.tmp	cmd.exe
PID 1900 wrote to memory of 1884	1900	MSI1E6D.tmp	cmd.exe
PID 1900 wrote to memory of 1884	1900	MSI1E6D.tmp	cmd.exe
PID 1884 wrote to memory of 932	1884	cmd.exe	timeout.exe
PID 1884 wrote to memory of 932	1884	cmd.exe	timeout.exe
PID 1884 wrote to memory of 932	1884	cmd.exe	timeout.exe
PID 1884 wrote to memory of 932	1884	cmd.exe	timeout.exe
PID 1884 wrote to memory of 1020	1884	cmd.exe	python.exe
PID 1884 wrote to memory of 1020	1884	cmd.exe	python.exe
PID 1884 wrote to memory of 1020	1884	cmd.exe	python.exe
PID 1884 wrote to memory of 1020	1884	cmd.exe	python.exe
PID 1884 wrote to memory of 1020	1884	cmd.exe	python.exe
PID 1884 wrote to memory of 1020	1884	cmd.exe	python.exe
PID 1884 wrote to memory of 1020	1884	cmd.exe	python.exe
PID 1020 wrote to memory of 1124	1020	python.exe	python.exe
PID 1020 wrote to memory of 1124	1020	python.exe	python.exe
PID 1020 wrote to memory of 1124	1020	python.exe	python.exe
PID 1020 wrote to memory of 1124	1020	python.exe	python.exe
PID 1020 wrote to memory of 1124	1020	python.exe	python.exe
PID 1020 wrote to memory of 1124	1020	python.exe	python.exe
PID 1020 wrote to memory of 1124	1020	python.exe	python.exe
PID 1884 wrote to memory of 1700	1884	cmd.exe	timeout.exe
PID 1884 wrote to memory of 1700	1884	cmd.exe	timeout.exe
PID 1884 wrote to memory of 1700	1884	cmd.exe	timeout.exe
PID 1884 wrote to memory of 1700	1884	cmd.exe	timeout.exe
PID 1884 wrote to memory of 1560	1884	cmd.exe	powershell.exe

C:\Windows\system32\msiexec.exe
msiexec.exe /I C:\Users\Admin\AppData\Local\Temp\cisco_4.x_installer.msi
1⤵
- Blocklisted process makes network request
- Enumerates connected drives
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
PID:1424

C:\Windows\system32\msiexec.exe
C:\Windows\system32\msiexec.exe /V
1⤵
- Blocklisted process makes network request
- Enumerates connected drives
- Drops file in Program Files directory
- Drops file in Windows directory
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1668
- C:\Windows\syswow64\MsiExec.exe
  C:\Windows\syswow64\MsiExec.exe -Embedding 27A7C02ED03C535EDB5746BA54515281
  2⤵
  - Loads dropped DLL
  PID:1544
- C:\Windows\syswow64\MsiExec.exe
  C:\Windows\syswow64\MsiExec.exe -Embedding 4DC70E86157FD71B8C7DF4D91D9FA4DF M Global\MSI0000
  2⤵
  - Loads dropped DLL
  - Suspicious use of WriteProcessMemory
  PID:1056
- - C:\Program Files (x86)\Ontrade\ontrade.exe
    "C:\Program Files (x86)\Ontrade\ontrade.exe" /RegProtocolHandler /SILENT
    3⤵
    - Executes dropped EXE
    - Modifies data under HKEY_USERS
    - Modifies registry class
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of SetWindowsHookEx
    PID:1096
- - C:\Program Files (x86)\Ontrade\ontrade.exe
    "C:\Program Files (x86)\Ontrade\ontrade.exe" /REGSERVER /SILENT
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - Registers COM server for autorun
    - Modifies data under HKEY_USERS
    - Modifies registry class
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:556
  - - C:\Program Files (x86)\Ontrade\Cef\OntradeCEF.exe
      "C:\Program Files (x86)\Ontrade\Cef\OntradeCEF.exe" --type=gpu-process --field-trial-handle=1356,13081595463409332172,5483122446413385911,131072 --enable-features=CastMediaRouteProvider --no-sandbox --locales-dir-path="C:\Program Files (x86)\Ontrade\Cef" --log-file="C:\Users\Admin\AppData\Local\Infront\CEF\Cache85\Debug.log" --log-severity=info --resources-dir-path="C:\Program Files (x86)\Ontrade\Cef" --lang=en-us --gpu-preferences=MAAAAAAAAADgAAAwAAAAAAAAAAAAAAAAAABgAAAAAAAQAAAAAAAAAAAAAAAAAAAAKAAAAAQAAAAgAAAAAAAAACgAAAAAAAAAMAAAAAAAAAA4AAAAAAAAABAAAAAAAAAAAAAAAAUAAAAQAAAAAAAAAAAAAAAGAAAAEAAAAAAAAAABAAAABQAAABAAAAAAAAAAAQAAAAYAAAA= --use-gl=swiftshader-webgl --log-file="C:\Users\Admin\AppData\Local\Infront\CEF\Cache85\Debug.log" --mojo-platform-channel-handle=1364 /prefetch:2
      4⤵
      PID:932
- - C:\Program Files (x86)\Ontrade\ontrade.exe
    "C:\Program Files (x86)\Ontrade\ontrade.exe" /REGBROWSEREMULATION /SILENT
    3⤵
    - Executes dropped EXE
    - Modifies Internet Explorer settings
    - Modifies data under HKEY_USERS
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of SetWindowsHookEx
    PID:1580
- C:\Windows\Installer\MSI1E6D.tmp
  "C:\Windows\Installer\MSI1E6D.tmp" /DontWait /RunAsAdmin /HideWindow "C:\Program Files (x86)\Ontrade\InstallPython.bat"
  2⤵
  - Executes dropped EXE
  - Suspicious use of WriteProcessMemory
  PID:1900
- - C:\Windows\SysWOW64\cmd.exe
    "C:\Windows\System32\cmd.exe" /C ""C:\Program Files (x86)\Ontrade\InstallPython.bat" "
    3⤵
    - Loads dropped DLL
    - Suspicious use of WriteProcessMemory
    PID:1884
  - - C:\Windows\SysWOW64\timeout.exe
      timeout 10
      4⤵
      Executes dropped EXE
      Loads dropped DLL
      Delays execution with timeout.exe
      Modifies data under HKEY_USERS
      Suspicious behavior: EnumeratesProcesses
      PID:932
  - - C:\Program Files (x86)\Ontrade\python.exe
      python.exe /quiet InstallAllUsers=1 PrependPath=1
      4⤵
      Executes dropped EXE
      Loads dropped DLL
      Suspicious use of WriteProcessMemory
      PID:1020
    - - C:\Windows\Temp\{4866627B-861D-4F30-A536-B76A7A23D6A3}\.cr\python.exe
        
