General Info Watch the FULL Interactive Analysis at ANY.RUN!

File name

sfx.exe

Verdict
Malicious activity
Analysis date
12/6/2018, 14:19:02
OS:
Windows 7 Professional Service Pack 1 (build: 7601, 32 bit)
Indicators:

MIME:
application/x-dosexec
File info:
PE32 executable (GUI) Intel 80386, for MS Windows
MD5

2ceada9ff365c2270d4f5009559f6317

SHA1

fa20d954bdbce36fc4c2a43e4d7398c5ffcf7953

SHA256

cc4af00148c278ba5d22fbf13abbdf0ce6832b6941b617f6794eee6bced60c61

SSDEEP

49152:nJqi6DGIafdSjrBNGgMFOdJe+LvahKKBo0/0u1YwRdDEOwKGdfdZStr0+253f0ey:JD5IrR/2ONoKKBN/pyYwXKt4+25vxRlw

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distored by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

Software environment set and analysis options

Launch configuration

Task duration
300 seconds
Additional time used
240 seconds
Fakenet option
off
Heavy Evaision option
on
MITM proxy
off
Route via Tor
off
Network geolocation
off
Privacy
Public submission
Autoconfirmation of UAC
on

Software preset

  • Internet Explorer 8.0.7601.17514
  • Adobe Acrobat Reader DC MUI (15.023.20070)
  • Adobe Flash Player 26 ActiveX (26.0.0.131)
  • Adobe Flash Player 26 NPAPI (26.0.0.131)
  • Adobe Flash Player 26 PPAPI (26.0.0.131)
  • Adobe Refresh Manager (1.8.0)
  • CCleaner (5.35)
  • FileZilla Client 3.36.0 (3.36.0)
  • Google Chrome (68.0.3440.106)
  • Google Update Helper (1.3.33.17)
  • Java 8 Update 92 (8.0.920.14)
  • Java Auto Updater (2.8.92.14)
  • Microsoft .NET Framework 4.6.1 (4.6.01055)
  • Microsoft Office Access MUI (English) 2010 (14.0.6029.1000)
  • Microsoft Office Access Setup Metadata MUI (English) 2010 (14.0.6029.1000)
  • Microsoft Office Excel MUI (English) 2010 (14.0.6029.1000)
  • Microsoft Office OneNote MUI (English) 2010 (14.0.6029.1000)
  • Microsoft Office Outlook MUI (English) 2010 (14.0.6029.1000)
  • Microsoft Office PowerPoint MUI (English) 2010 (14.0.6029.1000)
  • Microsoft Office Professional 2010 (14.0.6029.1000)
  • Microsoft Office Proof (English) 2010 (14.0.6029.1000)
  • Microsoft Office Proof (French) 2010 (14.0.6029.1000)
  • Microsoft Office Proof (Spanish) 2010 (14.0.6029.1000)
  • Microsoft Office Proofing (English) 2010 (14.0.6029.1000)
  • Microsoft Office Publisher MUI (English) 2010 (14.0.6029.1000)
  • Microsoft Office Shared MUI (English) 2010 (14.0.6029.1000)
  • Microsoft Office Shared Setup Metadata MUI (English) 2010 (14.0.6029.1000)
  • Microsoft Office Single Image 2010 (14.0.6029.1000)
  • Microsoft Office Word MUI (English) 2010 (14.0.6029.1000)
  • Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.6161 (9.0.30729.6161)
  • Microsoft Visual C++ 2010 x86 Redistributable - 10.0.40219 (10.0.40219)
  • Microsoft Visual C++ 2013 Redistributable (x86) - 12.0.30501 (12.0.30501.0)
  • Microsoft Visual C++ 2013 x86 Additional Runtime - 12.0.21005 (12.0.21005)
  • Microsoft Visual C++ 2013 x86 Minimum Runtime - 12.0.21005 (12.0.21005)
  • Microsoft Visual C++ 2017 Redistributable (x86) - 14.15.26706 (14.15.26706.0)
  • Microsoft Visual C++ 2017 x86 Additional Runtime - 14.15.26706 (14.15.26706)
  • Microsoft Visual C++ 2017 x86 Minimum Runtime - 14.15.26706 (14.15.26706)
  • Mozilla Firefox 61.0.2 (x86 en-US) (61.0.2)
  • Notepad++ (32-bit x86) (7.5.1)
  • Opera 12.15 (12.15.1748)
  • Skype version 8.29 (8.29)
  • VLC media player (2.2.6)
  • WinRAR 5.60 (32-bit) (5.60.0)

