General Info

File name

OldMHUUninstaller.exe

Full analysis
https://app.any.run/tasks/52208145-7d32-4bc2-9e43-d81f14358659
Verdict
Malicious activity
Analysis date
6/12/2019, 13:46:20
OS:
Windows 7 Professional Service Pack 1 (build: 7601, 32 bit)
Indicators:

MIME:
application/x-dosexec
File info:
PE32 executable (GUI) Intel 80386, for MS Windows
MD5

1329ade03f58927b4d53bcd2efa29bdd

SHA1

1eaa403052201e0c9896d0fe3d0a8ece0085f37f

SHA256

ae4718ea01d1d749a5a0f3791f3ec1ad3a7029302a6b28ef19988db60c3a6137

SSDEEP

12288:u79g/k9Ygb25zyaaEqrHqm/A3er7y19vfrFKYuO:agwYgb25FJsqIAuf693h

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distored by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

Software environment set and analysis options

Launch configuration

Task duration
60 seconds
Additional time used
none
Fakenet option
off
Heavy Evaision option
off
MITM proxy
off
Route via Tor
off
Network geolocation
off
Privacy
Public submission
Autoconfirmation of UAC
on

Software preset

  • Internet Explorer 8.0.7601.17514
  • Adobe Acrobat Reader DC MUI (15.023.20070)
  • Adobe Flash Player 26 ActiveX (26.0.0.131)
  • Adobe Flash Player 26 NPAPI (26.0.0.131)
  • Adobe Flash Player 26 PPAPI (26.0.0.131)
  • Adobe Refresh Manager (1.8.0)
  • CCleaner (5.35)
  • FileZilla Client 3.36.0 (3.36.0)
  • Google Chrome (73.0.3683.75)
  • Google Update Helper (1.3.33.23)
  • Java 8 Update 92 (8.0.920.14)
  • Java Auto Updater (2.8.92.14)
  • Microsoft .NET Framework 4.6.1 (4.6.01055)
  • Microsoft Office Access MUI (English) 2010 (14.0.6029.1000)
  • Microsoft Office Access Setup Metadata MUI (English) 2010 (14.0.6029.1000)
  • Microsoft Office Excel MUI (English) 2010 (14.0.6029.1000)
  • Microsoft Office OneNote MUI (English) 2010 (14.0.6029.1000)
  • Microsoft Office Outlook MUI (English) 2010 (14.0.6029.1000)
  • Microsoft Office PowerPoint MUI (English) 2010 (14.0.6029.1000)
  • Microsoft Office Professional 2010 (14.0.6029.1000)
  • Microsoft Office Proof (English) 2010 (14.0.6029.1000)
  • Microsoft Office Proof (French) 2010 (14.0.6029.1000)
  • Microsoft Office Proof (Spanish) 2010 (14.0.6029.1000)
  • Microsoft Office Proofing (English) 2010 (14.0.6029.1000)
  • Microsoft Office Publisher MUI (English) 2010 (14.0.6029.1000)
  • Microsoft Office Shared MUI (English) 2010 (14.0.6029.1000)
  • Microsoft Office Shared Setup Metadata MUI (English) 2010 (14.0.6029.1000)
  • Microsoft Office Single Image 2010 (14.0.6029.1000)
  • Microsoft Office Word MUI (English) 2010 (14.0.6029.1000)
  • Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.6161 (9.0.30729.6161)
  • Microsoft Visual C++ 2010 x86 Redistributable - 10.0.40219 (10.0.40219)
  • Microsoft Visual C++ 2013 Redistributable (x86) - 12.0.30501 (12.0.30501.0)
  • Microsoft Visual C++ 2013 x86 Additional Runtime - 12.0.21005 (12.0.21005)
  • Microsoft Visual C++ 2013 x86 Minimum Runtime - 12.0.21005 (12.0.21005)
  • Microsoft Visual C++ 2017 Redistributable (x86) - 14.15.26706 (14.15.26706.0)
  • Microsoft Visual C++ 2017 x86 Additional Runtime - 14.15.26706 (14.15.26706)
  • Microsoft Visual C++ 2017 x86 Minimum Runtime - 14.15.26706 (14.15.26706)
  • Mozilla Firefox 65.0.2 (x86 en-US) (65.0.2)
  • Notepad++ (32-bit x86) (7.5.1)
  • Opera 12.15 (12.15.1748)
  • Skype version 8.29 (8.29)
  • VLC media player (2.2.6)
  • WinRAR 5.60 (32-bit) (5.60.0)

Hotfixes

  • Client LanguagePack Package
  • Client Refresh LanguagePack Package
  • CodecPack Basic Package
  • Foundation Package
  • IE Troubleshooters Package
  • InternetExplorer Optional Package
  • KB2534111
  • KB2999226
  • KB976902
  • LocalPack AU Package
  • LocalPack CA Package
  • LocalPack GB Package
  • LocalPack US Package
  • LocalPack ZA Package
  • ProfessionalEdition
  • UltimateEdition

Behavior activities

MALICIOUS SUSPICIOUS INFO
Changes the autorun value in the registry
  • OldMHUUninstaller.exe (PID: 2712)
Loads dropped or rewritten executable
  • OldMHUUninstaller.exe (PID: 1140)
Executable content was dropped or overwritten
  • msiexec.exe (PID: 3668)
  • OldMHUUninstaller.exe (PID: 3076)
  • OldMHUUninstaller.exe (PID: 2712)
  • OldMHUUninstaller.exe (PID: 1140)
Creates files in the program directory
  • OldMHUUninstaller.exe (PID: 2712)
Executed via COM
  • DrvInst.exe (PID: 3172)
Creates a software uninstall entry
  • OldMHUUninstaller.exe (PID: 2712)
Executed as Windows Service
  • vssvc.exe (PID: 3924)
Starts itself from another location
  • OldMHUUninstaller.exe (PID: 3076)
  • OldMHUUninstaller.exe (PID: 1140)
Searches for installed software
  • OldMHUUninstaller.exe (PID: 2712)
Adds / modifies Windows certificates
  • DrvInst.exe (PID: 3172)
Creates a software uninstall entry
  • msiexec.exe (PID: 3668)
Changes settings of System certificates
  • DrvInst.exe (PID: 3172)
Low-level read access rights to disk partition
  • vssvc.exe (PID: 3924)

Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report

Static information

TRiD
.exe
|   Win32 Executable (generic) (52.9%)
.exe
|   Generic Win/DOS Executable (23.5%)
.exe
|   DOS Executable Generic (23.5%)
EXIF
EXE
MachineType:
Intel 386 or later, and compatibles
TimeStamp:
2017:05:01 16:33:52+02:00
PEType:
PE32
LinkerVersion:
14.1
CodeSize:
302080
InitializedDataSize:
161280
UninitializedDataSize:
null
EntryPoint:
0x2e1fd
OSVersion:
5.1
ImageVersion:
null
SubsystemVersion:
5.1
Subsystem:
Windows GUI
FileVersionNumber:
3.2.0.0
ProductVersionNumber:
3.2.0.0
FileFlagsMask:
0x003f
FileFlags:
(none)
FileOS:
Win32
ObjectFileType:
Executable application
FileSubtype:
null
LanguageCode:
English (U.S.)
CharacterSet:
Windows, Latin1
CompanyName:
Plantronics, Inc.
FileDescription:
OldMHUUninstaller
FileVersion:
3.2.0.0
InternalName:
setup
LegalCopyright:
Copyright (c) Plantronics, Inc.. All rights reserved.
OriginalFileName:
OldMHUUninstaller.exe
ProductName:
OldMHUUninstaller
ProductVersion:
3.2.0.0
Summary
Architecture:
IMAGE_FILE_MACHINE_I386
Subsystem:
IMAGE_SUBSYSTEM_WINDOWS_GUI
Compilation Date:
01-May-2017 14:33:52
Detected languages
English - United States
Debug artifacts
C:\build\work\eca3d12b\wix3\build\ship\x86\burn.pdb
CompanyName:
Plantronics, Inc.
FileDescription:
OldMHUUninstaller
FileVersion:
3.2.0.0
InternalName:
setup
LegalCopyright:
Copyright (c) Plantronics, Inc.. All rights reserved.
OriginalFilename:
OldMHUUninstaller.exe
ProductName:
OldMHUUninstaller
ProductVersion:
3.2.0.0
DOS Header
Magic number:
MZ
Bytes on last page of file:
0x0090
Pages in file:
0x0003
Relocations:
0x0000
Size of header:
0x0004
Min extra paragraphs:
0x0000
Max extra paragraphs:
0xFFFF
Initial SS value:
0x0000
Initial SP value:
0x00B8
Checksum:
0x0000
Initial IP value:
0x0000
Initial CS value:
0x0000
Overlay number:
0x0000
OEM identifier:
0x0000
OEM information:
0x0000
Address of NE header:
0x00000118
PE Headers
Signature:
PE
Machine:
IMAGE_FILE_MACHINE_I386
Number of sections:
7
Time date stamp:
01-May-2017 14:33:52
Pointer to Symbol Table:
0x00000000
Number of symbols:
0
Size of Optional Header:
0x00E0
Characteristics
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_NET_RUN_FROM_SWAP
IMAGE_FILE_REMOVABLE_RUN_FROM_SWAP
Sections
Name Virtual Address Virtual Size Raw Size Charateristics Entropy
.text 0x00001000 0x00049A67 0x00049C00 IMAGE_SCN_CNT_CODE,IMAGE_SCN_MEM_EXECUTE,IMAGE_SCN_MEM_READ 6.56282
.rdata 0x0004B000 0x0001EC60 0x0001EE00 IMAGE_SCN_CNT_INITIALIZED_DATA,IMAGE_SCN_MEM_READ 5.10841
.data 0x0006A000 0x00001730 0x00000A00 IMAGE_SCN_CNT_INITIALIZED_DATA,IMAGE_SCN_MEM_READ,IMAGE_SCN_MEM_WRITE 3.15458
.wixburn8 0x0006C000 0x00000038 0x00000200 IMAGE_SCN_CNT_INITIALIZED_DATA,IMAGE_SCN_MEM_READ 0.553262
.tls 0x0006D000 0x00000009 0x00000200 IMAGE_SCN_CNT_INITIALIZED_DATA,IMAGE_SCN_MEM_READ,IMAGE_SCN_MEM_WRITE 0
.rsrc 0x0006E000 0x00003A6C 0x00003C00 IMAGE_SCN_CNT_INITIALIZED_DATA,IMAGE_SCN_MEM_READ 5.5363
.reloc 0x00072000 0x00003DEC 0x00003E00 IMAGE_SCN_CNT_INITIALIZED_DATA,IMAGE_SCN_MEM_DISCARDABLE,IMAGE_SCN_MEM_READ 6.79026
Resources
1

Imports
    ADVAPI32.dll

    USER32.dll

    OLEAUT32.dll

    GDI32.dll

    SHELL32.dll

    ole32.dll

    KERNEL32.dll

    RPCRT4.dll

    Cabinet.dll (delay-loaded)

Exports

    No exports.

Screenshots

Processes

Total processes
42
Monitored processes
6
Malicious processes
3
Suspicious processes
0

Behavior graph

+
start oldmhuuninstaller.exe oldmhuuninstaller.exe oldmhuuninstaller.exe vssvc.exe no specs drvinst.exe no specs msiexec.exe
Specs description
Program did not start
Integrity level elevation
Task сontains an error or was rebooted
Process has crashed
Task contains several apps running
Executable file was dropped
Debug information is available
Process was injected
Network attacks were detected
Application downloaded the executable file
Actions similar to stealing personal data
Behavior similar to exploiting the vulnerability
Inspected object has sucpicious PE structure
File is detected by antivirus software
CPU overrun
RAM overrun
Process starts the services
Process was added to the startup
Behavior similar to spam
Low-level access to the HDD
Probably Tor was used
System was rebooted
Connects to the network
Known threat

Process information

Click at the process to see the details.

