Automated Malware Analysis IOC Report for

Files

File Path

Type

Category

Malicious

TradingStationPublisher.msi

Composite Document File V2 Document, Little Endian, Os: Windows, Version 10.0, MSI Installer, Create Time/Date: Mon Jun 21 08:00:00 1999, Name of Creating Application: Windows Installer, Security: 1, Code page: 1252, Template: Intel;1033, Number of Pages: 200, Revision Number: {38E8AABD-CF58-4632-80B8-4A82F220D6A0}, Title: Trading Station Publisher, Author: Myfxbook Ltd, Number of Words: 2, Last Saved Time/Date: Tue Jul 4 07:50:13 2023, Last Printed: Tue Jul 4 07:50:13 2023

initial sample

C:\Program Files (x86)\Myfxbook Ltd\Trading Station Publisher\Trading_Station_Publisher.exe

PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows

dropped

C:\Program Files (x86)\Myfxbook Ltd\Trading Station Publisher\fxcmlogger.dll

PE32 executable (DLL) (GUI) Intel 80386, for MS Windows

dropped

C:\Program Files (x86)\Myfxbook Ltd\Trading Station Publisher\fxcmrtmp.dll

PE32 executable (DLL) (GUI) Intel 80386, for MS Windows

dropped

C:\Program Files (x86)\Myfxbook Ltd\Trading Station Publisher\fxcore2.dll

PE32 executable (DLL) (GUI) Intel 80386 Mono/.Net assembly, for MS Windows

dropped

C:\Program Files (x86)\Myfxbook Ltd\Trading Station Publisher\fxmsg.dll

PE32 executable (DLL) (GUI) Intel 80386, for MS Windows

dropped

C:\Program Files (x86)\Myfxbook Ltd\Trading Station Publisher\fxtp.dll

PE32 executable (DLL) (GUI) Intel 80386, for MS Windows

dropped

C:\Program Files (x86)\Myfxbook Ltd\Trading Station Publisher\gsexpat.dll

PE32 executable (DLL) (GUI) Intel 80386, for MS Windows

dropped

C:\Program Files (x86)\Myfxbook Ltd\Trading Station Publisher\gslibeay32.dll

PE32 executable (DLL) (console) Intel 80386, for MS Windows

dropped

C:\Program Files (x86)\Myfxbook Ltd\Trading Station Publisher\gsssleay32.dll

PE32 executable (DLL) (console) Intel 80386, for MS Windows

dropped

C:\Program Files (x86)\Myfxbook Ltd\Trading Station Publisher\gstool2.dll

PE32 executable (DLL) (GUI) Intel 80386, for MS Windows

dropped

C:\Program Files (x86)\Myfxbook Ltd\Trading Station Publisher\gstool3.dll

PE32 executable (DLL) (GUI) Intel 80386, for MS Windows

dropped

C:\Program Files (x86)\Myfxbook Ltd\Trading Station Publisher\gszlib.dll

PE32 executable (DLL) (GUI) Intel 80386, for MS Windows

dropped

C:\Program Files (x86)\Myfxbook Ltd\Trading Station Publisher\httplib.dll

PE32 executable (DLL) (GUI) Intel 80386, for MS Windows

dropped

C:\Program Files (x86)\Myfxbook Ltd\Trading Station Publisher\log4cplus.dll

PE32 executable (DLL) (GUI) Intel 80386, for MS Windows

dropped

C:\Program Files (x86)\Myfxbook Ltd\Trading Station Publisher\pdas.dll

PE32 executable (DLL) (GUI) Intel 80386, for MS Windows

dropped

C:\Program Files (x86)\Myfxbook Ltd\Trading Station Publisher\rtmptp.dll