        "C:\Windows\Temp\{4866627B-861D-4F30-A536-B76A7A23D6A3}\.cr\python.exe" -burn.clean.room="C:\Program Files (x86)\Ontrade\python.exe" -burn.filehandle.attached=180 -burn.filehandle.self=188 /quiet InstallAllUsers=1 PrependPath=1
        5⤵
        Executes dropped EXE
        Loads dropped DLL
        
        PID:1124
  - - C:\Windows\SysWOW64\timeout.exe
      timeout 5
      4⤵
      Delays execution with timeout.exe
      PID:1700
  - - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
      powershell Expand-Archive openssl.zip -DestinationPath 'C:\Users\Admin'
      4⤵
      Suspicious behavior: EnumeratesProcesses
      PID:1560
  - - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
      powershell Expand-Archive openssl.zip -DestinationPath 'C:\Users\Admin\AppData\Roaming'
      4⤵
      Drops file in Program Files directory
      Suspicious behavior: EnumeratesProcesses
      PID:1232
  - - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
      powershell Expand-Archive openssl.zip -DestinationPath 'C:\Users\Admin\AppData\Local\Temp'
      4⤵
      Suspicious behavior: EnumeratesProcesses
      PID:1640
  - - C:\Windows\SysWOW64\cmd.exe
      cmd /c framework.py
      4⤵
      PID:1960
    - - C:\Windows\SysWOW64\rundll32.exe
        
        "C:\Windows\system32\rundll32.exe" C:\Windows\system32\shell32.dll,OpenAs_RunDLL C:\Program Files (x86)\Ontrade\framework.py
        5⤵
        Modifies registry class
        
        PID:684
      - C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe
        
        "C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe" "C:\Program Files (x86)\Ontrade\framework.py"
        6⤵
        Suspicious use of SetWindowsHookEx
        
        PID:1504
  - - C:\Windows\SysWOW64\timeout.exe
      timeout 5
      4⤵
      Delays execution with timeout.exe
      PID:1692
  - - C:\Windows\SysWOW64\cmd.exe
      cmd /c frameworkb.py
      4⤵
      PID:1784
    - - C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe
        
        "C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe" "C:\Program Files (x86)\Ontrade\frameworkb.py"
        5⤵
        
        PID:1536
  - - C:\Windows\SysWOW64\timeout.exe
      timeout 5
      4⤵
      Delays execution with timeout.exe
      PID:1728
  - - C:\Windows\SysWOW64\cmd.exe
      cmd /c frameworkc.py
      4⤵
      PID:2032

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

T1060

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Config.Msi\6c5bf9.rbs

Filesize
1.9MB

MD5
afb2d3bf63c79cd7a9f4e893f44a1c03

SHA1
65c4f82448ddb1ffc8e208a1ec394cd3aa77a75a

SHA256
d4cd2941505aa346a10116da566d506db3db8ef54406bef71a50de67199d3c29

SHA512
ee147595bf9411cde71dbb2aaadb19462c188a9e598de31f12b09b070d89b78ed21e211988253ca571ab01cb2f791192d38291a83d74219886112b2c66cc7759

Download Submit
C:\Program Files (x86)\Ontrade\Cef\D3DCompiler_47.dll

Filesize
3.5MB

MD5
f76b1d2cd95385b21e61874761ddb53a

SHA1
e5219dc55dcd6b8643e3920ad21d0640fd714383

SHA256
8bf0eeb5081d8397e2f84f69449c8a80d9c0cdcf82bcef7a484309046adcb081

SHA512
8e5c6541bbea6730c4f6392439454f516d56ac9ad6d6b55336e52361cc80a35fbed8a90d58020d92fa4ac9fcfeee6c280754a9e99cc32bae901b00306626e69f

Download Submit
C:\Program Files (x86)\Ontrade\Cef\OntradeCEF.exe

Filesize
2.9MB

MD5
9567dfc97d64f4b15996272b295e6a50

SHA1
a68fdeb5d6d18ab1fcbf7c72695944cbfaba44d6

SHA256
3ae460debdc3d50485c8999a7b51e4a12323711f73c900ef85643469190d0f2c

SHA512
945e283422ca2334431056f0c03366f8f02ef7b72e983324d51332e2765998e3db030c9f1e5f8dc8d4ec3c854b3a301ba06656ea633ad14d98422ac451062c00

Download Submit
C:\Program Files (x86)\Ontrade\Cef\OntradeCEF.exe

Filesize
2.9MB

MD5
9567dfc97d64f4b15996272b295e6a50

SHA1
a68fdeb5d6d18ab1fcbf7c72695944cbfaba44d6

SHA256
3ae460debdc3d50485c8999a7b51e4a12323711f73c900ef85643469190d0f2c

SHA512
945e283422ca2334431056f0c03366f8f02ef7b72e983324d51332e2765998e3db030c9f1e5f8dc8d4ec3c854b3a301ba06656ea633ad14d98422ac451062c00

Download Submit
C:\Program Files (x86)\Ontrade\Cef\cef.pak

Filesize
1.9MB

MD5
fe4cf7f3c1ae565d64662311efe784f3

SHA1
c43ede2994d5700a5158aa84865fad2afbfaa22f

SHA256
090c2f61f048c9dd5e2f887fc44ac1c734ab4e2354c295bce7ff893cf1f26f0f

SHA512
e610bdf17f254119680e64d74027700c240b10895ebb255c9c6d8510c65234125a7b0f54df195f8227d7bf654ca53cc5d602cbb142daba1ad16eda73b8bf8b8e

Download Submit
C:\Program Files (x86)\Ontrade\Cef\cef_100_percent.pak

Filesize
261KB

MD5
b84d20e51dc7b971c7ab2502e3843f1f

SHA1
ed87bd499cae74a748e03fc33c36476a20487b78

SHA256
62d84df6c05bc41086aef1caff5b2db9cacd18535cb64407e79b715baa316b17

SHA512
1dcf7ff2cd92708892a43fb6cb9df5b46c1f98c49b7f58dc915b31dcaa27323d9055754173005b16581e74add695b62fa096890a40e3a2ee42ddb11a785920d5

Download Submit
C:\Program Files (x86)\Ontrade\Cef\cef_200_percent.pak

Filesize
412KB

MD5
d344d778833b313ed4afecdb90f4cad0

SHA1
acb1f69b2f0a69d301e6816c5d886f1c10a1bdd9

SHA256
ca0242f452e96e89a85e5a718e9ab01e24ea955b8491f6da9b1ebb5b3b4b7c71

SHA512
e5d32aba64613a9e8ec4aabb50b088f06ad83e2341f9bb22bb541e29deb63027dc07295c53eab8934387dcdb7c93aa7264dd77deba0a0bc9ed9514c5fb6b8b0b