PID
3076
CMD
"C:\Users\admin\AppData\Local\Temp\OldMHUUninstaller.exe"
Path
C:\Users\admin\AppData\Local\Temp\OldMHUUninstaller.exe
Indicators
Parent process
––
User
admin
Integrity Level
MEDIUM
Exit code
0
Version:
Company
Plantronics, Inc.
Description
OldMHUUninstaller
Version
3.2.0.0
Modules
Image
c:\users\admin\appdata\local\temp\oldmhuuninstaller.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
c:\windows\system32\oleaut32.dll
c:\windows\system32\ole32.dll
c:\windows\system32\shell32.dll
c:\windows\system32\shlwapi.dll
c:\windows\system32\imm32.dll
c:\windows\system32\msctf.dll
c:\windows\system32\api-ms-win-core-synch-l1-2-0.dll
c:\windows\system32\cabinet.dll
c:\windows\system32\msi.dll
c:\windows\system32\version.dll
c:\windows\system32\urlmon.dll
c:\windows\system32\wininet.dll
c:\windows\system32\crypt32.dll
c:\windows\system32\msasn1.dll
c:\windows\system32\iertutil.dll
c:\windows\system32\comres.dll
c:\windows\system32\clbcatq.dll
c:\windows\system32\feclient.dll
c:\windows\system32\cryptbase.dll
c:\windows\system32\msxml3.dll
c:\windows\system32\profapi.dll
c:\windows\system32\apphelp.dll
c:\users\admin\appdata\local\temp\{9507f7ab-8b18-492d-abc8-35bb2a0a251a}\.cr\oldmhuuninstaller.exe

PID
1140
CMD
"C:\Users\admin\AppData\Local\Temp\{9507F7AB-8B18-492D-ABC8-35BB2A0A251A}\.cr\OldMHUUninstaller.exe" -burn.clean.room="C:\Users\admin\AppData\Local\Temp\OldMHUUninstaller.exe" -burn.filehandle.attached=148 -burn.filehandle.self=156
Path
C:\Users\admin\AppData\Local\Temp\{9507F7AB-8B18-492D-ABC8-35BB2A0A251A}\.cr\OldMHUUninstaller.exe
Indicators
Parent process
OldMHUUninstaller.exe
User
admin
Integrity Level
MEDIUM
Exit code
0
Version:
Company
Plantronics, Inc.
Description
OldMHUUninstaller
Version
3.2.0.0
Modules
Image
c:\users\admin\appdata\local\temp\{9507f7ab-8b18-492d-abc8-35bb2a0a251a}\.cr\oldmhuuninstaller.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
c:\windows\system32\oleaut32.dll
c:\windows\system32\ole32.dll
c:\windows\system32\shell32.dll
c:\windows\system32\shlwapi.dll
c:\windows\system32\imm32.dll
c:\windows\system32\msctf.dll
c:\windows\system32\api-ms-win-core-synch-l1-2-0.dll
c:\windows\system32\cryptbase.dll
c:\windows\system32\msi.dll
c:\windows\system32\version.dll
c:\windows\system32\clbcatq.dll
c:\windows\system32\cabinet.dll
c:\windows\system32\msxml3.dll
c:\windows\system32\profapi.dll
c:\windows\system32\feclient.dll
c:\users\admin\appdata\local\temp\{0a0695a1-ab64-47c6-92e9-16fa73377c99}\.ba\wixstdba.dll
c:\windows\system32\comdlg32.dll
c:\windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_41e6975e2bd6f2b2\comctl32.dll
c:\windows\winsxs\x86_microsoft.windows.gdiplus_6595b64144ccf1df_1.1.7601.17514_none_72d18a4386696c80\gdiplus.dll
c:\windows\system32\msimg32.dll
c:\windows\system32\windowscodecs.dll
c:\windows\system32\explorerframe.dll
c:\windows\system32\duser.dll
c:\windows\system32\dui70.dll
c:\windows\system32\uxtheme.dll
c:\windows\system32\riched20.dll
c:\program files\common files\microsoft shared\ink\tiptsf.dll
c:\windows\system32\propsys.dll
c:\windows\system32\ntmarta.dll
c:\windows\system32\wldap32.dll
c:\windows\system32\cryptsp.dll
c:\windows\system32\rsaenh.dll
c:\windows\system32\rpcrtremote.dll
c:\windows\system32\setupapi.dll
c:\windows\system32\cfgmgr32.dll
c:\windows\system32\devobj.dll
c:\windows\system32\apphelp.dll
c:\windows\system32\shdocvw.dll
c:\windows\system32\urlmon.dll
c:\windows\system32\wininet.dll
c:\windows\system32\iertutil.dll
c:\windows\system32\crypt32.dll
c:\windows\system32\msasn1.dll
c:\windows\system32\sspicli.dll
c:\windows\system32\mpr.dll

PID
2712
CMD
"C:\Users\admin\AppData\Local\Temp\{0A0695A1-AB64-47C6-92E9-16FA73377C99}\.be\OldMHUUninstaller.exe" -q -burn.elevated BurnPipe.{1E2D319C-A8EA-4019-8078-B6EA3D0997E7} {E429EA38-8E94-4542-A872-56A69543A3F9} 1140
Path
C:\Users\admin\AppData\Local\Temp\{0A0695A1-AB64-47C6-92E9-16FA73377C99}\.be\OldMHUUninstaller.exe
Indicators
Parent process
OldMHUUninstaller.exe
User
admin
Integrity Level
HIGH
Exit code
0
Version:
Company
Plantronics, Inc.
Description
OldMHUUninstaller
Version
3.2.0.0
Modules
Image
c:\users\admin\appdata\local\temp\{0a0695a1-ab64-47c6-92e9-16fa73377c99}\.be\oldmhuuninstaller.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
c:\windows\system32\ole32.dll
c:\windows\system32\oleaut32.dll
c:\windows\system32\shell32.dll
c:\windows\system32\shlwapi.dll
c:\windows\system32\imm32.dll
c:\windows\system32\msctf.dll
c:\windows\system32\api-ms-win-core-synch-l1-2-0.dll
c:\windows\system32\cabinet.dll
c:\windows\system32\msi.dll
c:\windows\system32\version.dll
c:\windows\system32\wininet.dll
c:\windows\system32\urlmon.dll
c:\windows\system32\crypt32.dll
c:\windows\system32\msasn1.dll
c:\windows\system32\iertutil.dll
c:\windows\system32\comres.dll
c:\windows\system32\clbcatq.dll
c:\windows\system32\feclient.dll
c:\windows\system32\cryptbase.dll
c:\windows\system32\msxml3.dll
c:\windows\system32\profapi.dll
c:\windows\system32\srclient.dll
c:\windows\system32\spp.dll
c:\windows\system32\vssapi.dll
c:\windows\system32\atl.dll
c:\windows\system32\vsstrace.dll
c:\windows\system32\ntmarta.dll
c:\windows\system32\wldap32.dll
c:\windows\system32\wuapi.dll
c:\windows\system32\wintrust.dll
c:\windows\system32\wups.dll
c:\windows\system32\cryptsp.dll
c:\windows\system32\rsaenh.dll
c:\windows\system32\rpcrtremote.dll
c:\windows\system32\vss_ps.dll
c:\windows\system32\dsrole.dll
c:\windows\system32\es.dll
c:\windows\system32\sxs.dll
c:\windows\system32\propsys.dll
c:\windows\system32\samcli.dll
c:\windows\system32\samlib.dll
c:\windows\system32\netutils.dll
c:\windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_41e6975e2bd6f2b2\comctl32.dll
c:\windows\system32\msimsg.dll
c:\windows\system32\netapi32.dll
c:\windows\system32\srvcli.dll
c:\windows\system32\wkscli.dll

PID
3924
CMD
C:\Windows\system32\vssvc.exe
Path
C:\Windows\system32\vssvc.exe
Indicators
No indicators
Parent process
––
User
SYSTEM
Integrity Level
SYSTEM
Version:
Company
Microsoft Corporation
Description
Microsoft® Volume Shadow Copy Service
Version
6.1.7600.16385 (win7_rtm.090713-1255)
Modules
Image
c:\windows\system32\vssvc.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\lpk.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\usp10.dll
c:\windows\system32\atl.dll
c:\windows\system32\ole32.dll
c:\windows\system32\shlwapi.dll
c:\windows\system32\oleaut32.dll
c:\windows\system32\vssapi.dll
c:\windows\system32\vsstrace.dll
c:\windows\system32\netapi32.dll
c:\windows\system32\netutils.dll
c:\windows\system32\srvcli.dll
c:\windows\system32\wkscli.dll
c:\windows\system32\samcli.dll
c:\windows\system32\clusapi.dll
c:\windows\system32\cryptdll.dll
c:\windows\system32\xolehlp.dll
c:\windows\system32\version.dll
c:\windows\system32\resutils.dll
c:\windows\system32\setupapi.dll
c:\windows\system32\cfgmgr32.dll
c:\windows\system32\devobj.dll
c:\windows\system32\authz.dll
c:\windows\system32\virtdisk.dll
c:\windows\system32\fltlib.dll
c:\windows\system32\imm32.dll
c:\windows\system32\msctf.dll
c:\windows\system32\cryptbase.dll
c:\windows\system32\cryptsp.dll
c:\windows\system32\rsaenh.dll
c:\windows\system32\rpcrtremote.dll
c:\windows\system32\clbcatq.dll
c:\windows\system32\vss_ps.dll
c:\windows\system32\samlib.dll
c:\windows\system32\es.dll
c:\windows\system32\propsys.dll
c:\windows\system32\catsrvut.dll
c:\windows\system32\mfcsubs.dll
c:\windows\system32\sxs.dll
c:\windows\system32\msxml3.dll
c:\windows\system32\crypt32.dll
c:\windows\system32\wintrust.dll
c:\windows\system32\msasn1.dll

PID
3172
CMD
DrvInst.exe "1" "200" "STORAGE\VolumeSnapshot\HarddiskVolumeSnapshot18" "" "" "6792c44eb" "00000000" "000005C4" "000003A0"
Path
C:\Windows\system32\DrvInst.exe
Indicators
No indicators
Parent process
––
User
SYSTEM
Integrity Level
SYSTEM
Exit code
0
Version:
Company
Microsoft Corporation
Description
Driver Installation Module
Version
6.1.7600.16385 (win7_rtm.090713-1255)
Modules
Image
c:\windows\system32\drvinst.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\setupapi.dll
c:\windows\system32\cfgmgr32.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\sechost.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\user32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
c:\windows\system32\oleaut32.dll
c:\windows\system32\ole32.dll
c:\windows\system32\devobj.dll
c:\windows\system32\devrtl.dll
c:\windows\system32\imm32.dll
c:\windows\system32\msctf.dll
c:\windows\system32\spinf.dll
c:\windows\system32\wintrust.dll
c:\windows\system32\crypt32.dll
c:\windows\system32\msasn1.dll
c:\windows\system32\cryptsp.dll
c:\windows\system32\rsaenh.dll
c:\windows\system32\cryptbase.dll
c:\windows\system32\ncrypt.dll
c:\windows\system32\bcrypt.dll
c:\windows\system32\bcryptprimitives.dll
c:\windows\system32\userenv.dll
c:\windows\system32\profapi.dll
c:\windows\system32\gpapi.dll
c:\windows\system32\cryptnet.dll
c:\windows\system32\wldap32.dll
c:\windows\system32\shlwapi.dll
c:\windows\system32\spfileq.dll

PID
3668
CMD
C:\Windows\system32\msiexec.exe /V
Path
C:\Windows\system32\msiexec.exe
Indicators
Parent process
––
User
SYSTEM
Integrity Level
SYSTEM
Version:
Company
Microsoft Corporation
Description
Windows® installer
Version
5.0.7600.16385 (win7_rtm.090713-1255)
Modules
Image
c:\windows\system32\msiexec.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
c:\windows\system32\ole32.dll
c:\windows\system32\msi.dll
c:\windows\system32\shlwapi.dll
c:\windows\system32\apphelp.dll
c:\windows\apppatch\aclayers.dll
c:\windows\system32\sspicli.dll
c:\windows\system32\shell32.dll
c:\windows\system32\oleaut32.dll
c:\windows\system32\userenv.dll
c:\windows\system32\profapi.dll
c:\windows\system32\winspool.drv
c:\windows\system32\mpr.dll
c:\windows\apppatch\acgenral.dll
c:\windows\system32\uxtheme.dll
c:\windows\system32\winmm.dll
c:\windows\system32\samcli.dll
c:\windows\system32\msacm32.dll
c:\windows\system32\version.dll
c:\windows\system32\sfc.dll
c:\windows\system32\sfc_os.dll
c:\windows\system32\dwmapi.dll
c:\windows\system32\setupapi.dll
c:\windows\system32\cfgmgr32.dll
c:\windows\system32\devobj.dll
c:\windows\system32\urlmon.dll
c:\windows\system32\wininet.dll
c:\windows\system32\iertutil.dll
c:\windows\system32\crypt32.dll
c:\windows\system32\msasn1.dll
c:\windows\system32\imm32.dll
c:\windows\system32\msctf.dll
c:\windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_41e6975e2bd6f2b2\comctl32.dll
c:\windows\system32\cryptbase.dll
c:\windows\system32\clbcatq.dll
c:\windows\system32\cryptsp.dll
c:\windows\system32\rsaenh.dll
c:\windows\system32\rpcrtremote.dll
c:\windows\system32\msimsg.dll
c:\windows\system32\netapi32.dll
c:\windows\system32\netutils.dll
c:\windows\system32\srvcli.dll
c:\windows\system32\wkscli.dll
c:\windows\system32\sxs.dll
c:\windows\system32\mscoree.dll
c:\windows\microsoft.net\framework\v4.0.30319\mscoreei.dll
c:\windows\microsoft.net\framework\v4.0.30319\clr.dll
c:\windows\microsoft.net\framework\v4.0.30319\fusion.dll
c:\windows\system32\rstrtmgr.dll
c:\windows\system32\ncrypt.dll
c:\windows\system32\bcrypt.dll
c:\windows\system32\bcryptprimitives.dll
c:\windows\system32\devrtl.dll