PE32 executable (DLL) (GUI) Intel 80386, for MS Windows

dropped

C:\Users\user\AppData\Local\Temp\MSI47A2.tmp

PE32 executable (DLL) (GUI) Intel 80386, for MS Windows

dropped

C:\Users\user\AppData\Local\Temp\MSI4801.tmp

PE32 executable (DLL) (GUI) Intel 80386, for MS Windows

dropped

C:\Windows\Installer\MSI5C10.tmp

PE32 executable (DLL) (GUI) Intel 80386, for MS Windows

dropped

C:\Windows\Installer\MSI5C5F.tmp

PE32 executable (DLL) (GUI) Intel 80386, for MS Windows

dropped

C:\Config.Msi\685ad9.rbs

data

modified

C:\Program Files (x86)\Myfxbook Ltd\Trading Station Publisher\ForexConnect.dll

PE32 executable (DLL) (GUI) Intel 80386, for MS Windows

dropped

C:\Program Files (x86)\Myfxbook Ltd\Trading Station Publisher\Microsoft.VC80.CRT.manifest

XML 1.0 document, Unicode text, UTF-8 (with BOM) text, with very long lines (504), with CRLF line terminators

dropped

C:\Program Files (x86)\Myfxbook Ltd\Trading Station Publisher\Order2Go2.dll

PE32 executable (DLL) (GUI) Intel 80386, for MS Windows

dropped

C:\Program Files (x86)\Myfxbook Ltd\Trading Station Publisher\Trading_Station_Publisher.exe.config

XML 1.0 document, ASCII text, with CRLF line terminators

dropped

C:\Program Files (x86)\Myfxbook Ltd\Trading Station Publisher\hash.dat

data

dropped

C:\Program Files (x86)\Myfxbook Ltd\Trading Station Publisher\icon3.ico

MS Windows icon resource - 1 icon, 30x30, 8 bits/pixel

dropped

C:\Program Files (x86)\Myfxbook Ltd\Trading Station Publisher\msvcp80.dll

PE32 executable (DLL) (GUI) Intel 80386, for MS Windows

dropped

C:\Program Files (x86)\Myfxbook Ltd\Trading Station Publisher\msvcr80.dll

PE32 executable (DLL) (GUI) Intel 80386, for MS Windows

dropped

C:\Users\user\AppData\Local\Temp\CFG4800.tmp

XML 1.0 document, ASCII text, with CRLF line terminators

dropped

C:\Users\user\AppData\Local\Temp\CFG5C3F.tmp

XML 1.0 document, ASCII text, with CRLF line terminators

dropped

C:\Users\user\AppData\Roaming\Microsoft\Installer\{C9F0231D-7C82-4D3D-BC5C-98FDA809C5AA}\_853F67D554F05449430E7E.exe

MS Windows icon resource - 1 icon, 30x30, 8 bits/pixel

dropped

C:\Users\user\AppData\Roaming\Microsoft\Installer\{C9F0231D-7C82-4D3D-BC5C-98FDA809C5AA}\_BB9EECDA4E810BDECD5258.exe

MS Windows icon resource - 1 icon, 30x30, 8 bits/pixel

dropped

C:\Users\user\AppData\Roaming\Microsoft\Installer\{C9F0231D-7C82-4D3D-BC5C-98FDA809C5AA}\_D7ED1792E3BE1F33D0BDF7.exe

MS Windows icon resource - 1 icon, 30x30, 8 bits/pixel

dropped

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Trading Station Publisher.lnk

MS Windows shortcut, Item id list present, Has Relative path, Has Working directory, Icon number=0, ctime=Sun Dec 31 23:06:32 1600, mtime=Sun Dec 31 23:06:32 1600, atime=Sun Dec 31 23:06:32 1600, length=0, window=hide