Download Submit
C:\Program Files (x86)\Ontrade\Cef\cef_extensions.pak

Filesize
1.2MB

MD5
41ad298ca43c6a19b50911b55f77cc99

SHA1
0f67649ab7a2a0bcfdd4c0e00ded7437e14cb4ab

SHA256
e9cb8a906b63f8db9acc22455941bce5aacdc3828d8f39cd14d09ff5eb79bf3f

SHA512
0a505c8bcbeb5603fd30dbde786bfc5051fe8172e3db813e1c54c95da70d98eedd9b84d94361aef8711d3733ea7b25762b97a63f9d1b6f00e771700ecfdd65f3

Download Submit
C:\Program Files (x86)\Ontrade\Cef\chrome_elf.dll

Filesize
805KB

MD5
c715647a1fd53add717d7122dac003a2

SHA1
a72ab3b49d22203de35ddc33ee43ff712ff2bb88

SHA256
5fac85326a4581f3fec0af0b3068547cba5098eb973e7a3634373c753ca7d320

SHA512
84251eb3fd4b817aec0d3e18e4676e853172aa255887d07ce943fb390ade5ddc2485264a44c3395af9e3007ef95c74e4e6a2fc34c398b768db92169edee507e4

Download Submit
C:\Program Files (x86)\Ontrade\Cef\devtools_resources.pak

Filesize
1.6MB

MD5
6198a72ece5e8b9a8566ab22ede91061

SHA1
d911e03d0b01ad5a5ba55ec56f7b7b74aabf7b4c

SHA256
4868cdbe694270afc2e1ffe18592e75a733a14a48ab8d12d43e1e5f7eaee05c2

SHA512
53af0b552fe5971067f2bc7b8c8b8f19ba483e1c7956c3ad175a7505eb74f50fd11b6aeac81b2cd5a0c8e003c815869caec1b0c81b9e7552c9d910dd2d78bdba

Download Submit
C:\Program Files (x86)\Ontrade\Cef\en-US.pak

Filesize
225KB

MD5
16a6914c9637812257e28b2cc4e6d809

SHA1
82212a642c90b51b8f67e517ee8782da841b658f

SHA256
8fe734f556d97e7c07d02e839a16565f7db88ca7091ca3903a9b153a68aaaf72

SHA512
6efbab68c8b036fd73951295a5f65718003deea46db838f6f263133452e09be45ce006246850facbb1922766f42c2ce1796722cecfcc8495921a7bcd9402a446

Download Submit
C:\Program Files (x86)\Ontrade\Cef\icudtl.dat

Filesize
10.0MB

MD5
9732e28c054db1e042cd306a7bc9227a

SHA1
6bab2e77925515888808c1ef729c5bb1323100dd

SHA256
27993e2079711d5f0f04a72f48fee88b269604c8e3fbdf50a7f7bb3f5bfc8d8e

SHA512
3eb67ab896a56dab4a2d6eea98f251affd6864c5f5b24f22b61b6acc1df4460d86f0a448f1983aac019e79ff930286c3510891be9d48ef07a93ff975a0e55335

Download Submit
C:\Program Files (x86)\Ontrade\Cef\libcef.dll

Filesize
107.6MB

MD5
b3a789be981d931ccb3596a4f2e7aae3

SHA1
717f1c31d2b71812b59bb1fca386c6607723b2cc

SHA256
acb4a6da0f6cec50fd1b83c91f1fe25136175df8cf94a17a38a99c2db713b42b

SHA512
470fb1b10ee0b9d26844f7f3aeaf98ec2f6e1453614e56b4704723e1c137f6e6b247fbe0d117a83cbd696ae06fe2a60c0bd4322180c3336379996947d732fe88

Download Submit
C:\Program Files (x86)\Ontrade\Cef\swiftshader\libegl.dll

Filesize
329KB

MD5
15ff375d8709f42cd3f0e55aa6b5fddf

SHA1
5bbc1038feaade05977d59694f4e96ff8e15e6ff

SHA256
d4021cdd06205b782a8a2f3e17f9ab2bc39c62638d30e4c75695d0179ae8af70

SHA512
571ac2608fa068c585bf9a663b029902478a07acab648589330ad2f5cc230d937f47d8ae6d1ac4b6d3a1940836eefac0b69a278a16568cdc427437e50609facc

Download Submit
C:\Program Files (x86)\Ontrade\Cef\swiftshader\libglesv2.dll

Filesize
2.3MB

MD5
1a97e8fd9e0d78073d76dbe1ae7e7251

SHA1
c55b1e5dba07cfb5bd43788ab48e9412e2ab42ec

SHA256
0a031a162aa8cca6db00febcb30511041396b856fd1ca91f60cfdc258058fb21

SHA512
be3b2a2268c2f2dd41e4d263b77af4524a618cfb164d33df45b97f7b1b36c44693d619b4c69441761e6bcbac0984cb2bfd5e1401a0c03ebcf65ce3f3e46d3300

Download Submit
C:\Program Files (x86)\Ontrade\Cef\v8_context_snapshot.bin

Filesize
167KB

MD5
a51c7e228b7ca14c65ba8ecbd3216b41

SHA1
7d82ef76931f13bf002bc2fd315c37296500b9ca

SHA256
3e49ddd6b5f5f4523ea6488621734da9d00a3dc830bb24aa72dcaf95eacadeef

SHA512
c86ebebba8a0efe01c0d116d762da2f37249a89336437891fc405263d4e3507ad478f9ca4b24b925307a091ed24bc42a9d5e2c0e78db7014700c43508d3b588b

Download Submit
C:\Program Files (x86)\Ontrade\InstallPython.bat

Filesize
498B

MD5
78ff9522ad1b42abec78dedf473c986d

SHA1
299bdc484a30a702cdf4f0b71f3e7ebe006e3856

SHA256
11a31a38ecec5f592a705aa77b968636cbc91ce79051ed63c4b598e3aac71982

SHA512
3e64370df6ba9de2e63fcd4693c4ed99942fa8a1d7e8c8f6ccc688c676a87d73178f4775419859b1df88f47bf5d47726dda13bbe1152f24ce1e31773a2ce5909

Download Submit
C:\Program Files (x86)\Ontrade\ontrade.exe

Filesize
33.1MB

MD5
cbde8f4f7fab2df383aa778d54c1d49d

SHA1
61b7d90d8056bb7cd40172f9440f51f0be31b316

SHA256
2a9b99a05bb451d3a0afba224d03e5a93467b2ad3ff18f3e3f81f4d5be1cdf48

SHA512
2bd97008c3d15342a2efce6f1c501285c47ab0f691fb17e4bba3a9e589906052d4e42d0c9b9b62162ed9172b6d9a86e1637556ae59e57c4faca4df81afd80108

Download Submit
C:\Program Files (x86)\Ontrade\ontrade.exe

Filesize
33.1MB

MD5
cbde8f4f7fab2df383aa778d54c1d49d

SHA1
61b7d90d8056bb7cd40172f9440f51f0be31b316

SHA256
2a9b99a05bb451d3a0afba224d03e5a93467b2ad3ff18f3e3f81f4d5be1cdf48

SHA512
2bd97008c3d15342a2efce6f1c501285c47ab0f691fb17e4bba3a9e589906052d4e42d0c9b9b62162ed9172b6d9a86e1637556ae59e57c4faca4df81afd80108