Registry activity

Total events
918
Read events
647
Write events
265
Delete events
6

Modification events

PID
Process
Operation
Key
Name
Value
1140
OldMHUUninstaller.exe
write
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap
UNCAsIntranet
0
1140
OldMHUUninstaller.exe
write
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap
AutoDetect
1
2712
OldMHUUninstaller.exe
write
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\VSS\Diag\SystemRestore
SrCreateRp (Enter)
40000000000000005CD83B831421D501980A0000D00A0000D5070000000000000000000000000000000000000000000000000000000000000000000000000000
2712
OldMHUUninstaller.exe
write
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\VSS\Diag\SPP
SppCreate (Enter)
40000000000000005CD83B831421D501980A0000D00A0000D0070000000000000000000000000000000000000000000000000000000000000000000000000000
2712
OldMHUUninstaller.exe
write
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\SPP
LastIndex
20
2712
OldMHUUninstaller.exe
write
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\VSS\Diag\SPP
SppGatherWriterMetadata (Enter)
4000000000000000F6858A831421D501980A0000D00A0000D3070000000000000000000000000000000000000000000000000000000000000000000000000000
2712
OldMHUUninstaller.exe
write
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\VSS\Diag\VssapiPublisher
IDENTIFY (Enter)
400000000000000050E88C831421D501980A00005C0D0000E803000001000000000000000000000094E80D61B1958442AC2470FB8C661A720000000000000000
2712
OldMHUUninstaller.exe
write
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\VSS\Diag\VssapiPublisher
IDENTIFY (Leave)
40000000000000005C056D841421D501980A00005C0D0000E803000000000000000000000000000094E80D61B1958442AC2470FB8C661A720000000000000000
2712
OldMHUUninstaller.exe
write
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\VSS\Diag\SPP
SppGatherWriterMetadata (Leave)
40000000000000004098548A1421D501980A0000D00A0000D3070000010000000000000000000000000000000000000000000000000000000000000000000000
2712
OldMHUUninstaller.exe
write
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\VSS\Diag\SPP
SppAddInterestingComponents (Enter)
40000000000000004098548A1421D501980A0000D00A0000D4070000000000000000000000000000000000000000000000000000000000000000000000000000
2712
OldMHUUninstaller.exe
write
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\VSS\Diag\SPP
SppAddInterestingComponents (Leave)
400000000000000010AB678A1421D501980A0000D00A0000D4070000010000000000000000000000000000000000000000000000000000000000000000000000
2712
OldMHUUninstaller.exe
write
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\VSS\Diag\VssapiPublisher
PREPAREBACKUP (Enter)
4000000000000000E0BD7A8A1421D501980A0000E80B0000E903000001000000000000000000000094E80D61B1958442AC2470FB8C661A720000000000000000
2712
OldMHUUninstaller.exe
write
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\VSS\Diag\VssapiPublisher
PREPAREBACKUP (Leave)
4000000000000000185A978A1421D501980A0000E80B0000E903000000000000000000000000000094E80D61B1958442AC2470FB8C661A720000000000000000
2712
OldMHUUninstaller.exe
write
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\VSS\Diag\VssapiPublisher
GETSTATE (Enter)
4000000000000000185A978A1421D501980A0000240C0000F903000001000000000000000000000094E80D61B1958442AC2470FB8C661A720000000000000000
2712
OldMHUUninstaller.exe
write
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\VSS\Diag\VssapiPublisher
GETSTATE (Leave)
4000000000000000CC1E9C8A1421D501980A0000240C0000F903000000000000000000000000000094E80D61B1958442AC2470FB8C661A720000000000000000
2712
OldMHUUninstaller.exe
write
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\VSS\Diag\VssapiPublisher
DOSNAPSHOT (Enter)
4000000000000000DA45A38A1421D501980A0000D00A00000A04000001000000000000000000000094E80D61B1958442AC2470FB8C661A720000000000000000
2712
OldMHUUninstaller.exe
write
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\VSS\Diag\VssapiPublisher
DOSNAPSHOT (Leave)
40000000000000005C13948B1421D501980A0000380C00000A04000000000000000000000000000094E80D61B1958442AC2470FB8C661A720000000000000000
2712
OldMHUUninstaller.exe
write
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\VSS\Diag\SPP
SppCreate (Leave)
40000000000000005C13948B1421D501980A0000D00A0000D0070000010000000000000000000000000000000000000000000000000000000000000000000000
2712
OldMHUUninstaller.exe
write
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\VSS\Diag\SystemRestore
SrCreateRp (Leave)
40000000000000005C13948B1421D501980A0000D00A0000D5070000010000000000000000000000000000000000000000000000000000000000000000000000
2712
OldMHUUninstaller.exe
write
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\SystemRestore
FirstRun
0
2712
OldMHUUninstaller.exe
write
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\SystemRestore
LastIndex
20
2712
OldMHUUninstaller.exe
write
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\SystemRestore\Volatile
NestingLevel
0
2712
OldMHUUninstaller.exe
write
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\SystemRestore\Volatile
StartNesting
0000000000000000
2712
OldMHUUninstaller.exe
write
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{72796858-1bf1-4bd0-948c-147f4312470d}
BundleCachePath
C:\ProgramData\Package Cache\{72796858-1bf1-4bd0-948c-147f4312470d}\OldMHUUninstaller.exe
2712
OldMHUUninstaller.exe
write
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{72796858-1bf1-4bd0-948c-147f4312470d}
BundleUpgradeCode
{DEE4513A-020C-4B3E-B0FC-BFD464543E82}
2712
OldMHUUninstaller.exe
write
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{72796858-1bf1-4bd0-948c-147f4312470d}
BundleAddonCode
2712
OldMHUUninstaller.exe
write
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{72796858-1bf1-4bd0-948c-147f4312470d}
BundleDetectCode
2712
OldMHUUninstaller.exe
write
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{72796858-1bf1-4bd0-948c-147f4312470d}
BundlePatchCode
2712
OldMHUUninstaller.exe
write
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{72796858-1bf1-4bd0-948c-147f4312470d}
BundleVersion
3.2.0.0
2712
OldMHUUninstaller.exe
write
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{72796858-1bf1-4bd0-948c-147f4312470d}
VersionMajor
3
2712
OldMHUUninstaller.exe
write
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{72796858-1bf1-4bd0-948c-147f4312470d}
VersionMinor
2
2712
OldMHUUninstaller.exe
write
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{72796858-1bf1-4bd0-948c-147f4312470d}
BundleProviderKey
{72796858-1bf1-4bd0-948c-147f4312470d}
2712
OldMHUUninstaller.exe
write
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{72796858-1bf1-4bd0-948c-147f4312470d}
BundleTag
2712
OldMHUUninstaller.exe
write
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{72796858-1bf1-4bd0-948c-147f4312470d}
EngineVersion
3.11.0.1701
2712
OldMHUUninstaller.exe
write
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{72796858-1bf1-4bd0-948c-147f4312470d}
DisplayIcon
C:\ProgramData\Package Cache\{72796858-1bf1-4bd0-948c-147f4312470d}\OldMHUUninstaller.exe,0
2712
OldMHUUninstaller.exe
write
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{72796858-1bf1-4bd0-948c-147f4312470d}
DisplayName
OldMHUUninstaller
2712
OldMHUUninstaller.exe
write
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{72796858-1bf1-4bd0-948c-147f4312470d}
DisplayVersion
3.2.0.0
2712
OldMHUUninstaller.exe
write
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{72796858-1bf1-4bd0-948c-147f4312470d}
Publisher
Plantronics, Inc.
2712
OldMHUUninstaller.exe
write
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{72796858-1bf1-4bd0-948c-147f4312470d}
NoModify
1
2712
OldMHUUninstaller.exe
write
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{72796858-1bf1-4bd0-948c-147f4312470d}
NoRemove
1
2712
OldMHUUninstaller.exe
write
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{72796858-1bf1-4bd0-948c-147f4312470d}
SystemComponent
1
2712
OldMHUUninstaller.exe
write
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{72796858-1bf1-4bd0-948c-147f4312470d}
QuietUninstallString
"C:\ProgramData\Package Cache\{72796858-1bf1-4bd0-948c-147f4312470d}\OldMHUUninstaller.exe" /uninstall /quiet
2712
OldMHUUninstaller.exe
write
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{72796858-1bf1-4bd0-948c-147f4312470d}
UninstallString
"C:\ProgramData\Package Cache\{72796858-1bf1-4bd0-948c-147f4312470d}\OldMHUUninstaller.exe" /uninstall
2712
OldMHUUninstaller.exe
write
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{72796858-1bf1-4bd0-948c-147f4312470d}
EstimatedSize
32
2712
OldMHUUninstaller.exe
write
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Installer\Dependencies\{72796858-1bf1-4bd0-948c-147f4312470d}
{72796858-1bf1-4bd0-948c-147f4312470d}
2712
OldMHUUninstaller.exe
write
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Installer\Dependencies\{72796858-1bf1-4bd0-948c-147f4312470d}
Version
3.2.0.0
2712
OldMHUUninstaller.exe
write
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Installer\Dependencies\{72796858-1bf1-4bd0-948c-147f4312470d}
DisplayName
OldMHUUninstaller
2712
OldMHUUninstaller.exe
write
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{72796858-1bf1-4bd0-948c-147f4312470d}
Resume
1
2712
OldMHUUninstaller.exe
write
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce
{72796858-1bf1-4bd0-948c-147f4312470d}
"C:\ProgramData\Package Cache\{72796858-1bf1-4bd0-948c-147f4312470d}\OldMHUUninstaller.exe" /burn.runonce
2712
OldMHUUninstaller.exe
write
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{72796858-1bf1-4bd0-948c-147f4312470d}
BundleResumeCommandLine
/burn.log.append "C:\Users\admin\AppData\Local\Temp\OldMHUUninstaller_20190612124637.log"
2712
OldMHUUninstaller.exe
write
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Installer\Dependencies\{4D0A3A86-70AE-4307-828E-089B5C619A10}
{4D0A3A86-70AE-4307-828E-089B5C619A10}
2712
OldMHUUninstaller.exe
write
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Installer\Dependencies\{4D0A3A86-70AE-4307-828E-089B5C619A10}
Version
3.2.0.0
2712
OldMHUUninstaller.exe
write
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Installer\Dependencies\{4D0A3A86-70AE-4307-828E-089B5C619A10}
DisplayName
OldMHUUninstallerMSI
2712
OldMHUUninstaller.exe
write
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{72796858-1bf1-4bd0-948c-147f4312470d}
Resume
3
2712
OldMHUUninstaller.exe
write
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{72796858-1bf1-4bd0-948c-147f4312470d}
Installed
1
3924
vssvc.exe
write
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\VSS\Diag\Shadow Copy Optimization Writer
IDENTIFY (Enter)
4000000000000000B87196831421D501540F00001C0E0000E8030000010000000100000000000000000000000000000000000000000000000000000000000000
3924
vssvc.exe
write
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\VSS\Diag\Registry Writer
IDENTIFY (Enter)
4000000000000000B87196831421D501540F0000E0090000E8030000010000000100000000000000000000000000000000000000000000000000000000000000
3924
vssvc.exe
write
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\VSS\Diag\ASR Writer
IDENTIFY (Enter)
400000000000000012D498831421D501540F0000140E0000E8030000010000000100000000000000000000000000000000000000000000000000000000000000
3924
vssvc.exe
write
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\VSS\Diag\COM+ REGDB Writer
IDENTIFY (Enter)
400000000000000012D498831421D501540F0000DC090000E8030000010000000100000000000000000000000000000000000000000000000000000000000000
3924
vssvc.exe
write
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\VSS\Diag\COM+ REGDB Writer
IDENTIFY (Leave)
40000000000000007A5DA2831421D501540F0000DC090000E8030000000000000100000000000000000000000000000000000000000000000000000000000000
3924
vssvc.exe
write
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\VSS\Diag\Registry Writer
IDENTIFY (Leave)
40000000000000007A5DA2831421D501540F0000E0090000E8030000000000000100000000000000000000000000000000000000000000000000000000000000