dropped

C:\Users\user\Desktop\Trading Station Publisher.lnk

dropped

C:\Windows\Installer\685ad8.msi

dropped

C:\Windows\Installer\685ada.msi

dropped

C:\Windows\Installer\MSI5CBE.tmp

data

dropped

C:\Windows\Installer\SourceHash{C9F0231D-7C82-4D3D-BC5C-98FDA809C5AA}

Composite Document File V2 Document, Cannot read section info

dropped

C:\Windows\Installer\inprogressinstallinfo.ipi

Composite Document File V2 Document, Cannot read section info

dropped

C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.log

Unicode text, UTF-8 (with BOM) text, with CRLF line terminators

dropped

C:\Windows\Temp\~DF17E8BB0EEC5F308C.TMP

data

dropped

C:\Windows\Temp\~DF2644C9926A78DCE0.TMP

data

dropped

C:\Windows\Temp\~DF64E116F222740F5B.TMP

data

dropped

C:\Windows\Temp\~DF6CA362C3AA904E35.TMP

Composite Document File V2 Document, Cannot read section info

dropped

C:\Windows\Temp\~DF771C0CDFFF9C296B.TMP

Composite Document File V2 Document, Cannot read section info

dropped

C:\Windows\Temp\~DF7E721A1F1407846A.TMP

Composite Document File V2 Document, Cannot read section info

dropped

C:\Windows\Temp\~DF87E40AF1FBC90FF0.TMP

data

dropped

C:\Windows\Temp\~DF9C70C067C5203211.TMP

Composite Document File V2 Document, Cannot read section info

dropped

C:\Windows\Temp\~DFAB99B570AB83F240.TMP

data

dropped

C:\Windows\Temp\~DFD4319B94E9DB9C69.TMP

Composite Document File V2 Document, Cannot read section info

dropped

C:\Windows\Temp\~DFE46B22D1505AEE55.TMP

data

dropped

C:\Windows\Temp\~DFE9ED549134836D65.TMP

data

dropped

There are 45 hidden files, click here to show them.

Processes

Path

Cmdline

Malicious

C:\Windows\System32\msiexec.exe

"C:\Windows\System32\msiexec.exe" /i "C:\Users\user\Desktop\TradingStationPublisher.msi"

Details

Is windows:	true
Is dropped:	false
PID:	7496
Target ID:	0
Parent PID:	2580
Name:	msiexec.exe
Class:	system-tools
Path:	C:\Windows\System32\msiexec.exe
Commandline:	"C:\Windows\System32\msiexec.exe" /i "C:\Users\user\Desktop\TradingStationPublisher.msi"
Size:	69632
MD5:	E5DA170027542E25EDE42FC54C929077
Time:	02:53:35
Date:	31/08/2024
Reason:	newprocess
Reputation:	high
Is admin:	true
Is elevated:	true
Modulebase:	0x7ff6c10a0000
Modulesize:	94208
Wow64:	false

Signature Hits	Behavior Group	Mitre Attack
Spawns processes	System Summary	Process Injection

C:\Windows\System32\msiexec.exe

C:\Windows\system32\msiexec.exe /V

Details

Is windows:	true
Is dropped:	false
PID:	7548
Target ID:	1
Parent PID:	620
Name:	msiexec.exe
Class:	system-tools
Path:	C:\Windows\System32\msiexec.exe
Commandline:	C:\Windows\system32\msiexec.exe /V
Size:	69632
MD5:	E5DA170027542E25EDE42FC54C929077
Time:	02:53:35
Date:	31/08/2024
Reason:	newprocess
Reputation:	high
Is admin:	true
Is elevated:	true
Modulebase:	0x7ff6c10a0000
Modulesize:	94208
Wow64:	false

Signature Hits	Behavior Group	Mitre Attack
Spawns processes	System Summary	Process Injection

C:\Windows\SysWOW64\msiexec.exe

C:\Windows\syswow64\MsiExec.exe -Embedding D01A3FF5829F0F5B771FA5AB009E87F8 C

Details

Is windows:	true
Is dropped:	false
PID:	7596
Target ID:	2
Parent PID:	7548
Name:	msiexec.exe
Class:	system-tools
Path:	C:\Windows\SysWOW64\msiexec.exe
Commandline:	C:\Windows\syswow64\MsiExec.exe -Embedding D01A3FF5829F0F5B771FA5AB009E87F8 C
Size:	59904
MD5:	9D09DC1EDA745A5F87553048E57620CF
Time:	02:53:35
Date:	31/08/2024
Reason:	newprocess
Reputation:	high
Is admin:	true
Is elevated:	true
Modulebase:	0x370000
Modulesize:	73728
Wow64:	true