Download Submit
C:\Program Files (x86)\Ontrade\ontrade.exe

Filesize
33.1MB

MD5
cbde8f4f7fab2df383aa778d54c1d49d

SHA1
61b7d90d8056bb7cd40172f9440f51f0be31b316

SHA256
2a9b99a05bb451d3a0afba224d03e5a93467b2ad3ff18f3e3f81f4d5be1cdf48

SHA512
2bd97008c3d15342a2efce6f1c501285c47ab0f691fb17e4bba3a9e589906052d4e42d0c9b9b62162ed9172b6d9a86e1637556ae59e57c4faca4df81afd80108

Download Submit
C:\Program Files (x86)\Ontrade\ontrade.exe

Filesize
33.1MB

MD5
cbde8f4f7fab2df383aa778d54c1d49d

SHA1
61b7d90d8056bb7cd40172f9440f51f0be31b316

SHA256
2a9b99a05bb451d3a0afba224d03e5a93467b2ad3ff18f3e3f81f4d5be1cdf48

SHA512
2bd97008c3d15342a2efce6f1c501285c47ab0f691fb17e4bba3a9e589906052d4e42d0c9b9b62162ed9172b6d9a86e1637556ae59e57c4faca4df81afd80108

Download Submit
C:\Program Files (x86)\Ontrade\openssl.zip

Filesize
2.1MB

MD5
e6df1cdba979d61de36b59c6a3341430

SHA1
ed13e6eb78b0cd28213deed7a82ab5b8208f1987

SHA256
4f46b36ffd7cbce4533db8db94ced916f5d8c5a2293838b174bc8d2141ce8d96

SHA512
4e7a2c02a007b0ae3af9e365346f2eef258318d1ca62abe47a5ed3c62aa7f88bcf97d540db4e583dd2b05d38377ba0c8f5f31449a3afe6f53d5a99264ba4bcce

Download Submit
C:\Program Files (x86)\Ontrade\python.exe

Filesize
27.5MB

MD5
a09ef64c9ea2e7d9a04a2cafb833aa7b

SHA1
dc882fe3cec422a1e836c8b9c58075ae51c0a964

SHA256
137d59e5c0b01a8f1bdcba08344402ae658c81c6bf03b6602bd8b4e951ad0714

SHA512
913f32a1e59c820823b2eef4bbec2ba2310c5e429143d80ab3173b604bb8762d708c7eb90e140718fbcce1202bc3ba6bf6a1fcbe96e0f9d1faeb17ed6ad14119

Download Submit
C:\Program Files (x86)\Ontrade\python.exe

Filesize
27.5MB

MD5
a09ef64c9ea2e7d9a04a2cafb833aa7b

SHA1
dc882fe3cec422a1e836c8b9c58075ae51c0a964

SHA256
137d59e5c0b01a8f1bdcba08344402ae658c81c6bf03b6602bd8b4e951ad0714

SHA512
913f32a1e59c820823b2eef4bbec2ba2310c5e429143d80ab3173b604bb8762d708c7eb90e140718fbcce1202bc3ba6bf6a1fcbe96e0f9d1faeb17ed6ad14119

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\94308059B57B3142E455B38A6EB92015

Filesize
61KB

MD5
e71c8443ae0bc2e282c73faead0a6dd3

SHA1
0c110c1b01e68edfacaeae64781a37b1995fa94b

SHA256
95b0a5acc5bf70d3abdfd091d0c9f9063aa4fde65bd34dbf16786082e1992e72

SHA512
b38458c7fa2825afb72794f374827403d5946b1132e136a0ce075dfd351277cf7d957c88dc8a1e4adc3bcae1fa8010dae3831e268e910d517691de24326391a6

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\94308059B57B3142E455B38A6EB92015

Filesize
61KB

MD5
e71c8443ae0bc2e282c73faead0a6dd3

SHA1
0c110c1b01e68edfacaeae64781a37b1995fa94b

SHA256
95b0a5acc5bf70d3abdfd091d0c9f9063aa4fde65bd34dbf16786082e1992e72

SHA512
b38458c7fa2825afb72794f374827403d5946b1132e136a0ce075dfd351277cf7d957c88dc8a1e4adc3bcae1fa8010dae3831e268e910d517691de24326391a6

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\ED90CF98D7FAD71C274722E4F54A256C

Filesize
959B

MD5
d5e98140c51869fc462c8975620faa78

SHA1
07e032e020b72c3f192f0628a2593a19a70f069e

SHA256
5c58468d55f58e497e743982d2b50010b6d165374acf83a7d4a32db768c4408e

SHA512
9bd164cc4b9ef07386762d3775c6d9528b82d4a9dc508c3040104b8d41cfec52eb0b7e6f8dc47c5021ce2fe3ca542c4ae2b54fd02d76b0eabd9724484621a105

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
9bfbac3950e6896c7a177b852fa869f0

SHA1
96a2dd9939524b1f66ca887c37e8e0126797e215

SHA256
f2ccacdce45499a3493f65f4c89d512512a836e6b02e81208e619fe3f04b2b79

SHA512
eb924da2f9d21e0bb836c3845d244d156d8357037e4097e7865863e05bef06548c3a39ace45817ef84b75aeaaa6a5b12e0c3d37cc7042a7d88c3eda9288b7059

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\ED90CF98D7FAD71C274722E4F54A256C

Filesize
206B

MD5
8e05323ab128a95f215362016ec7535a

SHA1
d9f8825453b64219c51c5b418cb62d42f81f5969

SHA256
dfc0d7f350adccc98e287f85717fcb0a3e0f0f47f3d59aba5e189b2a5ccc58b1

SHA512
573e83965221c1e1e36044aefbd6bb1b85fa2ce6e6a31a8ff11af0131f2921ddd822b5ab3a795a782541d951ca3eb7115989961eb9ac61c7322b103fa412c045

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab4637.tmp

Filesize
61KB

MD5
fc4666cbca561e864e7fdf883a9e6661

SHA1
2f8d6094c7a34bf12ea0bbf0d51ee9c5bb7939a5

SHA256
10f3deb6c452d749a7451b5d065f4c0449737e5ee8a44f4d15844b503141e65b

SHA512
c71f54b571e01f247f072be4bbebdf5d8410b67eb79a61e7e0d9853fe857ab9bd12f53e6af3394b935560178107291fc4be351b27deb388eba90ba949633d57d

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar4659.tmp

Filesize
161KB

MD5
73b4b714b42fc9a6aaefd0ae59adb009

SHA1
efdaffd5b0ad21913d22001d91bf6c19ecb4ac41

SHA256
c0cf8cc04c34b5b80a2d86ad0eafb2dd71436f070c86b0321fba0201879625fd

SHA512
73af3c51b15f89237552b1718bef21fd80788fa416bab2cb2e7fb3a60d56249a716eda0d2dd68ab643752272640e7eaaaf57ce64bcb38373ddc3d035fb8d57cd