Hotfixes

  • Client LanguagePack Package
  • Client Refresh LanguagePack Package
  • CodecPack Basic Package
  • Foundation Package
  • IE Troubleshooters Package
  • InternetExplorer Optional Package
  • KB2534111
  • KB2999226
  • KB976902
  • LocalPack AU Package
  • LocalPack CA Package
  • LocalPack GB Package
  • LocalPack US Package
  • LocalPack ZA Package
  • ProfessionalEdition
  • UltimateEdition

Behavior activities

MALICIOUS SUSPICIOUS INFO
Application was dropped or rewritten from another process
  • QuickProjection.exe (PID: 2308)
  • AdhocSettingService.exe (PID: 3736)
  • setup.exe (PID: 3824)
Executable content was dropped or overwritten
  • msiexec.exe (PID: 3212)
  • setup.exe (PID: 3824)
  • sfx.exe (PID: 3760)
Starts Microsoft Installer
  • setup.exe (PID: 3824)
Reads internet explorer settings
  • sfx.exe (PID: 3760)
Creates files in the user directory
  • QuickProjection.exe (PID: 2308)
Creates a software uninstall entry
  • msiexec.exe (PID: 3212)
Low-level read access rights to disk partition
  • vssvc.exe (PID: 2140)
Creates files in the program directory
  • msiexec.exe (PID: 3212)
Searches for installed software
  • msiexec.exe (PID: 3212)

Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report

Static information

TRiD
.exe
|   Win64 Executable (generic) (64.6%)
.dll
|   Win32 Dynamic Link Library (generic) (15.4%)
.exe
|   Win32 Executable (generic) (10.5%)
.exe
|   Generic Win/DOS Executable (4.6%)
.exe
|   DOS Executable Generic (4.6%)
EXIF
EXE
MachineType:
Intel 386 or later, and compatibles
TimeStamp:
2016:08:14 21:15:49+02:00
PEType:
PE32
LinkerVersion:
14
CodeSize:
188416
InitializedDataSize:
196096
UninitializedDataSize:
null
EntryPoint:
0x1cab5
OSVersion:
5.1
ImageVersion:
null
SubsystemVersion:
5.1
Subsystem:
Windows GUI
Summary
Architecture:
IMAGE_FILE_MACHINE_I386
Subsystem:
IMAGE_SUBSYSTEM_WINDOWS_GUI
Compilation Date:
14-Aug-2016 19:15:49
Detected languages
English - United States
Debug artifacts
D:\Projects\WinRAR\sfx\build\sfxrar32\Release\sfxrar.pdb
DOS Header
Magic number:
MZ
Bytes on last page of file:
0x0090
Pages in file:
0x0003
Relocations:
0x0000
Size of header:
0x0004
Min extra paragraphs:
0x0000
Max extra paragraphs:
0xFFFF
Initial SS value:
0x0000
Initial SP value:
0x00B8
Checksum:
0x0000
Initial IP value:
0x0000
Initial CS value:
0x0000
Overlay number:
0x0000
OEM identifier:
0x0000
OEM information:
0x0000
Address of NE header:
0x00000108
PE Headers
Signature:
PE
Machine:
IMAGE_FILE_MACHINE_I386
Number of sections:
6
Time date stamp:
14-Aug-2016 19:15:49
Pointer to Symbol Table:
0x00000000
Number of symbols:
0
Size of Optional Header:
0x00E0
Characteristics
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_EXECUTABLE_IMAGE
Sections
Name Virtual Address Virtual Size Raw Size Charateristics Entropy
.text 0x00001000 0x0002DFE8 0x0002E000 IMAGE_SCN_CNT_CODE,IMAGE_SCN_MEM_EXECUTE,IMAGE_SCN_MEM_READ 6.71025
.rdata 0x0002F000 0x000099D0 0x00009A00 IMAGE_SCN_CNT_INITIALIZED_DATA,IMAGE_SCN_MEM_READ 5.15287
.data 0x00039000 0x0001F8B8 0x00000C00 IMAGE_SCN_CNT_INITIALIZED_DATA,IMAGE_SCN_MEM_READ,IMAGE_SCN_MEM_WRITE 3.29547
.gfids 0x00059000 0x000000F0 0x00000200 IMAGE_SCN_CNT_INITIALIZED_DATA,IMAGE_SCN_MEM_READ 2.12367
.rsrc 0x0005A000 0x00004680 0x00004800 IMAGE_SCN_CNT_INITIALIZED_DATA,IMAGE_SCN_MEM_READ 4.63811
.reloc 0x0005F000 0x00001F8C 0x00002000 IMAGE_SCN_CNT_INITIALIZED_DATA,IMAGE_SCN_MEM_DISCARDABLE,IMAGE_SCN_MEM_READ 6.62986
Resources
1