Signature Hits	Behavior Group	Mitre Attack
Spawns processes	System Summary	Process Injection

C:\Windows\SysWOW64\msiexec.exe

C:\Windows\syswow64\MsiExec.exe -Embedding B3CFD1C5B1A07D95A7F37C5DD98B4186

Details

Is windows:	true
Is dropped:	false
PID:	8148
Target ID:	6
Parent PID:	7548
Name:	msiexec.exe
Class:	system-tools
Path:	C:\Windows\SysWOW64\msiexec.exe
Commandline:	C:\Windows\syswow64\MsiExec.exe -Embedding B3CFD1C5B1A07D95A7F37C5DD98B4186
Size:	59904
MD5:	9D09DC1EDA745A5F87553048E57620CF
Time:	02:54:46
Date:	31/08/2024
Reason:	newprocess
Reputation:	high
Is admin:	true
Is elevated:	true
Modulebase:	0x370000
Modulesize:	73728
Wow64:	true

Signature Hits	Behavior Group	Mitre Attack
Spawns processes	System Summary	Process Injection

URLs

Name

Malicious

http://www.myfxbook.com/help/trading-station-publisher-wizard

unknown

http://www.openssl.org/support/faq.html....................rbwb.rndC:HOMERANDFILEprng

unknown

https://secure.comodo.com/CPS0L

unknown

https://sectigo.com/CPS0

unknown

http://www.myfxbook.com/help/trading-station-publisher-wizard.html

unknown

http://www.openssl.org/V

unknown

http://www.zlib.net/D

unknown

http://www.unicode.org/cldr/)

unknown

https://upload1.myfxbook.com/fxcm-upload.html?

unknown

http://www.fxcorporate.com

unknown

http://www.fxcorporate.com7http://dbfx.fxcorporate.com

unknown

http://www.openssl.org/support/faq.html

unknown

There are 2 hidden URLs, click here to show them.

Registry

Path

Value

Malicious

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\D1EB23A46D17D68FD92564C2F1F1601764D8E349

Blob

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\D1EB23A46D17D68FD92564C2F1F1601764D8E349

Blob

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer

GlobalAssocChangedCounter

HKEY_CURRENT_USER\SOFTWARE\Microsoft\RestartManager\Session0000

Owner

HKEY_CURRENT_USER\SOFTWARE\Microsoft\RestartManager\Session0000

SessionHash

HKEY_CURRENT_USER\SOFTWARE\Microsoft\RestartManager\Session0000

Sequence

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\Folders

C:\Config.Msi\

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\Rollback\Scripts

C:\Config.Msi\685ad9.rbs

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\Rollback\Scripts

C:\Config.Msi\685ad9.rbsLow

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\Folders

C:\Users\user\AppData\Roaming\Microsoft\Installer\

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-21-2246122658-3693405117-2476756634-1002\Components\E80FA548820A42974315FAE6BC9F68E5

D1320F9C28C7D3D4CBC589DF8A905CAA

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-21-2246122658-3693405117-2476756634-1002\Components\B3FD2C1620E3E534DE095A5A5D507D48

D1320F9C28C7D3D4CBC589DF8A905CAA

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-21-2246122658-3693405117-2476756634-1002\Components\9E372BBED8778243F171BD08D9EDB226

D1320F9C28C7D3D4CBC589DF8A905CAA

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-21-2246122658-3693405117-2476756634-1002\Components\5731A9CB07410E1F1BD2B2E8FD5C4407