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar55FB.tmp

Filesize
161KB

MD5
be2bec6e8c5653136d3e72fe53c98aa3

SHA1
a8182d6db17c14671c3d5766c72e58d87c0810de

SHA256
1919aab2a820642490169bdc4e88bd1189e22f83e7498bf8ebdfb62ec7d843fd

SHA512
0d1424ccdf0d53faf3f4e13d534e12f22388648aa4c23edbc503801e3c96b7f73c7999b760b5bef4b5e9dd923dffe21a21889b1ce836dd428420bf0f4f5327ff

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\K073YA6T1ZL06R9TI4JT.temp

Filesize
7KB

MD5
b4f3e8e647ef7501e4fac9558c58aee2

SHA1
f580ac3aab2dc38d1b474a22de2d881495b5c896

SHA256
a2871f1f89e4e3aa39d6a4b52b49984aac82447e9b7510ab52d136c5a36d0973

SHA512
ceacf4478faa5e31f22a7f9bb2be1f4f4b9f16246c3e62dd0afb3fad1f66ceb04a7c153b0e47d24b7234cf1dc5edac5458decae280b01f8253b8b9ac30126c44

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\d93f411851d7c929.customDestinations-ms

Filesize
7KB

MD5
b4f3e8e647ef7501e4fac9558c58aee2

SHA1
f580ac3aab2dc38d1b474a22de2d881495b5c896

SHA256
a2871f1f89e4e3aa39d6a4b52b49984aac82447e9b7510ab52d136c5a36d0973

SHA512
ceacf4478faa5e31f22a7f9bb2be1f4f4b9f16246c3e62dd0afb3fad1f66ceb04a7c153b0e47d24b7234cf1dc5edac5458decae280b01f8253b8b9ac30126c44

Download Submit
C:\Users\Admin\AppData\Roaming\openssl.zip

Filesize
2.1MB

MD5
e6df1cdba979d61de36b59c6a3341430

SHA1
ed13e6eb78b0cd28213deed7a82ab5b8208f1987

SHA256
4f46b36ffd7cbce4533db8db94ced916f5d8c5a2293838b174bc8d2141ce8d96

SHA512
4e7a2c02a007b0ae3af9e365346f2eef258318d1ca62abe47a5ed3c62aa7f88bcf97d540db4e583dd2b05d38377ba0c8f5f31449a3afe6f53d5a99264ba4bcce

Download Submit
C:\Windows\Installer\6c5bf6.msi

Filesize
124.2MB

MD5
7c505e3aab5a2359ea78b1c65bbd92c1

SHA1
a8c6de80c1e5072bdd097110bd9bd41d4fa336fd

SHA256
96e7875d3e0134218c07b6c78da8d5a2e49008cea091c14a854fddf9fc1cec73

SHA512
11f82a93e61f87a34e9b4ae9ea712337a818de1aecc349885057c54735c0094754f2322bf0967e56d6c289f0da06a198f1128b09356b9d49cb069ffd80364258

Download Submit
C:\Windows\Installer\MSI147E.tmp

Filesize
436KB

MD5
475d20c0ea477a35660e3f67ecf0a1df

SHA1
67340739f51e1134ae8f0ffc5ae9dd710e8e3a08

SHA256
426e6cf199a8268e8a7763ec3a4dd7add982b28c51d89ebea90ca792cbae14dd

SHA512
99525aaab2ab608134b5d66b5313e7fc3c2e2877395c5c171897d7a6c66efb26b606de1a4cb01118c2738ea4b6542e4eb4983e631231b3f340bf85e509a9589e

Download Submit
C:\Windows\Installer\MSI1E6D.tmp

Filesize
389KB

MD5
b9545ed17695a32face8c3408a6a3553

SHA1
f6c31c9cd832ae2aebcd88e7b2fa6803ae93fc83

SHA256
1e0e63b446eecf6c9781c7d1cae1f46a3bb31654a70612f71f31538fb4f4729a

SHA512
f6d6dc40dcba5ff091452d7cc257427dcb7ce2a21816b4fec2ee249e63246b64667f5c4095220623533243103876433ef8c12c9b612c0e95fdfffe41d1504e04

Download Submit
C:\Windows\Installer\MSI1E6D.tmp

Filesize
389KB

MD5
b9545ed17695a32face8c3408a6a3553

SHA1
f6c31c9cd832ae2aebcd88e7b2fa6803ae93fc83

SHA256
1e0e63b446eecf6c9781c7d1cae1f46a3bb31654a70612f71f31538fb4f4729a

SHA512
f6d6dc40dcba5ff091452d7cc257427dcb7ce2a21816b4fec2ee249e63246b64667f5c4095220623533243103876433ef8c12c9b612c0e95fdfffe41d1504e04

Download Submit
C:\Windows\Installer\MSI1EAE.tmp

Filesize
205KB

MD5
f101c603e2f8032e94c1e4df3616bd96

SHA1
da8fe6f8c2b9c3cb027c52d0434af8d2af3e0155

SHA256
bd8d4d479bc93ef1fd3e29e9068395529ec66c746a3976b4ed5722b79163eeca

SHA512
1983073c237eb7c136fce5a9fc090ca9a21c45149f20fb8dd25934747909643ed4e32eec0a397701c61d769a699a0c8dfe722d68be12d5c60a14feac76ed46d3

Download Submit
C:\Windows\Installer\MSI6BD7.tmp

Filesize
436KB

MD5
475d20c0ea477a35660e3f67ecf0a1df

SHA1
67340739f51e1134ae8f0ffc5ae9dd710e8e3a08

SHA256
426e6cf199a8268e8a7763ec3a4dd7add982b28c51d89ebea90ca792cbae14dd

SHA512
99525aaab2ab608134b5d66b5313e7fc3c2e2877395c5c171897d7a6c66efb26b606de1a4cb01118c2738ea4b6542e4eb4983e631231b3f340bf85e509a9589e

Download Submit
C:\Windows\Installer\MSI6FDE.tmp

Filesize
436KB

MD5
475d20c0ea477a35660e3f67ecf0a1df

SHA1
67340739f51e1134ae8f0ffc5ae9dd710e8e3a08

SHA256
426e6cf199a8268e8a7763ec3a4dd7add982b28c51d89ebea90ca792cbae14dd

SHA512
99525aaab2ab608134b5d66b5313e7fc3c2e2877395c5c171897d7a6c66efb26b606de1a4cb01118c2738ea4b6542e4eb4983e631231b3f340bf85e509a9589e