3924
vssvc.exe
write
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\VSS\Diag\ASR Writer
IDENTIFY (Leave)
40000000000000002E22A7831421D501540F0000140E0000E8030000000000000100000000000000000000000000000000000000000000000000000000000000
3924
vssvc.exe
write
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\VSS\Diag\Shadow Copy Optimization Writer
IDENTIFY (Leave)
4000000000000000E2E6AB831421D501540F00001C0E0000E8030000000000000100000000000000000000000000000000000000000000000000000000000000
3924
vssvc.exe
write
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\VSS\Diag\SwProvider_{b5946137-7b9f-4925-af80-51abd60b20d5}
PROVIDER_BEGINPREPARE (Enter)
4000000000000000E0BD7A8A1421D501540F00001C0E00000104000001000000000000000000000094E80D61B1958442AC2470FB8C661A720000000000000000
3924
vssvc.exe
write
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\VSS\Diag\SwProvider_{b5946137-7b9f-4925-af80-51abd60b20d5}
PROVIDER_BEGINPREPARE (Leave)
4000000000000000E0BD7A8A1421D501540F00001C0E00000104000000000000000000000000000094E80D61B1958442AC2470FB8C661A720000000000000000
3924
vssvc.exe
write
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\VSS\Diag\Registry Writer
PREPAREBACKUP (Enter)
400000000000000094827F8A1421D501540F0000140E0000E903000001000000010000000000000094E80D61B1958442AC2470FB8C661A720000000000000000
3924
vssvc.exe
write
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\VSS\Diag\Shadow Copy Optimization Writer
PREPAREBACKUP (Enter)
400000000000000094827F8A1421D501540F00001C0E0000E903000001000000010000000000000094E80D61B1958442AC2470FB8C661A720000000000000000
3924
vssvc.exe
write
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\VSS\Diag\COM+ REGDB Writer
PREPAREBACKUP (Enter)
400000000000000094827F8A1421D501540F0000E0090000E903000001000000010000000000000094E80D61B1958442AC2470FB8C661A720000000000000000
3924
vssvc.exe
write
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\VSS\Diag\COM+ REGDB Writer
PREPAREBACKUP (Leave)
40000000000000004847848A1421D501540F0000E0090000E903000000000000010000000000000094E80D61B1958442AC2470FB8C661A720000000000000000
3924
vssvc.exe
write
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\VSS\Diag\COM+ REGDB Writer
VSS_WS_STABLE (SetCurrentState)
40000000000000004847848A1421D501540F0000E00900000100000001000000010000000000000094E80D61B1958442AC2470FB8C661A720000000000000000
3924
vssvc.exe
write
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\VSS\Diag\Shadow Copy Optimization Writer
PREPAREBACKUP (Leave)
40000000000000004847848A1421D501540F00001C0E0000E903000000000000010000000000000094E80D61B1958442AC2470FB8C661A720000000000000000
3924
vssvc.exe
write
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\VSS\Diag\Shadow Copy Optimization Writer
VSS_WS_STABLE (SetCurrentState)
40000000000000004847848A1421D501540F00001C0E00000100000001000000010000000000000094E80D61B1958442AC2470FB8C661A720000000000000000
3924
vssvc.exe
write
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\VSS\Diag\Registry Writer
PREPAREBACKUP (Leave)
40000000000000004847848A1421D501540F0000140E0000E903000000000000010000000000000094E80D61B1958442AC2470FB8C661A720000000000000000
3924
vssvc.exe
write
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\VSS\Diag\Registry Writer
VSS_WS_STABLE (SetCurrentState)
40000000000000004847848A1421D501540F0000140E00000100000001000000010000000000000094E80D61B1958442AC2470FB8C661A720000000000000000
3924
vssvc.exe
write
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\VSS\Diag\COM+ REGDB Writer
GETSTATE (Enter)
4000000000000000CC1E9C8A1421D501540F0000140E0000F903000001000000010000000000000094E80D61B1958442AC2470FB8C661A720000000000000000
3924
vssvc.exe
write
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\VSS\Diag\Shadow Copy Optimization Writer
GETSTATE (Enter)
4000000000000000CC1E9C8A1421D501540F0000E0090000F903000001000000010000000000000094E80D61B1958442AC2470FB8C661A720000000000000000
3924
vssvc.exe
write
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\VSS\Diag\Registry Writer
GETSTATE (Enter)
4000000000000000CC1E9C8A1421D501540F00001C0E0000F903000001000000010000000000000094E80D61B1958442AC2470FB8C661A720000000000000000
3924
vssvc.exe
write
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\VSS\Diag\Registry Writer
GETSTATE (Leave)
4000000000000000CC1E9C8A1421D501540F00001C0E0000F903000000000000010000000000000094E80D61B1958442AC2470FB8C661A720000000000000000
3924
vssvc.exe
write
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\VSS\Diag\Shadow Copy Optimization Writer
GETSTATE (Leave)
4000000000000000CC1E9C8A1421D501540F0000E0090000F903000000000000010000000000000094E80D61B1958442AC2470FB8C661A720000000000000000
3924
vssvc.exe
write
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\VSS\Diag\COM+ REGDB Writer
GETSTATE (Leave)
4000000000000000CC1E9C8A1421D501540F0000140E0000F903000000000000010000000000000094E80D61B1958442AC2470FB8C661A720000000000000000
3924
vssvc.exe
write
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\VSS\Diag\SwProvider_{b5946137-7b9f-4925-af80-51abd60b20d5}
PROVIDER_ENDPREPARE (Enter)
4000000000000000DA45A38A1421D501540F0000340C00000204000001000000000000000000000094E80D61B1958442AC2470FB8C661A720000000000000000
3924
vssvc.exe
write
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\VSS\Diag\SwProvider_{b5946137-7b9f-4925-af80-51abd60b20d5}
PROVIDER_ENDPREPARE (Leave)
40000000000000006E7B1A8B1421D501540F0000340C00000204000000000000000000000000000094E80D61B1958442AC2470FB8C661A720000000000000000
3924
vssvc.exe
write
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\VSS\Diag\VssvcPublisher
PREPARESNAPSHOT (Enter)
4000000000000000C8DD1C8B1421D501540F0000340C0000EA03000001000000000000000000000094E80D61B1958442AC2470FB8C661A720000000000000000
3924
vssvc.exe
write
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\VSS\Diag\COM+ REGDB Writer
PREPARESNAPSHOT (Enter)
4000000000000000D604248B1421D501540F0000980B0000EA03000001000000010000000000000094E80D61B1958442AC2470FB8C661A720000000000000000
3924
vssvc.exe
write
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\VSS\Diag\Registry Writer
PREPARESNAPSHOT (Enter)
4000000000000000D604248B1421D501540F0000C00B0000EA03000001000000010000000000000094E80D61B1958442AC2470FB8C661A720000000000000000
3924
vssvc.exe
write
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\VSS\Diag\Shadow Copy Optimization Writer
PREPARESNAPSHOT (Enter)
4000000000000000D604248B1421D501540F0000B40B0000EA03000001000000010000000000000094E80D61B1958442AC2470FB8C661A720000000000000000
3924
vssvc.exe
write
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\VSS\Diag\Shadow Copy Optimization Writer
PREPARESNAPSHOT (Leave)
40000000000000004CB5348B1421D501540F0000B40B0000EA03000000000000010000000000000094E80D61B1958442AC2470FB8C661A720000000000000000
3924
vssvc.exe
write
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\VSS\Diag\Shadow Copy Optimization Writer
VSS_WS_WAITING_FOR_FREEZE (SetCurrentState)
40000000000000004CB5348B1421D501540F0000B40B00000200000001000000010000000000000094E80D61B1958442AC2470FB8C661A720000000000000000
3924
vssvc.exe
write
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\VSS\Diag\COM+ REGDB Writer
PREPARESNAPSHOT (Leave)
4000000000000000A617378B1421D501540F0000980B0000EA03000000000000010000000000000094E80D61B1958442AC2470FB8C661A720000000000000000
3924
vssvc.exe
write
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\VSS\Diag\COM+ REGDB Writer
VSS_WS_WAITING_FOR_FREEZE (SetCurrentState)
4000000000000000A617378B1421D501540F0000980B00000200000001000000010000000000000094E80D61B1958442AC2470FB8C661A720000000000000000
3924
vssvc.exe
write
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\VSS\Diag\Registry Writer
PREPARESNAPSHOT (Leave)
4000000000000000007A398B1421D501540F0000C00B0000EA03000000000000010000000000000094E80D61B1958442AC2470FB8C661A720000000000000000
3924
vssvc.exe
write
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\VSS\Diag\Registry Writer
VSS_WS_WAITING_FOR_FREEZE (SetCurrentState)
4000000000000000007A398B1421D501540F0000C00B00000200000001000000010000000000000094E80D61B1958442AC2470FB8C661A720000000000000000
3924
vssvc.exe
write
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\VSS\Diag\VssvcPublisher
PREPARESNAPSHOT (Leave)
4000000000000000FA01628B1421D501540F0000340C0000EA03000000000000000000000000000094E80D61B1958442AC2470FB8C661A720000000000000000
3924
vssvc.exe
write
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\VSS\Diag\VssvcPublisher
FREEZE (Enter)
4000000000000000FA01628B1421D501540F0000340C0000EB03000001000000000000000000000094E80D61B1958442AC2470FB8C661A720000000000000000
3924
vssvc.exe
write
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\VSS\Diag\VssvcPublisher
FREEZE_FRONT (Enter)
4000000000000000FA01628B1421D501540F0000340C0000EC03000001000000000000000000000094E80D61B1958442AC2470FB8C661A720000000000000000
3924
vssvc.exe
write
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\VSS\Diag\Shadow Copy Optimization Writer
FREEZE (Enter)
40000000000000005464648B1421D501540F0000C00B0000EB03000001000000020000000000000094E80D61B1958442AC2470FB8C661A720000000000000000
3924
vssvc.exe
write
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\VSS\Diag\Shadow Copy Optimization Writer
FREEZE (Leave)
40000000000000005464648B1421D501540F0000C00B0000EB03000000000000020000000000000094E80D61B1958442AC2470FB8C661A720000000000000000
3924
vssvc.exe
write
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\VSS\Diag\Shadow Copy Optimization Writer
VSS_WS_WAITING_FOR_THAW (SetCurrentState)
40000000000000005464648B1421D501540F0000C00B00000300000001000000020000000000000094E80D61B1958442AC2470FB8C661A720000000000000000
3924
vssvc.exe
write
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\VSS\Diag\Shadow Copy Optimization Writer
BKGND_FREEZE_THREAD (Enter)
40000000000000005464648B1421D501540F0000E80C0000FC03000001000000030000000000000094E80D61B1958442AC2470FB8C661A720000000000000000
3924
vssvc.exe
write
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\VSS\Diag\VssvcPublisher
FREEZE_FRONT (Leave)
4000000000000000AEC6668B1421D501540F0000340C0000EC03000000000000000000000000000094E80D61B1958442AC2470FB8C661A720000000000000000
3924
vssvc.exe
write
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\VSS\Diag\VssvcPublisher
FREEZE_BACK (Enter)
4000000000000000AEC6668B1421D501540F0000340C0000ED03000001000000000000000000000094E80D61B1958442AC2470FB8C661A720000000000000000
3924
vssvc.exe
write
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\VSS\Diag\VssvcPublisher
FREEZE_BACK (Leave)
40000000000000000829698B1421D501540F0000340C0000ED03000000000000000000000000000094E80D61B1958442AC2470FB8C661A720000000000000000
3924
vssvc.exe
write
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\VSS\Diag\VssvcPublisher
FREEZE_SYSTEM (Enter)
40000000000000000829698B1421D501540F0000340C0000EE03000001000000000000000000000094E80D61B1958442AC2470FB8C661A720000000000000000
3924
vssvc.exe
write
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\VSS\Diag\COM+ REGDB Writer
FREEZE (Enter)
4000000000000000628B6B8B1421D501540F0000A40B0000EB03000001000000020000000000000094E80D61B1958442AC2470FB8C661A720000000000000000
3924
vssvc.exe
write
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\VSS\Diag\COM+ REGDB Writer
FREEZE (Leave)
4000000000000000628B6B8B1421D501540F0000A40B0000EB03000000000000020000000000000094E80D61B1958442AC2470FB8C661A720000000000000000
3924
vssvc.exe
write
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\VSS\Diag\COM+ REGDB Writer
VSS_WS_WAITING_FOR_THAW (SetCurrentState)
4000000000000000628B6B8B1421D501540F0000A40B00000300000001000000020000000000000094E80D61B1958442AC2470FB8C661A720000000000000000
3924
vssvc.exe
write
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\VSS\Diag\COM+ REGDB Writer
BKGND_FREEZE_THREAD (Enter)