D1320F9C28C7D3D4CBC589DF8A905CAA

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-21-2246122658-3693405117-2476756634-1002\Components\5EFC3D3CBA911E4260F6A5923CD7EC27

D1320F9C28C7D3D4CBC589DF8A905CAA

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-21-2246122658-3693405117-2476756634-1002\Components\11435F5D613F269B7DF107B7127441A5

D1320F9C28C7D3D4CBC589DF8A905CAA

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-21-2246122658-3693405117-2476756634-1002\Components\47930F9F9B8C881B880D2EBB447B9687

D1320F9C28C7D3D4CBC589DF8A905CAA

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-21-2246122658-3693405117-2476756634-1002\Components\B09F7044F80936427C45ED38F15E19A6

D1320F9C28C7D3D4CBC589DF8A905CAA

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-21-2246122658-3693405117-2476756634-1002\Components\F533E38493FC32F368CD809CF7D6AF30

D1320F9C28C7D3D4CBC589DF8A905CAA

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-21-2246122658-3693405117-2476756634-1002\Components\64461170B84BFE92169FE2AA78AE455C

D1320F9C28C7D3D4CBC589DF8A905CAA

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-21-2246122658-3693405117-2476756634-1002\Components\07CFE2D14900B4714F6E86D894D72469

D1320F9C28C7D3D4CBC589DF8A905CAA

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-21-2246122658-3693405117-2476756634-1002\Components\7B1A2FC2300266904E094995286C8730

D1320F9C28C7D3D4CBC589DF8A905CAA

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-21-2246122658-3693405117-2476756634-1002\Components\55B13A8B76FEF4E3326D639A2AAF8E5A

D1320F9C28C7D3D4CBC589DF8A905CAA

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-21-2246122658-3693405117-2476756634-1002\Components\9A1E89B0F673BBC7E4AA65FE3317846E

D1320F9C28C7D3D4CBC589DF8A905CAA

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-21-2246122658-3693405117-2476756634-1002\Components\33AD395A0FC55BBC3B1BE5C9F8E82CA5

D1320F9C28C7D3D4CBC589DF8A905CAA

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-21-2246122658-3693405117-2476756634-1002\Components\15BAF10D60C68B1490B0A0ABE1E0F491

D1320F9C28C7D3D4CBC589DF8A905CAA

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-21-2246122658-3693405117-2476756634-1002\Components\40DE1EFE632E158386B10EBE1382C68D

D1320F9C28C7D3D4CBC589DF8A905CAA

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-21-2246122658-3693405117-2476756634-1002\Components\B37F642D3462CC96B09257B4996F05C2

D1320F9C28C7D3D4CBC589DF8A905CAA

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-21-2246122658-3693405117-2476756634-1002\Components\8E60FB973E030A18F4332A5827E5E27E

D1320F9C28C7D3D4CBC589DF8A905CAA

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-21-2246122658-3693405117-2476756634-1002\Components\54276AEA3D4D9BD39DE08FD9A9AC60B4

D1320F9C28C7D3D4CBC589DF8A905CAA

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-21-2246122658-3693405117-2476756634-1002\Components\47FD68219369EAA0DE6B7DCD95A627CB

D1320F9C28C7D3D4CBC589DF8A905CAA

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-21-2246122658-3693405117-2476756634-1002\Components\B2AFC08B12D6914AEB5C29AF3FCC5691

D1320F9C28C7D3D4CBC589DF8A905CAA

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-21-2246122658-3693405117-2476756634-1002\Components\65C6657EECAD73B8AEE0DD1B09ED309D

D1320F9C28C7D3D4CBC589DF8A905CAA

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-21-2246122658-3693405117-2476756634-1002\Components\C726B38AB1C7C305817C500BCE2AF536

D1320F9C28C7D3D4CBC589DF8A905CAA

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-21-2246122658-3693405117-2476756634-1002\Components\35141882BD3199C0F50A0E81103669CA