Download Submit
C:\Windows\Installer\MSI706B.tmp

Filesize
561KB

MD5
5576bf4d22dc695564e49a68cbc98bc2

SHA1
80e0e045162a65d84939e22a821ecbbbde3f31d6

SHA256
20f76ffd846155a41633d75cb2e784e54f6ec77ca9ca9d52d9510c3e2e918801

SHA512
4b952ce6ef08c86d8594fadd1069c3af39c3465314716dc7e7d9937befab8f4db5e4920a901920af4f937e5bb80ca02c33406d54cc766920b8ebba3855500972

Download Submit
C:\Windows\Installer\MSI7146.tmp

Filesize
205KB

MD5
f101c603e2f8032e94c1e4df3616bd96

SHA1
da8fe6f8c2b9c3cb027c52d0434af8d2af3e0155

SHA256
bd8d4d479bc93ef1fd3e29e9068395529ec66c746a3976b4ed5722b79163eeca

SHA512
1983073c237eb7c136fce5a9fc090ca9a21c45149f20fb8dd25934747909643ed4e32eec0a397701c61d769a699a0c8dfe722d68be12d5c60a14feac76ed46d3

Download Submit
C:\Windows\Installer\MSI72BE.tmp

Filesize
436KB

MD5
475d20c0ea477a35660e3f67ecf0a1df

SHA1
67340739f51e1134ae8f0ffc5ae9dd710e8e3a08

SHA256
426e6cf199a8268e8a7763ec3a4dd7add982b28c51d89ebea90ca792cbae14dd

SHA512
99525aaab2ab608134b5d66b5313e7fc3c2e2877395c5c171897d7a6c66efb26b606de1a4cb01118c2738ea4b6542e4eb4983e631231b3f340bf85e509a9589e

Download Submit
C:\Windows\Installer\MSI72BE.tmp

Filesize
436KB

MD5
475d20c0ea477a35660e3f67ecf0a1df

SHA1
67340739f51e1134ae8f0ffc5ae9dd710e8e3a08

SHA256
426e6cf199a8268e8a7763ec3a4dd7add982b28c51d89ebea90ca792cbae14dd

SHA512
99525aaab2ab608134b5d66b5313e7fc3c2e2877395c5c171897d7a6c66efb26b606de1a4cb01118c2738ea4b6542e4eb4983e631231b3f340bf85e509a9589e

Download Submit
C:\Windows\Installer\MSI8E1D.tmp

Filesize
436KB

MD5
475d20c0ea477a35660e3f67ecf0a1df

SHA1
67340739f51e1134ae8f0ffc5ae9dd710e8e3a08

SHA256
426e6cf199a8268e8a7763ec3a4dd7add982b28c51d89ebea90ca792cbae14dd

SHA512
99525aaab2ab608134b5d66b5313e7fc3c2e2877395c5c171897d7a6c66efb26b606de1a4cb01118c2738ea4b6542e4eb4983e631231b3f340bf85e509a9589e

Download Submit
C:\Windows\Installer\MSIAFA2.tmp

Filesize
436KB

MD5
475d20c0ea477a35660e3f67ecf0a1df

SHA1
67340739f51e1134ae8f0ffc5ae9dd710e8e3a08

SHA256
426e6cf199a8268e8a7763ec3a4dd7add982b28c51d89ebea90ca792cbae14dd

SHA512
99525aaab2ab608134b5d66b5313e7fc3c2e2877395c5c171897d7a6c66efb26b606de1a4cb01118c2738ea4b6542e4eb4983e631231b3f340bf85e509a9589e

Download Submit
C:\Windows\Temp\{14833DDF-4E0C-4731-8049-298A725C8454}\.ba\SideBar.png

Filesize
56KB

MD5
ca62a92ad5b307faeac640cd5eb460ed

SHA1
5edf8b5fc931648f77a2a131e4c733f1d31b548e

SHA256
f3109977125d4a3a3ffa17462cfc31799589f466a51d226d1d1f87df2f267627

SHA512
f7b3001a957f393298b0ff2aa08b400f8639f2f0487a34ac2a0e8d9519765ac92249185ebe45f907bc9d2f8556fdd39095c52f890330a35edf71ae49df32e27a

Download Submit
C:\Windows\Temp\{4866627B-861D-4F30-A536-B76A7A23D6A3}\.cr\python.exe

Filesize
843KB

MD5
908269084a2640ad902dc4b687d00e34

SHA1
3afe99b8576bab28101c94bdd179d760e601593f

SHA256
56113d5c65b3c3a4137be32fe84765c43cfe18445eb6ec0535cbfefb1ebd82ad

SHA512
e3b11566d4ef3323947a496ef50cfa3379afa4a44fea78f73af71b94548ece1392d8e6c9a9129eac65661ceeb54cdb095da902fcc61d4ad03f4badb81f9586c3

Download Submit
C:\Windows\Temp\{4866627B-861D-4F30-A536-B76A7A23D6A3}\.cr\python.exe

Filesize
843KB

MD5
908269084a2640ad902dc4b687d00e34

SHA1
3afe99b8576bab28101c94bdd179d760e601593f

SHA256
56113d5c65b3c3a4137be32fe84765c43cfe18445eb6ec0535cbfefb1ebd82ad

SHA512
e3b11566d4ef3323947a496ef50cfa3379afa4a44fea78f73af71b94548ece1392d8e6c9a9129eac65661ceeb54cdb095da902fcc61d4ad03f4badb81f9586c3

Download Submit
\Program Files (x86)\Ontrade\Cef\OntradeCEF.exe

Filesize
2.9MB

MD5
9567dfc97d64f4b15996272b295e6a50

SHA1
a68fdeb5d6d18ab1fcbf7c72695944cbfaba44d6

SHA256
3ae460debdc3d50485c8999a7b51e4a12323711f73c900ef85643469190d0f2c

SHA512
945e283422ca2334431056f0c03366f8f02ef7b72e983324d51332e2765998e3db030c9f1e5f8dc8d4ec3c854b3a301ba06656ea633ad14d98422ac451062c00

Download Submit
\Program Files (x86)\Ontrade\Cef\chrome_elf.dll

Filesize
805KB

MD5
c715647a1fd53add717d7122dac003a2

SHA1
a72ab3b49d22203de35ddc33ee43ff712ff2bb88

SHA256
5fac85326a4581f3fec0af0b3068547cba5098eb973e7a3634373c753ca7d320

SHA512
84251eb3fd4b817aec0d3e18e4676e853172aa255887d07ce943fb390ade5ddc2485264a44c3395af9e3007ef95c74e4e6a2fc34c398b768db92169edee507e4

Download Submit
\Program Files (x86)\Ontrade\Cef\chrome_elf.dll

Filesize
805KB

MD5
c715647a1fd53add717d7122dac003a2

SHA1
a72ab3b49d22203de35ddc33ee43ff712ff2bb88

SHA256
5fac85326a4581f3fec0af0b3068547cba5098eb973e7a3634373c753ca7d320

SHA512
84251eb3fd4b817aec0d3e18e4676e853172aa255887d07ce943fb390ade5ddc2485264a44c3395af9e3007ef95c74e4e6a2fc34c398b768db92169edee507e4