4000000000000000628B6B8B1421D501540F0000F80C0000FC03000001000000030000000000000094E80D61B1958442AC2470FB8C661A720000000000000000
3924
vssvc.exe
write
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\VSS\Diag\VssvcPublisher
FREEZE_SYSTEM (Leave)
40000000000000001650708B1421D501540F0000340C0000EE03000000000000000000000000000094E80D61B1958442AC2470FB8C661A720000000000000000
3924
vssvc.exe
write
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\VSS\Diag\VssvcPublisher
FREEZE_KTM (Enter)
40000000000000001650708B1421D501540F0000340C0000F003000001000000000000000000000094E80D61B1958442AC2470FB8C661A720000000000000000
3924
vssvc.exe
write
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\VSS\Diag\VssvcPublisher
FREEZE_KTM (Leave)
40000000000000001650708B1421D501540F0000340C0000F003000000000000000000000000000094E80D61B1958442AC2470FB8C661A720000000000000000
3924
vssvc.exe
write
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\VSS\Diag\VssvcPublisher
FREEZE_RM (Enter)
40000000000000001650708B1421D501540F0000340C0000EF03000001000000000000000000000094E80D61B1958442AC2470FB8C661A720000000000000000
3924
vssvc.exe
write
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\VSS\Diag\Registry Writer
FREEZE (Enter)
400000000000000070B2728B1421D501540F0000A40B0000EB03000001000000020000000000000094E80D61B1958442AC2470FB8C661A720000000000000000
3924
vssvc.exe
write
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\VSS\Diag\Registry Writer
FREEZE (Leave)
40000000000000007ED9798B1421D501540F0000A40B0000EB03000000000000020000000000000094E80D61B1958442AC2470FB8C661A720000000000000000
3924
vssvc.exe
write
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\VSS\Diag\Registry Writer
VSS_WS_WAITING_FOR_THAW (SetCurrentState)
40000000000000007ED9798B1421D501540F0000A40B00000300000001000000020000000000000094E80D61B1958442AC2470FB8C661A720000000000000000
3924
vssvc.exe
write
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\VSS\Diag\Registry Writer
BKGND_FREEZE_THREAD (Enter)
40000000000000007ED9798B1421D501540F0000A80E0000FC03000001000000030000000000000094E80D61B1958442AC2470FB8C661A720000000000000000
3924
vssvc.exe
write
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\VSS\Diag\VssvcPublisher
FREEZE_RM (Leave)
40000000000000007ED9798B1421D501540F0000340C0000EF03000000000000000000000000000094E80D61B1958442AC2470FB8C661A720000000000000000
3924
vssvc.exe
write
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\VSS\Diag\VssvcPublisher
FREEZE (Leave)
40000000000000007ED9798B1421D501540F0000340C0000EB03000000000000000000000000000094E80D61B1958442AC2470FB8C661A720000000000000000
3924
vssvc.exe
write
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\VSS\Diag\SwProvider_{b5946137-7b9f-4925-af80-51abd60b20d5}
PROVIDER_PRECOMMIT (Enter)
40000000000000007ED9798B1421D501540F0000340C00000304000001000000000000000000000094E80D61B1958442AC2470FB8C661A720000000000000000
3924
vssvc.exe
write
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\VSS\Diag\SwProvider_{b5946137-7b9f-4925-af80-51abd60b20d5}
PROVIDER_PRECOMMIT (Leave)
40000000000000007ED9798B1421D501540F0000340C00000304000000000000000000000000000094E80D61B1958442AC2470FB8C661A720000000000000000
3924
vssvc.exe
write
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\VSS\Diag\Lovelace
OPEN_VOLUME_HANDLE (Enter)
40000000000000007ED9798B1421D501540F0000340C0000FD03000001000000000000000000000094E80D61B1958442AC2470FB8C661A720000000000000000
3924
vssvc.exe
write
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\VSS\Diag\Lovelace(__?_Volume{e1a82db4-a9f0-11e7-b142-806e6f6e6963}_)
OPEN_VOLUME_HANDLE (Enter)
40000000000000007ED9798B1421D501540F0000940E0000FD03000001000000000000000000000094E80D61B1958442AC2470FB8C661A720000000000000000
3924
vssvc.exe
write
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\VSS\Diag\Lovelace(__?_Volume{e1a82db4-a9f0-11e7-b142-806e6f6e6963}_)
OPEN_VOLUME_HANDLE (Leave)
400000000000000040C5858B1421D501540F0000940E0000FD03000000000000000000000000000094E80D61B1958442AC2470FB8C661A720000000000000000
3924
vssvc.exe
write
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\VSS\Diag\Lovelace
OPEN_VOLUME_HANDLE (Leave)
40000000000000009A27888B1421D501540F0000340C0000FD03000000000000000000000000000094E80D61B1958442AC2470FB8C661A720000000000000000
3924
vssvc.exe
write
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\VSS\Diag\Lovelace(__?_Volume{e1a82db4-a9f0-11e7-b142-806e6f6e6963}_)
IOCTL_FLUSH_AND_HOLD (Enter)
40000000000000009A27888B1421D501540F0000940E0000FE03000001000000000000000000000094E80D61B1958442AC2470FB8C661A720000000000000000
3924
vssvc.exe
write
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\VSS\Diag\Lovelace(__?_Volume{e1a82db4-a9f0-11e7-b142-806e6f6e6963}_)
IOCTL_FLUSH_AND_HOLD (Leave)
40000000000000004EEC8C8B1421D501540F0000940E0000FE03000000000000000000000000000094E80D61B1958442AC2470FB8C661A720000000000000000
3924
vssvc.exe
write
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\VSS\Diag\Lovelace(__?_Volume{e1a82db4-a9f0-11e7-b142-806e6f6e6963}_)
IOCTL_RELEASE (Enter)
40000000000000004EEC8C8B1421D501540F0000940E0000FF03000001000000000000000000000094E80D61B1958442AC2470FB8C661A720000000000000000
3924
vssvc.exe
write
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\VSS\Diag\Lovelace(__?_Volume{e1a82db4-a9f0-11e7-b142-806e6f6e6963}_)
IOCTL_RELEASE (Leave)
40000000000000004EEC8C8B1421D501540F0000940E0000FF03000000000000000000000000000094E80D61B1958442AC2470FB8C661A720000000000000000
3924
vssvc.exe
write
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\VSS\Diag\Lovelace
IOCTL_FLUSH_AND_HOLD (Enter)
40000000000000009A27888B1421D501540F0000340C0000FE03000001000000000000000000000094E80D61B1958442AC2470FB8C661A720000000000000000
3924
vssvc.exe
write
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\VSS\Diag\Lovelace
IOCTL_FLUSH_AND_HOLD (Leave)
40000000000000004EEC8C8B1421D501540F0000340C0000FE03000000000000000000000000000094E80D61B1958442AC2470FB8C661A720000000000000000
3924
vssvc.exe
write
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\VSS\Diag\Lovelace
IOCTL_RELEASE (Enter)
40000000000000004EEC8C8B1421D501540F0000340C0000FF030000010000000000000000000000000000000000000000000000000000000000000000000000
3924
vssvc.exe
write
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\VSS\Diag\Lovelace
IOCTL_RELEASE (Leave)
40000000000000004EEC8C8B1421D501540F0000340C0000FF030000000000000000000000000000000000000000000000000000000000000000000000000000
3924
vssvc.exe
write
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\VSS\Diag\SwProvider_{b5946137-7b9f-4925-af80-51abd60b20d5}
PROVIDER_COMMIT (Enter)
40000000000000004EEC8C8B1421D501540F0000A00E00000404000001000000000000000000000094E80D61B1958442AC2470FB8C661A720000000000000000
3924
vssvc.exe
write
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\VSS\Diag\SwProvider_{b5946137-7b9f-4925-af80-51abd60b20d5}
PROVIDER_COMMIT (Leave)
40000000000000004EEC8C8B1421D501540F0000A00E00000404000000000000000000000000000094E80D61B1958442AC2470FB8C661A720000000000000000
3924
vssvc.exe
write
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\VSS\Diag\SwProvider_{b5946137-7b9f-4925-af80-51abd60b20d5}
PROVIDER_POSTCOMMIT (Enter)
40000000000000004EEC8C8B1421D501540F0000340C00000504000001000000000000000000000094E80D61B1958442AC2470FB8C661A720000000000000000
3924
vssvc.exe
write
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\VSS\Diag\SwProvider_{b5946137-7b9f-4925-af80-51abd60b20d5}
PROVIDER_POSTCOMMIT (Leave)
40000000000000005C13948B1421D501540F0000340C00000504000000000000000000000000000094E80D61B1958442AC2470FB8C661A720000000000000000
3924
vssvc.exe
write
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\VSS\Diag\VssvcPublisher
THAW_KTM (Enter)
40000000000000005C13948B1421D501540F0000340C0000F403000001000000000000000000000094E80D61B1958442AC2470FB8C661A720000000000000000
3924
vssvc.exe
write
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\VSS\Diag\VssvcPublisher
THAW_KTM (Leave)
40000000000000005C13948B1421D501540F0000340C0000F403000000000000000000000000000094E80D61B1958442AC2470FB8C661A720000000000000000
3924
vssvc.exe
write
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\VSS\Diag\VssvcPublisher
THAW (Enter)
40000000000000005C13948B1421D501540F0000340C0000F203000001000000000000000000000094E80D61B1958442AC2470FB8C661A720000000000000000
3924
vssvc.exe
write
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\VSS\Diag\COM+ REGDB Writer
THAW (Enter)
400000000000000010D8988B1421D501540F0000BC0B0000F203000001000000030000000000000094E80D61B1958442AC2470FB8C661A720000000000000000
3924
vssvc.exe
write
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\VSS\Diag\Registry Writer
THAW (Enter)
400000000000000010D8988B1421D501540F0000A40B0000F203000001000000030000000000000094E80D61B1958442AC2470FB8C661A720000000000000000
3924
vssvc.exe
write
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\VSS\Diag\Shadow Copy Optimization Writer
THAW (Enter)
400000000000000010D8988B1421D501540F0000980B0000F203000001000000030000000000000094E80D61B1958442AC2470FB8C661A720000000000000000
3924
vssvc.exe
write
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\VSS\Diag\COM+ REGDB Writer
BKGND_FREEZE_THREAD (Leave)
400000000000000010D8988B1421D501540F0000F80C0000FC03000000000000030000000000000094E80D61B1958442AC2470FB8C661A720000000000000000
3924
vssvc.exe
write
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\VSS\Diag\Registry Writer
BKGND_FREEZE_THREAD (Leave)
400000000000000010D8988B1421D501540F0000A80E0000FC03000000000000030000000000000094E80D61B1958442AC2470FB8C661A720000000000000000
3924
vssvc.exe
write
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\VSS\Diag\Shadow Copy Optimization Writer
BKGND_FREEZE_THREAD (Leave)
400000000000000010D8988B1421D501540F0000E80C0000FC03000000000000030000000000000094E80D61B1958442AC2470FB8C661A720000000000000000
3924
vssvc.exe
write
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\VSS\Diag\COM+ REGDB Writer
THAW (Leave)
400000000000000010D8988B1421D501540F0000BC0B0000F203000000000000030000000000000094E80D61B1958442AC2470FB8C661A720000000000000000
3924
vssvc.exe
write
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\VSS\Diag\COM+ REGDB Writer
VSS_WS_WAITING_FOR_POST_SNAPSHOT (SetCurrentState)
400000000000000010D8988B1421D501540F0000BC0B00000400000001000000030000000000000094E80D61B1958442AC2470FB8C661A720000000000000000
3924
vssvc.exe
write
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\VSS\Diag\Shadow Copy Optimization Writer
THAW (Leave)
400000000000000010D8988B1421D501540F0000980B0000F203000000000000030000000000000094E80D61B1958442AC2470FB8C661A720000000000000000
3924
vssvc.exe
write
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\VSS\Diag\Registry Writer
THAW (Leave)
400000000000000010D8988B1421D501540F0000A40B0000F203000000000000030000000000000094E80D61B1958442AC2470FB8C661A720000000000000000
3924
vssvc.exe
write
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\VSS\Diag\Shadow Copy Optimization Writer
VSS_WS_WAITING_FOR_POST_SNAPSHOT (SetCurrentState)
400000000000000010D8988B1421D501540F0000980B00000400000001000000030000000000000094E80D61B1958442AC2470FB8C661A720000000000000000
3924
vssvc.exe
write
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\VSS\Diag\Registry Writer
VSS_WS_WAITING_FOR_POST_SNAPSHOT (SetCurrentState)
400000000000000010D8988B1421D501540F0000A40B00000400000001000000030000000000000094E80D61B1958442AC2470FB8C661A720000000000000000
3924
vssvc.exe
write
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\VSS\Diag\VssvcPublisher
THAW (Leave)
400000000000000010D8988B1421D501540F0000340C0000F203000000000000000000000000000094E80D61B1958442AC2470FB8C661A720000000000000000
3924
vssvc.exe
write
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\VSS\Diag\SwProvider_{b5946137-7b9f-4925-af80-51abd60b20d5}
PROVIDER_PREFINALCOMMIT (Enter)