D1320F9C28C7D3D4CBC589DF8A905CAA

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-21-2246122658-3693405117-2476756634-1002\Components\49ED9C993BF41A7EE515D380DD6CAA28

D1320F9C28C7D3D4CBC589DF8A905CAA

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\Folders

C:\Program Files (x86)\Myfxbook Ltd\Trading Station Publisher\

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\Folders

C:\Program Files (x86)\Myfxbook Ltd\

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\Folders

C:\Users\user\AppData\Roaming\Microsoft\Installer\{C9F0231D-7C82-4D3D-BC5C-98FDA809C5AA}\

HKEY_CURRENT_USER\SOFTWARE\Myfxbook Ltd\Trading Station Publisher\{E7566C56-DACE-8B37-EA0E-DDB190DE03D9}

ProgramMenuFolder

HKEY_CURRENT_USER\SOFTWARE\Myfxbook Ltd\Trading Station Publisher\{A83B627C-7C1B-503C-18C7-05B0ECA25F63}

DesktopFolder

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-21-2246122658-3693405117-2476756634-1002\Products\D1320F9C28C7D3D4CBC589DF8A905CAA\InstallProperties

LocalPackage

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-21-2246122658-3693405117-2476756634-1002\Products\D1320F9C28C7D3D4CBC589DF8A905CAA\InstallProperties

AuthorizedCDFPrefix

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-21-2246122658-3693405117-2476756634-1002\Products\D1320F9C28C7D3D4CBC589DF8A905CAA\InstallProperties

Comments

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-21-2246122658-3693405117-2476756634-1002\Products\D1320F9C28C7D3D4CBC589DF8A905CAA\InstallProperties

Contact

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-21-2246122658-3693405117-2476756634-1002\Products\D1320F9C28C7D3D4CBC589DF8A905CAA\InstallProperties

DisplayVersion

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-21-2246122658-3693405117-2476756634-1002\Products\D1320F9C28C7D3D4CBC589DF8A905CAA\InstallProperties

HelpLink

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-21-2246122658-3693405117-2476756634-1002\Products\D1320F9C28C7D3D4CBC589DF8A905CAA\InstallProperties

HelpTelephone

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-21-2246122658-3693405117-2476756634-1002\Products\D1320F9C28C7D3D4CBC589DF8A905CAA\InstallProperties

InstallDate

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-21-2246122658-3693405117-2476756634-1002\Products\D1320F9C28C7D3D4CBC589DF8A905CAA\InstallProperties

InstallLocation

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-21-2246122658-3693405117-2476756634-1002\Products\D1320F9C28C7D3D4CBC589DF8A905CAA\InstallProperties

InstallSource

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-21-2246122658-3693405117-2476756634-1002\Products\D1320F9C28C7D3D4CBC589DF8A905CAA\InstallProperties

ModifyPath

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-21-2246122658-3693405117-2476756634-1002\Products\D1320F9C28C7D3D4CBC589DF8A905CAA\InstallProperties

Publisher

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-21-2246122658-3693405117-2476756634-1002\Products\D1320F9C28C7D3D4CBC589DF8A905CAA\InstallProperties

Readme

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-21-2246122658-3693405117-2476756634-1002\Products\D1320F9C28C7D3D4CBC589DF8A905CAA\InstallProperties

Size

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-21-2246122658-3693405117-2476756634-1002\Products\D1320F9C28C7D3D4CBC589DF8A905CAA\InstallProperties

EstimatedSize

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-21-2246122658-3693405117-2476756634-1002\Products\D1320F9C28C7D3D4CBC589DF8A905CAA\InstallProperties

UninstallString

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-21-2246122658-3693405117-2476756634-1002\Products\D1320F9C28C7D3D4CBC589DF8A905CAA\InstallProperties

URLInfoAbout

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-21-2246122658-3693405117-2476756634-1002\Products\D1320F9C28C7D3D4CBC589DF8A905CAA\InstallProperties