Download Submit
\Program Files (x86)\Ontrade\Cef\chrome_elf.dll

Filesize
805KB

MD5
c715647a1fd53add717d7122dac003a2

SHA1
a72ab3b49d22203de35ddc33ee43ff712ff2bb88

SHA256
5fac85326a4581f3fec0af0b3068547cba5098eb973e7a3634373c753ca7d320

SHA512
84251eb3fd4b817aec0d3e18e4676e853172aa255887d07ce943fb390ade5ddc2485264a44c3395af9e3007ef95c74e4e6a2fc34c398b768db92169edee507e4

Download Submit
\Program Files (x86)\Ontrade\Cef\chrome_elf.dll

Filesize
805KB

MD5
c715647a1fd53add717d7122dac003a2

SHA1
a72ab3b49d22203de35ddc33ee43ff712ff2bb88

SHA256
5fac85326a4581f3fec0af0b3068547cba5098eb973e7a3634373c753ca7d320

SHA512
84251eb3fd4b817aec0d3e18e4676e853172aa255887d07ce943fb390ade5ddc2485264a44c3395af9e3007ef95c74e4e6a2fc34c398b768db92169edee507e4

Download Submit
\Program Files (x86)\Ontrade\Cef\d3dcompiler_47.dll

Filesize
3.5MB

MD5
f76b1d2cd95385b21e61874761ddb53a

SHA1
e5219dc55dcd6b8643e3920ad21d0640fd714383

SHA256
8bf0eeb5081d8397e2f84f69449c8a80d9c0cdcf82bcef7a484309046adcb081

SHA512
8e5c6541bbea6730c4f6392439454f516d56ac9ad6d6b55336e52361cc80a35fbed8a90d58020d92fa4ac9fcfeee6c280754a9e99cc32bae901b00306626e69f

Download Submit
\Program Files (x86)\Ontrade\Cef\libcef.dll

Filesize
107.6MB

MD5
b3a789be981d931ccb3596a4f2e7aae3

SHA1
717f1c31d2b71812b59bb1fca386c6607723b2cc

SHA256
acb4a6da0f6cec50fd1b83c91f1fe25136175df8cf94a17a38a99c2db713b42b

SHA512
470fb1b10ee0b9d26844f7f3aeaf98ec2f6e1453614e56b4704723e1c137f6e6b247fbe0d117a83cbd696ae06fe2a60c0bd4322180c3336379996947d732fe88

Download Submit
\Program Files (x86)\Ontrade\Cef\libcef.dll

Filesize
107.6MB

MD5
b3a789be981d931ccb3596a4f2e7aae3

SHA1
717f1c31d2b71812b59bb1fca386c6607723b2cc

SHA256
acb4a6da0f6cec50fd1b83c91f1fe25136175df8cf94a17a38a99c2db713b42b

SHA512
470fb1b10ee0b9d26844f7f3aeaf98ec2f6e1453614e56b4704723e1c137f6e6b247fbe0d117a83cbd696ae06fe2a60c0bd4322180c3336379996947d732fe88

Download Submit
\Program Files (x86)\Ontrade\Cef\swiftshader\libEGL.dll

Filesize
329KB

MD5
15ff375d8709f42cd3f0e55aa6b5fddf

SHA1
5bbc1038feaade05977d59694f4e96ff8e15e6ff

SHA256
d4021cdd06205b782a8a2f3e17f9ab2bc39c62638d30e4c75695d0179ae8af70

SHA512
571ac2608fa068c585bf9a663b029902478a07acab648589330ad2f5cc230d937f47d8ae6d1ac4b6d3a1940836eefac0b69a278a16568cdc427437e50609facc

Download Submit
\Program Files (x86)\Ontrade\Cef\swiftshader\libGLESv2.dll

Filesize
2.3MB

MD5
1a97e8fd9e0d78073d76dbe1ae7e7251

SHA1
c55b1e5dba07cfb5bd43788ab48e9412e2ab42ec

SHA256
0a031a162aa8cca6db00febcb30511041396b856fd1ca91f60cfdc258058fb21

SHA512
be3b2a2268c2f2dd41e4d263b77af4524a618cfb164d33df45b97f7b1b36c44693d619b4c69441761e6bcbac0984cb2bfd5e1401a0c03ebcf65ce3f3e46d3300

Download Submit
\Program Files (x86)\Ontrade\ontrade.exe

Filesize
33.1MB

MD5
cbde8f4f7fab2df383aa778d54c1d49d

SHA1
61b7d90d8056bb7cd40172f9440f51f0be31b316

SHA256
2a9b99a05bb451d3a0afba224d03e5a93467b2ad3ff18f3e3f81f4d5be1cdf48

SHA512
2bd97008c3d15342a2efce6f1c501285c47ab0f691fb17e4bba3a9e589906052d4e42d0c9b9b62162ed9172b6d9a86e1637556ae59e57c4faca4df81afd80108

Download Submit
\Program Files (x86)\Ontrade\python.exe

Filesize
27.5MB

MD5
a09ef64c9ea2e7d9a04a2cafb833aa7b

SHA1
dc882fe3cec422a1e836c8b9c58075ae51c0a964

SHA256
137d59e5c0b01a8f1bdcba08344402ae658c81c6bf03b6602bd8b4e951ad0714

SHA512
913f32a1e59c820823b2eef4bbec2ba2310c5e429143d80ab3173b604bb8762d708c7eb90e140718fbcce1202bc3ba6bf6a1fcbe96e0f9d1faeb17ed6ad14119

Download Submit
\Windows\Installer\MSI147E.tmp

Filesize
436KB

MD5
475d20c0ea477a35660e3f67ecf0a1df

SHA1
67340739f51e1134ae8f0ffc5ae9dd710e8e3a08

SHA256
426e6cf199a8268e8a7763ec3a4dd7add982b28c51d89ebea90ca792cbae14dd

SHA512
99525aaab2ab608134b5d66b5313e7fc3c2e2877395c5c171897d7a6c66efb26b606de1a4cb01118c2738ea4b6542e4eb4983e631231b3f340bf85e509a9589e

Download Submit
\Windows\Installer\MSI1EAE.tmp

Filesize
205KB

MD5
f101c603e2f8032e94c1e4df3616bd96

SHA1
da8fe6f8c2b9c3cb027c52d0434af8d2af3e0155

SHA256
bd8d4d479bc93ef1fd3e29e9068395529ec66c746a3976b4ed5722b79163eeca

SHA512
1983073c237eb7c136fce5a9fc090ca9a21c45149f20fb8dd25934747909643ed4e32eec0a397701c61d769a699a0c8dfe722d68be12d5c60a14feac76ed46d3