400000000000000010D8988B1421D501540F0000340C00000604000001000000000000000000000094E80D61B1958442AC2470FB8C661A720000000000000000
3924
vssvc.exe
write
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\VSS\Diag\SwProvider_{b5946137-7b9f-4925-af80-51abd60b20d5}
PROVIDER_PREFINALCOMMIT (Leave)
400000000000000034D5D68B1421D501540F0000340C00000604000000000000000000000000000094E80D61B1958442AC2470FB8C661A720000000000000000
3924
vssvc.exe
write
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\VSS\Diag\VssvcPublisher
POSTSNAPSHOT (Enter)
400000000000000034D5D68B1421D501540F0000340C0000F503000001000000000000000000000094E80D61B1958442AC2470FB8C661A720000000000000000
3924
vssvc.exe
write
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\VSS\Diag\Registry Writer
POSTSNAPSHOT (Enter)
4000000000000000B8ACEE8B1421D501540F0000A40B0000F503000001000000040000000000000094E80D61B1958442AC2470FB8C661A720000000000000000
3924
vssvc.exe
write
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\VSS\Diag\COM+ REGDB Writer
POSTSNAPSHOT (Enter)
4000000000000000B8ACEE8B1421D501540F0000B40B0000F503000001000000040000000000000094E80D61B1958442AC2470FB8C661A720000000000000000
3924
vssvc.exe
write
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\VSS\Diag\Shadow Copy Optimization Writer
POSTSNAPSHOT (Enter)
4000000000000000B8ACEE8B1421D501540F0000980B0000F503000001000000040000000000000094E80D61B1958442AC2470FB8C661A720000000000000000
3924
vssvc.exe
write
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\VSS\Diag\Registry Writer
POSTSNAPSHOT (Leave)
4000000000000000120FF18B1421D501540F0000A40B0000F503000000000000040000000000000094E80D61B1958442AC2470FB8C661A720000000000000000
3924
vssvc.exe
write
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\VSS\Diag\Registry Writer
VSS_WS_WAITING_FOR_BACKUP_COMPLETE (SetCurrentState)
4000000000000000120FF18B1421D501540F0000A40B00000500000001000000040000000000000094E80D61B1958442AC2470FB8C661A720000000000000000
3924
vssvc.exe
write
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\VSS\Diag\COM+ REGDB Writer
POSTSNAPSHOT (Leave)
4000000000000000120FF18B1421D501540F0000B40B0000F503000000000000040000000000000094E80D61B1958442AC2470FB8C661A720000000000000000
3924
vssvc.exe
write
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\VSS\Diag\COM+ REGDB Writer
VSS_WS_WAITING_FOR_BACKUP_COMPLETE (SetCurrentState)
4000000000000000120FF18B1421D501540F0000B40B00000500000001000000040000000000000094E80D61B1958442AC2470FB8C661A720000000000000000
3924
vssvc.exe
write
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\VSS\Diag\Shadow Copy Optimization Writer
POSTSNAPSHOT (Leave)
40000000000000005491958C1421D501540F0000980B0000F503000000000000040000000000000094E80D61B1958442AC2470FB8C661A720000000000000000
3924
vssvc.exe
write
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\VSS\Diag\Shadow Copy Optimization Writer
VSS_WS_WAITING_FOR_BACKUP_COMPLETE (SetCurrentState)
40000000000000005491958C1421D501540F0000980B00000500000001000000040000000000000094E80D61B1958442AC2470FB8C661A720000000000000000
3924
vssvc.exe
write
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\VSS\Diag\VssvcPublisher
POSTSNAPSHOT (Leave)
40000000000000005491958C1421D501540F0000340C0000F503000000000000000000000000000094E80D61B1958442AC2470FB8C661A720000000000000000
3924
vssvc.exe
write
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\VSS\Diag\SwProvider_{b5946137-7b9f-4925-af80-51abd60b20d5}
PROVIDER_POSTFINALCOMMIT (Enter)
40000000000000005491958C1421D501540F0000340C00000704000001000000000000000000000094E80D61B1958442AC2470FB8C661A720000000000000000
3924
vssvc.exe
write
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\VSS\Diag\SwProvider_{b5946137-7b9f-4925-af80-51abd60b20d5}
PROVIDER_POSTFINALCOMMIT (Leave)
40000000000000007E06AB8C1421D501540F0000340C00000704000000000000000000000000000094E80D61B1958442AC2470FB8C661A720000000000000000
3924
vssvc.exe
write
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\VSS\Diag\VssvcPublisher
BACKUPSHUTDOWN (Enter)
40000000000000009A54B98C1421D501540F0000340C0000FB03000001000000000000000000000094E80D61B1958442AC2470FB8C661A720000000000000000
3924
vssvc.exe
write
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\VSS\Diag\COM+ REGDB Writer
BACKUPSHUTDOWN (Enter)
4000000000000000F4B6BB8C1421D501540F0000BC0B0000FB03000001000000050000000000000094E80D61B1958442AC2470FB8C661A720000000000000000
3924
vssvc.exe
write
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\VSS\Diag\Registry Writer
BACKUPSHUTDOWN (Enter)
4000000000000000F4B6BB8C1421D501540F0000C00B0000FB03000001000000050000000000000094E80D61B1958442AC2470FB8C661A720000000000000000
3924
vssvc.exe
write
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\VSS\Diag\COM+ REGDB Writer
BACKUPSHUTDOWN (Leave)
4000000000000000F4B6BB8C1421D501540F0000BC0B0000FB03000000000000050000000000000094E80D61B1958442AC2470FB8C661A720000000000000000
3924
vssvc.exe
write
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\VSS\Diag\Registry Writer
BACKUPSHUTDOWN (Leave)
4000000000000000F4B6BB8C1421D501540F0000C00B0000FB03000000000000050000000000000094E80D61B1958442AC2470FB8C661A720000000000000000
3924
vssvc.exe
write
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\VSS\Diag\Shadow Copy Optimization Writer
BACKUPSHUTDOWN (Enter)
4000000000000000F4B6BB8C1421D501540F0000A40B0000FB03000001000000050000000000000094E80D61B1958442AC2470FB8C661A720000000000000000
3924
vssvc.exe
write
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\VSS\Diag\Shadow Copy Optimization Writer
BACKUPSHUTDOWN (Leave)
4000000000000000F4B6BB8C1421D501540F0000A40B0000FB03000000000000050000000000000094E80D61B1958442AC2470FB8C661A720000000000000000
3924
vssvc.exe
write
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\VSS\Diag\VssvcPublisher
BACKUPSHUTDOWN (Leave)
40000000000000004E19BE8C1421D501540F0000340C0000FB03000000000000000000000000000094E80D61B1958442AC2470FB8C661A720000000000000000
3172
DrvInst.exe
write
HKEY_USERS\.DEFAULT\Software\Classes\Local Settings\MuiCache\62\52C64B7E
LanguageList
en-US
3172
DrvInst.exe
write
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\91C6D6EE3E8AC86384E548C299295C756C817B81
Blob
0F000000010000001400000085FEF11B4F47FE3952F98301C9F98976FEFEE0CE09000000010000002A000000302806082B0601050507030106082B0601050507030206082B0601050507030406082B0601050507030353000000010000002500000030233021060B6086480186F8450107300130123010060A2B0601040182373C0101030200C01400000001000000140000007B5B45CFAFCECB7AFD31921A6AB6F346EB5748501D00000001000000100000005B3B67000EEB80022E42605B6B3B72400B000000010000000E000000740068006100770074006500000003000000010000001400000091C6D6EE3E8AC86384E548C299295C756C817B812000000001000000240400003082042030820308A0030201020210344ED55720D5EDEC49F42FCE37DB2B6D300D06092A864886F70D01010505003081A9310B300906035504061302555331153013060355040A130C7468617774652C20496E632E31283026060355040B131F43657274696669636174696F6E205365727669636573204469766973696F6E31383036060355040B132F2863292032303036207468617774652C20496E632E202D20466F7220617574686F72697A656420757365206F6E6C79311F301D06035504031316746861777465205072696D61727920526F6F74204341301E170D3036313131373030303030305A170D3336303731363233353935395A3081A9310B300906035504061302555331153013060355040A130C7468617774652C20496E632E31283026060355040B131F43657274696669636174696F6E205365727669636573204469766973696F6E31383036060355040B132F2863292032303036207468617774652C20496E632E202D20466F7220617574686F72697A656420757365206F6E6C79311F301D06035504031316746861777465205072696D61727920526F6F7420434130820122300D06092A864886F70D01010105000382010F003082010A0282010100ACA0F0FB8059D49CC7A4CF9DA159730910450C0D2C6E68F16C5B4868495937FC0B3319C2777FCC102D95341CE6EB4D09A71CD2B8C9973602B789D4245F06C0CC4494948D02626FEB5ADD118D289A5C8490107A0DBD74662F6A38A0E2D55444EB1D079F07BA6FEEE9FD4E0B29F53E84A001F19CABF81C7E89A4E8A1D871650DA3517BEEBCD222600DB95B9DDFBAFC515B0BAF98B2E92EE904E86287DE2BC8D74EC14C641EDDCF8758BA4A4FCA68071D1C9D4AC6D52F91CC7C71721CC5C067EB32FDC9925C94DA85C09BBF537D2B09F48C9D911F976A52CBDE0936A477D87B875044D53E6E2969FB3949261E09A5807B402DEBE82785C9FE61FD7EE67C971DD59D0203010001A3423040300F0603551D130101FF040530030101FF300E0603551D0F0101FF040403020106301D0603551D0E041604147B5B45CFAFCECB7AFD31921A6AB6F346EB574850300D06092A864886F70D010105050003820101007911C04BB391B6FCF0E967D40D6E45BE55E893D2CE033FEDDA25B01D57CB1E3A76A04CEC5076E864720CA4A9F1B88BD6D68784BB32E54111C077D9B3609DEB1BD5D16E4444A9A601EC55621D77B85C8E48497C9C3B5711ACAD73378E2F785C906847D96060E6FC073D222017C4F716E9C4D872F9C8737CDF162F15A93EFD6A27B6A1EB5ABA981FD5E34D640A9D13C861BAF5391C87BAB8BD7B227FF6FEAC4079E5AC106F3D8F1B79768BC437B3211884E53600EB632099B9E9FE3304BB41C8C102F94463209E81CE42D3D63F2C76D3639C59DD8FA6E10EA02E41F72E9547CFBCFD33F3F60B617E7E912B8147C22730EEA7105D378F5C392BE404F07B8D568C68
3172
DrvInst.exe
write
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\91C6D6EE3E8AC86384E548C299295C756C817B81
Blob
190000000100000010000000DC73F9B71E16D51D26527D32B11A6A3D03000000010000001400000091C6D6EE3E8AC86384E548C299295C756C817B810B000000010000000E00000074006800610077007400650000001D00000001000000100000005B3B67000EEB80022E42605B6B3B72401400000001000000140000007B5B45CFAFCECB7AFD31921A6AB6F346EB57485053000000010000002500000030233021060B6086480186F8450107300130123010060A2B0601040182373C0101030200C009000000010000002A000000302806082B0601050507030106082B0601050507030206082B0601050507030406082B060105050703030F000000010000001400000085FEF11B4F47FE3952F98301C9F98976FEFEE0CE2000000001000000240400003082042030820308A0030201020210344ED55720D5EDEC49F42FCE37DB2B6D300D06092A864886F70D01010505003081A9310B300906035504061302555331153013060355040A130C7468617774652C20496E632E31283026060355040B131F43657274696669636174696F6E205365727669636573204469766973696F6E31383036060355040B132F2863292032303036207468617774652C20496E632E202D20466F7220617574686F72697A656420757365206F6E6C79311F301D06035504031316746861777465205072696D61727920526F6F74204341301E170D3036313131373030303030305A170D3336303731363233353935395A3081A9310B300906035504061302555331153013060355040A130C7468617774652C20496E632E31283026060355040B131F43657274696669636174696F6E205365727669636573204469766973696F6E31383036060355040B132F2863292032303036207468617774652C20496E632E202D20466F7220617574686F72697A656420757365206F6E6C79311F301D06035504031316746861777465205072696D61727920526F6F7420434130820122300D06092A864886F70D01010105000382010F003082010A0282010100ACA0F0FB8059D49CC7A4CF9DA159730910450C0D2C6E68F16C5B4868495937FC0B3319C2777FCC102D95341CE6EB4D09A71CD2B8C9973602B789D4245F06C0CC4494948D02626FEB5ADD118D289A5C8490107A0DBD74662F6A38A0E2D55444EB1D079F07BA6FEEE9FD4E0B29F53E84A001F19CABF81C7E89A4E8A1D871650DA3517BEEBCD222600DB95B9DDFBAFC515B0BAF98B2E92EE904E86287DE2BC8D74EC14C641EDDCF8758BA4A4FCA68071D1C9D4AC6D52F91CC7C71721CC5C067EB32FDC9925C94DA85C09BBF537D2B09F48C9D911F976A52CBDE0936A477D87B875044D53E6E2969FB3949261E09A5807B402DEBE82785C9FE61FD7EE67C971DD59D0203010001A3423040300F0603551D130101FF040530030101FF300E0603551D0F0101FF040403020106301D0603551D0E041604147B5B45CFAFCECB7AFD31921A6AB6F346EB574850300D06092A864886F70D010105050003820101007911C04BB391B6FCF0E967D40D6E45BE55E893D2CE033FEDDA25B01D57CB1E3A76A04CEC5076E864720CA4A9F1B88BD6D68784BB32E54111C077D9B3609DEB1BD5D16E4444A9A601EC55621D77B85C8E48497C9C3B5711ACAD73378E2F785C906847D96060E6FC073D222017C4F716E9C4D872F9C8737CDF162F15A93EFD6A27B6A1EB5ABA981FD5E34D640A9D13C861BAF5391C87BAB8BD7B227FF6FEAC4079E5AC106F3D8F1B79768BC437B3211884E53600EB632099B9E9FE3304BB41C8C102F94463209E81CE42D3D63F2C76D3639C59DD8FA6E10EA02E41F72E9547CFBCFD33F3F60B617E7E912B8147C22730EEA7105D378F5C392BE404F07B8D568C68
3668
msiexec.exe
delete key
HKEY_USERS\.DEFAULT\Software\Classes\Local Settings\MuiCache\62\52C64B7E
3668
msiexec.exe
delete key
HKEY_USERS\.DEFAULT\Software\Classes\Local Settings\MuiCache\62
3668
msiexec.exe
delete key