URLUpdateInfo

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-21-2246122658-3693405117-2476756634-1002\Products\D1320F9C28C7D3D4CBC589DF8A905CAA\InstallProperties

VersionMajor

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-21-2246122658-3693405117-2476756634-1002\Products\D1320F9C28C7D3D4CBC589DF8A905CAA\InstallProperties

VersionMinor

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-21-2246122658-3693405117-2476756634-1002\Products\D1320F9C28C7D3D4CBC589DF8A905CAA\InstallProperties

WindowsInstaller

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-21-2246122658-3693405117-2476756634-1002\Products\D1320F9C28C7D3D4CBC589DF8A905CAA\InstallProperties

Version

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-21-2246122658-3693405117-2476756634-1002\Products\D1320F9C28C7D3D4CBC589DF8A905CAA\InstallProperties

Language

HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{C9F0231D-7C82-4D3D-BC5C-98FDA809C5AA}

AuthorizedCDFPrefix

HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{C9F0231D-7C82-4D3D-BC5C-98FDA809C5AA}

Comments

HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{C9F0231D-7C82-4D3D-BC5C-98FDA809C5AA}

Contact

HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{C9F0231D-7C82-4D3D-BC5C-98FDA809C5AA}

DisplayVersion

HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{C9F0231D-7C82-4D3D-BC5C-98FDA809C5AA}

HelpLink

HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{C9F0231D-7C82-4D3D-BC5C-98FDA809C5AA}

HelpTelephone

HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{C9F0231D-7C82-4D3D-BC5C-98FDA809C5AA}

InstallDate

HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{C9F0231D-7C82-4D3D-BC5C-98FDA809C5AA}

InstallLocation

HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{C9F0231D-7C82-4D3D-BC5C-98FDA809C5AA}

InstallSource

HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{C9F0231D-7C82-4D3D-BC5C-98FDA809C5AA}

ModifyPath

HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{C9F0231D-7C82-4D3D-BC5C-98FDA809C5AA}

Publisher

HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{C9F0231D-7C82-4D3D-BC5C-98FDA809C5AA}

Readme

HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{C9F0231D-7C82-4D3D-BC5C-98FDA809C5AA}

Size

HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{C9F0231D-7C82-4D3D-BC5C-98FDA809C5AA}

EstimatedSize

HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{C9F0231D-7C82-4D3D-BC5C-98FDA809C5AA}

UninstallString

HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{C9F0231D-7C82-4D3D-BC5C-98FDA809C5AA}

URLInfoAbout

HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{C9F0231D-7C82-4D3D-BC5C-98FDA809C5AA}

URLUpdateInfo

HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{C9F0231D-7C82-4D3D-BC5C-98FDA809C5AA}

VersionMajor

HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{C9F0231D-7C82-4D3D-BC5C-98FDA809C5AA}

VersionMinor

HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{C9F0231D-7C82-4D3D-BC5C-98FDA809C5AA}

WindowsInstaller

HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{C9F0231D-7C82-4D3D-BC5C-98FDA809C5AA}

Version

HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{C9F0231D-7C82-4D3D-BC5C-98FDA809C5AA}

Language

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UpgradeCodes\4F25A81C972D29347AAD5C87A1184A1C

D1320F9C28C7D3D4CBC589DF8A905CAA

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-21-2246122658-3693405117-2476756634-1002\Products\D1320F9C28C7D3D4CBC589DF8A905CAA\InstallProperties

DisplayName

HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{C9F0231D-7C82-4D3D-BC5C-98FDA809C5AA}

DisplayName

HKEY_CURRENT_USER\SOFTWARE\Microsoft\Installer\Assemblies\C:|Program Files (x86)|Myfxbook Ltd|Trading Station Publisher|fxcore2.dll

fxcore2,Version="1.3.2.0",Culture="neutral",PublicKeyToken="440355E023152E83",ProcessorArchitecture="x86"