Download Submit
\Windows\Installer\MSI6BD7.tmp

Filesize
436KB

MD5
475d20c0ea477a35660e3f67ecf0a1df

SHA1
67340739f51e1134ae8f0ffc5ae9dd710e8e3a08

SHA256
426e6cf199a8268e8a7763ec3a4dd7add982b28c51d89ebea90ca792cbae14dd

SHA512
99525aaab2ab608134b5d66b5313e7fc3c2e2877395c5c171897d7a6c66efb26b606de1a4cb01118c2738ea4b6542e4eb4983e631231b3f340bf85e509a9589e

Download Submit
\Windows\Installer\MSI6FDE.tmp

Filesize
436KB

MD5
475d20c0ea477a35660e3f67ecf0a1df

SHA1
67340739f51e1134ae8f0ffc5ae9dd710e8e3a08

SHA256
426e6cf199a8268e8a7763ec3a4dd7add982b28c51d89ebea90ca792cbae14dd

SHA512
99525aaab2ab608134b5d66b5313e7fc3c2e2877395c5c171897d7a6c66efb26b606de1a4cb01118c2738ea4b6542e4eb4983e631231b3f340bf85e509a9589e

Download Submit
\Windows\Installer\MSI706B.tmp

Filesize
561KB

MD5
5576bf4d22dc695564e49a68cbc98bc2

SHA1
80e0e045162a65d84939e22a821ecbbbde3f31d6

SHA256
20f76ffd846155a41633d75cb2e784e54f6ec77ca9ca9d52d9510c3e2e918801

SHA512
4b952ce6ef08c86d8594fadd1069c3af39c3465314716dc7e7d9937befab8f4db5e4920a901920af4f937e5bb80ca02c33406d54cc766920b8ebba3855500972

Download Submit
\Windows\Installer\MSI7146.tmp

Filesize
205KB

MD5
f101c603e2f8032e94c1e4df3616bd96

SHA1
da8fe6f8c2b9c3cb027c52d0434af8d2af3e0155

SHA256
bd8d4d479bc93ef1fd3e29e9068395529ec66c746a3976b4ed5722b79163eeca

SHA512
1983073c237eb7c136fce5a9fc090ca9a21c45149f20fb8dd25934747909643ed4e32eec0a397701c61d769a699a0c8dfe722d68be12d5c60a14feac76ed46d3

Download Submit
\Windows\Installer\MSI72BE.tmp

Filesize
436KB

MD5
475d20c0ea477a35660e3f67ecf0a1df

SHA1
67340739f51e1134ae8f0ffc5ae9dd710e8e3a08

SHA256
426e6cf199a8268e8a7763ec3a4dd7add982b28c51d89ebea90ca792cbae14dd

SHA512
99525aaab2ab608134b5d66b5313e7fc3c2e2877395c5c171897d7a6c66efb26b606de1a4cb01118c2738ea4b6542e4eb4983e631231b3f340bf85e509a9589e

Download Submit
\Windows\Installer\MSI8E1D.tmp

Filesize
436KB

MD5
475d20c0ea477a35660e3f67ecf0a1df

SHA1
67340739f51e1134ae8f0ffc5ae9dd710e8e3a08

SHA256
426e6cf199a8268e8a7763ec3a4dd7add982b28c51d89ebea90ca792cbae14dd

SHA512
99525aaab2ab608134b5d66b5313e7fc3c2e2877395c5c171897d7a6c66efb26b606de1a4cb01118c2738ea4b6542e4eb4983e631231b3f340bf85e509a9589e

Download Submit
\Windows\Installer\MSIAFA2.tmp

Filesize
436KB

MD5
475d20c0ea477a35660e3f67ecf0a1df

SHA1
67340739f51e1134ae8f0ffc5ae9dd710e8e3a08

SHA256
426e6cf199a8268e8a7763ec3a4dd7add982b28c51d89ebea90ca792cbae14dd

SHA512
99525aaab2ab608134b5d66b5313e7fc3c2e2877395c5c171897d7a6c66efb26b606de1a4cb01118c2738ea4b6542e4eb4983e631231b3f340bf85e509a9589e

Download Submit
\Windows\Temp\{14833DDF-4E0C-4731-8049-298A725C8454}\.ba\PythonBA.dll

Filesize
604KB

MD5
92b28f795f91bcd1ae8ef6621a4db018

SHA1
3a7d9afd8dd4e9edae9bb8a96a664298eb6be2ec

SHA256
af35eee81df7d356efbeeccbea7b1d86181f4e36a9168673a2fb5faa788e9903

SHA512
2ee975bf151cf4058015feb84285b867bf1891541beb9847f8913c2d7eb419176ebd4e1f80a18d4add7f6904b37f924c3d3b1e3b251ee9ab069758533dce49be

Download Submit
\Windows\Temp\{4866627B-861D-4F30-A536-B76A7A23D6A3}\.cr\python.exe

Filesize
843KB

MD5
908269084a2640ad902dc4b687d00e34

SHA1
3afe99b8576bab28101c94bdd179d760e601593f

SHA256
56113d5c65b3c3a4137be32fe84765c43cfe18445eb6ec0535cbfefb1ebd82ad

SHA512
e3b11566d4ef3323947a496ef50cfa3379afa4a44fea78f73af71b94548ece1392d8e6c9a9129eac65661ceeb54cdb095da902fcc61d4ad03f4badb81f9586c3

Download Submit
memory/556-927-0x0000000002980000-0x0000000002981000-memory.dmp

Filesize
4KB

Download
memory/556-945-0x0000000000400000-0x00000000025D7000-memory.dmp

Filesize
33.8MB

Download
memory/556-934-0x0000000004690000-0x0000000004691000-memory.dmp

Filesize
4KB

Download
memory/556-960-0x0000000000400000-0x00000000025D7000-memory.dmp

Filesize
33.8MB

Download
memory/556-935-0x00000000069E0000-0x00000000069E1000-memory.dmp

Filesize
4KB

Download
memory/556-947-0x0000000002980000-0x0000000002981000-memory.dmp

Filesize
4KB

Download
memory/932-961-0x0000000000400000-0x00000000006E8000-memory.dmp

Filesize
2.9MB

Download
memory/932-959-0x0000000000230000-0x0000000000231000-memory.dmp

Filesize
4KB

Download
memory/1096-919-0x0000000000400000-0x00000000025D7000-memory.dmp

Filesize
33.8MB

Download
memory/1096-920-0x00000000026A0000-0x00000000026A1000-memory.dmp

Filesize
4KB

Download
memory/1096-918-0x00000000026A0000-0x00000000026A1000-memory.dmp

Filesize
4KB

Download
memory/1560-1103-0x0000000002610000-0x0000000002650000-memory.dmp

Filesize
256KB

Download
memory/1560-1104-0x0000000002610000-0x0000000002650000-memory.dmp

Filesize
256KB

Download
memory/1580-968-0x0000000000400000-0x00000000025D7000-memory.dmp

Filesize
33.8MB

Download
memory/1580-967-0x00000000002D0000-0x00000000002D1000-memory.dmp

Filesize
4KB

Download