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\Rollback\Scripts
3668
msiexec.exe
delete key
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\Rollback
3668
msiexec.exe
delete key
HKEY_USERS\S-1-5-21-1302019708-1500728564-335382590-1000\Software\Microsoft\RestartManager\Session0000
3668
msiexec.exe
delete key
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\InProgress
3668
msiexec.exe
write
HKEY_USERS\S-1-5-21-1302019708-1500728564-335382590-1000\Software\Microsoft\RestartManager\Session0000
Owner
540E0000569BBC8B1421D501
3668
msiexec.exe
write
HKEY_USERS\S-1-5-21-1302019708-1500728564-335382590-1000\Software\Microsoft\RestartManager\Session0000
SessionHash
B5AF76A718F420AAF19EDD1FC8B102CCDA3B8DBB6426CF64A4CFDA51E322289A
3668
msiexec.exe
write
HKEY_USERS\S-1-5-21-1302019708-1500728564-335382590-1000\Software\Microsoft\RestartManager\Session0000
Sequence
1
3668
msiexec.exe
write
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\InProgress
C:\Windows\Installer\1547d2.ipi
3668
msiexec.exe
write
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\Folders
C:\Config.Msi\
3668
msiexec.exe
write
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\Rollback\Scripts
C:\Config.Msi\1547d3.rbs
30744860
3668
msiexec.exe
write
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\Rollback\Scripts
C:\Config.Msi\1547d3.rbsLow
3996991440
3668
msiexec.exe
write
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\43B549F8F7CCEE351AB76515C294BFF0
68A3A0D4EA07703428E880B9C516A901
02:\SOFTWARE\Plantronics\MHUUninstaller
3668
msiexec.exe
write
HKEY_LOCAL_MACHINE\SOFTWARE\Plantronics
MHUUninstaller
1
3668
msiexec.exe
write
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Products\68A3A0D4EA07703428E880B9C516A901\InstallProperties
LocalPackage
C:\Windows\Installer\1547d4.msi
3668
msiexec.exe
write
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Products\68A3A0D4EA07703428E880B9C516A901\InstallProperties
AuthorizedCDFPrefix
3668
msiexec.exe
write
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Products\68A3A0D4EA07703428E880B9C516A901\InstallProperties
Comments
3668
msiexec.exe
write
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Products\68A3A0D4EA07703428E880B9C516A901\InstallProperties
Contact
3668
msiexec.exe
write
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Products\68A3A0D4EA07703428E880B9C516A901\InstallProperties
DisplayVersion
3.2.0.0
3668
msiexec.exe
write
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Products\68A3A0D4EA07703428E880B9C516A901\InstallProperties
HelpLink
3668
msiexec.exe
write
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Products\68A3A0D4EA07703428E880B9C516A901\InstallProperties
HelpTelephone
3668
msiexec.exe
write
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Products\68A3A0D4EA07703428E880B9C516A901\InstallProperties
InstallDate
20190612
3668
msiexec.exe
write
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Products\68A3A0D4EA07703428E880B9C516A901\InstallProperties
InstallLocation
3668
msiexec.exe
write
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Products\68A3A0D4EA07703428E880B9C516A901\InstallProperties
InstallSource
C:\ProgramData\Package Cache\{4D0A3A86-70AE-4307-828E-089B5C619A10}v3.2.0.0\
3668
msiexec.exe
write
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Products\68A3A0D4EA07703428E880B9C516A901\InstallProperties
ModifyPath
MsiExec.exe /I{4D0A3A86-70AE-4307-828E-089B5C619A10}
3668
msiexec.exe
write
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Products\68A3A0D4EA07703428E880B9C516A901\InstallProperties
Publisher
Plantronics, Inc.
3668
msiexec.exe
write
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Products\68A3A0D4EA07703428E880B9C516A901\InstallProperties
Readme
3668
msiexec.exe
write
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Products\68A3A0D4EA07703428E880B9C516A901\InstallProperties
Size
3668
msiexec.exe
write
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Products\68A3A0D4EA07703428E880B9C516A901\InstallProperties
EstimatedSize
32
3668
msiexec.exe
write
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Products\68A3A0D4EA07703428E880B9C516A901\InstallProperties
SystemComponent
1
3668
msiexec.exe
write
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Products\68A3A0D4EA07703428E880B9C516A901\InstallProperties
UninstallString
MsiExec.exe /I{4D0A3A86-70AE-4307-828E-089B5C619A10}
3668
msiexec.exe
write
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Products\68A3A0D4EA07703428E880B9C516A901\InstallProperties
URLInfoAbout
3668
msiexec.exe
write
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Products\68A3A0D4EA07703428E880B9C516A901\InstallProperties
URLUpdateInfo
3668
msiexec.exe
write
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Products\68A3A0D4EA07703428E880B9C516A901\InstallProperties
VersionMajor
3
3668
msiexec.exe
write
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Products\68A3A0D4EA07703428E880B9C516A901\InstallProperties
VersionMinor
2
3668
msiexec.exe
write
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Products\68A3A0D4EA07703428E880B9C516A901\InstallProperties
WindowsInstaller
1
3668
msiexec.exe
write
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Products\68A3A0D4EA07703428E880B9C516A901\InstallProperties
Version
50462720
3668
msiexec.exe
write
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Products\68A3A0D4EA07703428E880B9C516A901\InstallProperties
Language
1033
3668
msiexec.exe
write
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{4D0A3A86-70AE-4307-828E-089B5C619A10}
AuthorizedCDFPrefix
3668
msiexec.exe
write
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{4D0A3A86-70AE-4307-828E-089B5C619A10}
Comments
3668
msiexec.exe
write
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{4D0A3A86-70AE-4307-828E-089B5C619A10}
Contact
3668
msiexec.exe
write
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{4D0A3A86-70AE-4307-828E-089B5C619A10}
DisplayVersion
3.2.0.0
3668
msiexec.exe
write
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{4D0A3A86-70AE-4307-828E-089B5C619A10}
HelpLink
3668
msiexec.exe
write
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{4D0A3A86-70AE-4307-828E-089B5C619A10}
HelpTelephone
3668
msiexec.exe
write
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{4D0A3A86-70AE-4307-828E-089B5C619A10}
InstallDate
20190612
3668
msiexec.exe
write
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{4D0A3A86-70AE-4307-828E-089B5C619A10}
InstallLocation
3668
msiexec.exe
write
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{4D0A3A86-70AE-4307-828E-089B5C619A10}
InstallSource
C:\ProgramData\Package Cache\{4D0A3A86-70AE-4307-828E-089B5C619A10}v3.2.0.0\
3668
msiexec.exe
write
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{4D0A3A86-70AE-4307-828E-089B5C619A10}
ModifyPath
MsiExec.exe /I{4D0A3A86-70AE-4307-828E-089B5C619A10}
3668
msiexec.exe
write
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{4D0A3A86-70AE-4307-828E-089B5C619A10}
Publisher
Plantronics, Inc.
3668
msiexec.exe
write
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{4D0A3A86-70AE-4307-828E-089B5C619A10}
Readme
3668
msiexec.exe
write
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{4D0A3A86-70AE-4307-828E-089B5C619A10}
Size
3668
msiexec.exe
write
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{4D0A3A86-70AE-4307-828E-089B5C619A10}
EstimatedSize
32
3668
msiexec.exe
write
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{4D0A3A86-70AE-4307-828E-089B5C619A10}
SystemComponent
1
3668
msiexec.exe
write
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{4D0A3A86-70AE-4307-828E-089B5C619A10}
UninstallString
MsiExec.exe /I{4D0A3A86-70AE-4307-828E-089B5C619A10}
3668
msiexec.exe
write
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{4D0A3A86-70AE-4307-828E-089B5C619A10}
URLInfoAbout
3668
msiexec.exe
write
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{4D0A3A86-70AE-4307-828E-089B5C619A10}
URLUpdateInfo
3668
msiexec.exe
write
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{4D0A3A86-70AE-4307-828E-089B5C619A10}
VersionMajor
3
3668
msiexec.exe
write
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{4D0A3A86-70AE-4307-828E-089B5C619A10}
VersionMinor
2
3668
msiexec.exe
write
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{4D0A3A86-70AE-4307-828E-089B5C619A10}
WindowsInstaller
1
3668
msiexec.exe
write
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{4D0A3A86-70AE-4307-828E-089B5C619A10}
Version
50462720
3668
msiexec.exe
write
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{4D0A3A86-70AE-4307-828E-089B5C619A10}
Language
1033
3668
msiexec.exe
write
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UpgradeCodes\1344BED51D7235A409CD703BECEB61E0
68A3A0D4EA07703428E880B9C516A901
3668
msiexec.exe
write
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Products\68A3A0D4EA07703428E880B9C516A901\InstallProperties
DisplayName
OldMHUUninstallerMSI
3668
msiexec.exe
write
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{4D0A3A86-70AE-4307-828E-089B5C619A10}
DisplayName
OldMHUUninstallerMSI
3668
msiexec.exe
write
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Installer\Features\68A3A0D4EA07703428E880B9C516A901
ProductFeature
3668
msiexec.exe
write
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Products\68A3A0D4EA07703428E880B9C516A901\Features
ProductFeature
,rL0Vbsy{BB'(0BSxZ.(
3668
msiexec.exe
write
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Products\68A3A0D4EA07703428E880B9C516A901\Patches
AllPatches
3668
msiexec.exe
write
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Installer\Products\68A3A0D4EA07703428E880B9C516A901
ProductName
OldMHUUninstallerMSI
3668
msiexec.exe
write
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Installer\Products\68A3A0D4EA07703428E880B9C516A901
PackageCode
4B0141C569DF9B04E82C4FE270BF4AA9
3668
msiexec.exe
write
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Installer\Products\68A3A0D4EA07703428E880B9C516A901
Language
1033
3668
msiexec.exe
write
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Installer\Products\68A3A0D4EA07703428E880B9C516A901
Version
50462720
3668
msiexec.exe
write
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Installer\Products\68A3A0D4EA07703428E880B9C516A901
Assignment
1
3668
msiexec.exe
write
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Installer\Products\68A3A0D4EA07703428E880B9C516A901
AdvertiseFlags
388
3668
msiexec.exe
write
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Installer\Products\68A3A0D4EA07703428E880B9C516A901
InstanceType
0
3668
msiexec.exe
write
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Installer\Products\68A3A0D4EA07703428E880B9C516A901
AuthorizedLUAApp
0
3668
msiexec.exe
write
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Installer\Products\68A3A0D4EA07703428E880B9C516A901
DeploymentFlags
3
3668
msiexec.exe
write
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Installer\UpgradeCodes\1344BED51D7235A409CD703BECEB61E0
68A3A0D4EA07703428E880B9C516A901
3668
msiexec.exe
write
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Installer\Products\68A3A0D4EA07703428E880B9C516A901\SourceList
PackageName
OldMHUUninstallerMSI.msi
3668
msiexec.exe
write
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Installer\Products\68A3A0D4EA07703428E880B9C516A901\SourceList\Net
1
C:\ProgramData\Package Cache\{4D0A3A86-70AE-4307-828E-089B5C619A10}v3.2.0.0\
3668
msiexec.exe
write
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Installer\Products\68A3A0D4EA07703428E880B9C516A901
Clients
:
3668
msiexec.exe
write
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Installer\Products\68A3A0D4EA07703428E880B9C516A901\SourceList
LastUsedSource
n;1;C:\ProgramData\Package Cache\{4D0A3A86-70AE-4307-828E-089B5C619A10}v3.2.0.0\
3668
msiexec.exe
write
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\MUI\StringCacheSettings
StringCacheGeneration
99