HKEY_CURRENT_USER\SOFTWARE\Microsoft\Installer\Assemblies\C:|Program Files (x86)|Myfxbook Ltd|Trading Station Publisher|Trading_Station_Publisher.exe

Trading_Station_Publisher,Version="2.0.0.0",Culture="neutral",ProcessorArchitecture="x86"

HKEY_CURRENT_USER\SOFTWARE\Microsoft\Installer\Features\D1320F9C28C7D3D4CBC589DF8A905CAA

DefaultFeature

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-21-2246122658-3693405117-2476756634-1002\Products\D1320F9C28C7D3D4CBC589DF8A905CAA\Features

DefaultFeature

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-21-2246122658-3693405117-2476756634-1002\Products\D1320F9C28C7D3D4CBC589DF8A905CAA\Patches

AllPatches

HKEY_CURRENT_USER\SOFTWARE\Microsoft\Installer\Products\D1320F9C28C7D3D4CBC589DF8A905CAA

ProductName

HKEY_CURRENT_USER\SOFTWARE\Microsoft\Installer\Products\D1320F9C28C7D3D4CBC589DF8A905CAA

PackageCode

HKEY_CURRENT_USER\SOFTWARE\Microsoft\Installer\Products\D1320F9C28C7D3D4CBC589DF8A905CAA

Language

HKEY_CURRENT_USER\SOFTWARE\Microsoft\Installer\Products\D1320F9C28C7D3D4CBC589DF8A905CAA

Version

HKEY_CURRENT_USER\SOFTWARE\Microsoft\Installer\Products\D1320F9C28C7D3D4CBC589DF8A905CAA

Assignment

HKEY_CURRENT_USER\SOFTWARE\Microsoft\Installer\Products\D1320F9C28C7D3D4CBC589DF8A905CAA

AdvertiseFlags

HKEY_CURRENT_USER\SOFTWARE\Microsoft\Installer\Products\D1320F9C28C7D3D4CBC589DF8A905CAA

ProductIcon

HKEY_CURRENT_USER\SOFTWARE\Microsoft\Installer\Products\D1320F9C28C7D3D4CBC589DF8A905CAA

InstanceType

HKEY_CURRENT_USER\SOFTWARE\Microsoft\Installer\Products\D1320F9C28C7D3D4CBC589DF8A905CAA

AuthorizedLUAApp

HKEY_CURRENT_USER\SOFTWARE\Microsoft\Installer\Products\D1320F9C28C7D3D4CBC589DF8A905CAA

DeploymentFlags

HKEY_CURRENT_USER\SOFTWARE\Microsoft\Installer\UpgradeCodes\4F25A81C972D29347AAD5C87A1184A1C

D1320F9C28C7D3D4CBC589DF8A905CAA

HKEY_CURRENT_USER\SOFTWARE\Microsoft\Installer\Products\D1320F9C28C7D3D4CBC589DF8A905CAA\SourceList

PackageName

HKEY_CURRENT_USER\SOFTWARE\Microsoft\Installer\Products\D1320F9C28C7D3D4CBC589DF8A905CAA\SourceList\Net

HKEY_CURRENT_USER\SOFTWARE\Microsoft\Installer\Products\D1320F9C28C7D3D4CBC589DF8A905CAA\SourceList\Media

HKEY_CURRENT_USER\SOFTWARE\Microsoft\Installer\Products\D1320F9C28C7D3D4CBC589DF8A905CAA

Clients

HKEY_CURRENT_USER\SOFTWARE\Microsoft\Installer\Products\D1320F9C28C7D3D4CBC589DF8A905CAA\SourceList

LastUsedSource

There are 100 hidden registries, click here to show them.

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

IOC Report
TradingStationPublisher.msi

Files

Processes

URLs

Registry

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

IOC ReportTradingStationPublisher.msi

Files

Processes

URLs

Registry

IOC Report
TradingStationPublisher.msi