Files activity

Executable files
7
Suspicious files
5
Text files
67
Unknown types
4

Dropped files

PID
Process
Filename
Type
3076
OldMHUUninstaller.exe
C:\Users\admin\AppData\Local\Temp\{9507F7AB-8B18-492D-ABC8-35BB2A0A251A}\.cr\OldMHUUninstaller.exe
executable
MD5: cc0d529f8e0d82e9ff6be2f0357d66c7
SHA256: 9e3ced1e4d290a98df5a0717615a8f29e49e09eb2f2c988e43a01f62531401fc
1140
OldMHUUninstaller.exe
C:\Users\admin\AppData\Local\Temp\{0A0695A1-AB64-47C6-92E9-16FA73377C99}\.be\OldMHUUninstaller.exe
executable
MD5: cc0d529f8e0d82e9ff6be2f0357d66c7
SHA256: 9e3ced1e4d290a98df5a0717615a8f29e49e09eb2f2c988e43a01f62531401fc
2712
OldMHUUninstaller.exe
C:\ProgramData\Package Cache\{4D0A3A86-70AE-4307-828E-089B5C619A10}v3.2.0.0\OldMHUUninstallerMSI.msi
executable
MD5: d11b0bba63130cf1b76ea169ab640902
SHA256: 7356e935fceceb4b7124a767b98c9682513b7d64ffdb2826077ba53c1ac9d4b7
3668
msiexec.exe
C:\Windows\Installer\1547d0.msi
executable
MD5: d11b0bba63130cf1b76ea169ab640902
SHA256: 7356e935fceceb4b7124a767b98c9682513b7d64ffdb2826077ba53c1ac9d4b7
3668
msiexec.exe
C:\Windows\Installer\1547d4.msi
executable
MD5: d11b0bba63130cf1b76ea169ab640902
SHA256: 7356e935fceceb4b7124a767b98c9682513b7d64ffdb2826077ba53c1ac9d4b7
2712
OldMHUUninstaller.exe
C:\ProgramData\Package Cache\{72796858-1bf1-4bd0-948c-147f4312470d}\OldMHUUninstaller.exe
executable
MD5: cc0d529f8e0d82e9ff6be2f0357d66c7
SHA256: 9e3ced1e4d290a98df5a0717615a8f29e49e09eb2f2c988e43a01f62531401fc
1140
OldMHUUninstaller.exe
C:\Users\admin\AppData\Local\Temp\{0A0695A1-AB64-47C6-92E9-16FA73377C99}\.ba\wixstdba.dll
executable
MD5: 6ba2e331e0f447aaff0e8142df5f7230
SHA256: 58a135101a2044d96f470e29369a8214c5c2add774488d73c6ae81a588582239
3172
DrvInst.exe
C:\Windows\INF\setupapi.ev1
binary
MD5: 85022b125cf9deb1f6d3f691934a06be
SHA256: fdab575b29646fc15eae64438d8a839992230b207f43d05891c8f3400089f86e
3668
msiexec.exe
C:\Config.Msi\1547d3.rbs
––
MD5:  ––
SHA256:  ––
3668
msiexec.exe
C:\Windows\Installer\1547d2.ipi
binary
MD5: 36dab09efc729b145f318667136927f4
SHA256: 784218294e87e01dce03fe325580b95d26660eb0f9688a00c93a5ff5fecc4e47
3668
msiexec.exe
C:\Users\admin\AppData\Local\Temp\~DF5BDA971CB6822788.TMP
––
MD5:  ––
SHA256:  ––
3668
msiexec.exe
C:\Users\admin\AppData\Local\Temp\~DFD4EDF3E4A427E133.TMP
––
MD5:  ––
SHA256:  ––
3668
msiexec.exe
C:\Windows\Installer\1547d2.ipi
––
MD5:  ––
SHA256:  ––
2712
OldMHUUninstaller.exe
C:\ProgramData\Package Cache\.unverified\OldMHUUninstallerMSI
––
MD5:  ––
SHA256:  ––
1140
OldMHUUninstaller.exe
C:\Users\admin\AppData\Local\Temp\{0A0695A1-AB64-47C6-92E9-16FA73377C99}\OldMHUUninstallerMSI
––
MD5:  ––
SHA256:  ––
2712
OldMHUUninstaller.exe
C:\ProgramData\Package Cache\{72796858-1bf1-4bd0-948c-147f4312470d}\state.rsm
smt
MD5: a5e6a51c4a569698a61b07745963626e
SHA256: 9f9f0b2c4f1c121bf6601e1fa0abdab0c23f41835a91716a4d7f20e503818c4f
1140
OldMHUUninstaller.exe
C:\Users\admin\AppData\Local\Temp\OldMHUUninstaller_20190612124637.log
text
MD5: 750de028cfeee1811c60e0a43015ca51
SHA256: 0a6f224cd82bfc8d316973c5aeca7ad8067e5a576489c7e2f4af602fefa1035c
3172
DrvInst.exe
C:\Windows\INF\setupapi.dev.log
text
MD5: e1f59cebcb09ee1f9d48e14f692be1a9
SHA256: 1ede16bda38888a42043550c4d37526abfbca97697dbe95476e1a30903358a71
3172
DrvInst.exe
C:\Windows\INF\setupapi.dev.log
ini
MD5: 4a8edc02f14de0c87932fa8d7d4f9399
SHA256: 3821933e5a156269b1b53359bba0d7ffc8922eb1227f3511f04ed718c07b8b8d
3668
msiexec.exe
C:\Windows\Installer\MSI4A22.tmp
––
MD5:  ––
SHA256:  ––
3172
DrvInst.exe
C:\Windows\INF\setupapi.ev3
binary
MD5: 76dcc60f78b3dff1ae3627619074f465
SHA256: 18541ac1875315c4f9eff75050c574faff83717c029dae6b366f9c6c3f0c19e0
2712
OldMHUUninstaller.exe
C:\System Volume Information\SPP\metadata-2
––
MD5:  ––
SHA256:  ––
2712
OldMHUUninstaller.exe
C:\System Volume Information\SPP\OnlineMetadataCache\{610de894-95b1-4284-ac24-70fb8c661a72}_OnDiskSnapshotProp
binary
MD5: 2fd34ae59f67dd36f11395989035ad97
SHA256: 0378d9085cc0c1f89347782b74f34013f193bb4b9e58dcc5cae8fcc70b8c0bbe
2712
OldMHUUninstaller.exe
C:\System Volume Information\SPP\snapshot-2
binary
MD5: 2fd34ae59f67dd36f11395989035ad97
SHA256: 0378d9085cc0c1f89347782b74f34013f193bb4b9e58dcc5cae8fcc70b8c0bbe
2712
OldMHUUninstaller.exe
C:\Users\admin\AppData\Local\Temp\OldMHUUninstaller_20190612124637_000_OldMHUUninstallerMSI.log
txt
MD5: 9ca4b1d5607bc0586e8d6b37df50c815
SHA256: de741699b6aa8849fad19ef7b15d59f9472f1caaa6d16dfb2e22aef8447cb8a9
1140
OldMHUUninstaller.exe
C:\Users\admin\AppData\Local\Temp\{0A0695A1-AB64-47C6-92E9-16FA73377C99}\.ba\license.rtf
text
MD5: cb9d45f977946386620f6958dd3087f9
SHA256: 15aee9f41cff56ac986684ccbaf7ffa76e9170ab3dd7880c20dfa50bc4fe08ff
1140
OldMHUUninstaller.exe
C:\Users\admin\AppData\Local\Temp\{0A0695A1-AB64-47C6-92E9-16FA73377C99}\.ba\BootstrapperApplicationData.xml
xml
MD5: f5eb47ef625e5e35589d274373ff280e
SHA256: fbd5bf1e5cae8fb0c093de97eb5b51dd4fd6a694fdca0750a8147c66ad2a9fda
1140
OldMHUUninstaller.exe
C:\Users\admin\AppData\Local\Temp\{0A0695A1-AB64-47C6-92E9-16FA73377C99}\.ba\thm.wxl
xml
MD5: 5d492af2e8c9b2ab58ca1a10248c726f
SHA256: accf0d8bfcef21f5f80730d90705446fc0253174a484fd73b6523a092224322d
1140
OldMHUUninstaller.exe
C:\Users\admin\AppData\Local\Temp\{0A0695A1-AB64-47C6-92E9-16FA73377C99}\.ba\thm.xml
xml
MD5: f62729c6d2540015e072514226c121c7
SHA256: f13bae0ec08c91b4a315bb2d86ee48fade597e7a5440dce6f751f98a3a4d6916
1140
OldMHUUninstaller.exe
C:\Users\admin\AppData\Local\Temp\{0A0695A1-AB64-47C6-92E9-16FA73377C99}\.ba\logo.png
image
MD5: 8346e21859a269dccf1e408dc7593cca
SHA256: cd2e8ed1fbb308d9d166f49794d323a9b22efba1033cdf906d1f4b030319e01b
3668
msiexec.exe
C:\Users\admin\AppData\Local\Temp\OldMHUUninstaller_20190612124637_000_OldMHUUninstallerMSI.log
txt
MD5: 9ca4b1d5607bc0586e8d6b37df50c815
SHA256: de741699b6aa8849fad19ef7b15d59f9472f1caaa6d16dfb2e22aef8447cb8a9
3924
vssvc.exe
C:
––
MD5:  ––
SHA256:  ––

Find more information of the staic content and download it at the full report

Network activity

HTTP(S) requests
0
TCP/UDP connections
0
DNS requests
0
Threats
0

No network activity.

Debug output strings

No debug info.