2

3

4

7

8

9

10

11

12

13

14

15

16

100

101

ASKNEXTVOL

GETPASSWORD1

LICENSEDLG

RENAMEDLG

REPLACEFILEDLG

STARTDLG

Imports
    KERNEL32.dll

    COMCTL32.dll (delay-loaded)

Exports

    No exports.

Screenshots

Processes

Total processes
42
Monitored processes
8
Malicious processes
1
Suspicious processes
0

Behavior graph

+
drop and start start sfx.exe setup.exe msiexec.exe no specs msiexec.exe vssvc.exe no specs drvinst.exe no specs adhocsettingservice.exe no specs quickprojection.exe
Specs description
Program did not start
Integrity level elevation
Task сontains an error or was rebooted
Process has crashed
Task contains several apps running
Executable file was dropped
Debug information is available
Process was injected
Network attacks were detected
Application downloaded the executable file
Actions similar to stealing personal data
Behavior similar to exploiting the vulnerability
Inspected object has sucpicious PE structure
File is detected by antivirus software
CPU overrun
RAM overrun
Process starts the services
Process was added to the startup
Behavior similar to spam
Low-level access to the HDD
Probably Tor was used
System was rebooted
Connects to the network
Known threat

Process information

Click at the process to see the details.

PID
3760
CMD
"C:\Users\admin\Desktop\sfx.exe"
Path
C:\Users\admin\Desktop\sfx.exe
Indicators
Parent process
––
User
admin
Integrity Level
MEDIUM
Exit code
0
Version:
Company
Description
Version
Modules
Image
c:\users\admin\desktop\sfx.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\version.dll
c:\windows\system32\sfc_os.dll
c:\windows\system32\sspicli.dll
c:\windows\system32\rsaenh.dll
c:\windows\system32\uxtheme.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
c:\windows\system32\imm32.dll
c:\windows\system32\msctf.dll
c:\windows\system32\dwmapi.dll
c:\windows\system32\cryptbase.dll
c:\windows\system32\ole32.dll
c:\windows\system32\riched20.dll
c:\windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_41e6975e2bd6f2b2\comctl32.dll
c:\windows\system32\shlwapi.dll
c:\windows\system32\shell32.dll
c:\windows\system32\clbcatq.dll
c:\windows\system32\oleaut32.dll
c:\program files\common files\microsoft shared\ink\tiptsf.dll
c:\windows\system32\ieframe.dll
c:\windows\system32\psapi.dll
c:\windows\system32\oleacc.dll
c:\windows\system32\iertutil.dll
c:\windows\system32\urlmon.dll
c:\windows\system32\wininet.dll
c:\windows\system32\crypt32.dll
c:\windows\system32\msasn1.dll
c:\windows\system32\apphelp.dll
c:\windows\system32\mshtml.dll
c:\windows\system32\msls31.dll
c:\windows\system32\ntmarta.dll
c:\windows\system32\wldap32.dll
c:\windows\system32\msimtf.dll
c:\windows\system32\mlang.dll
c:\windows\system32\profapi.dll
c:\windows\system32\propsys.dll
c:\windows\system32\setupapi.dll
c:\windows\system32\cfgmgr32.dll
c:\windows\system32\devobj.dll
c:\users\admin\desktop\204635\setup.exe
c:\windows\system32\sfc.dll
c:\windows\system32\devrtl.dll
c:\windows\system32\mpr.dll
c:\windows\system32\ws2_32.dll
c:\windows\system32\nsi.dll
c:\windows\system32\dnsapi.dll
c:\windows\system32\iphlpapi.dll
c:\windows\system32\winnsi.dll

PID
3824
CMD
"C:\Users\admin\Desktop\204635\setup.exe" -i
Path
C:\Users\admin\Desktop\204635\setup.exe
Indicators
Parent process
sfx.exe
User
admin
Integrity Level
MEDIUM
Exit code
0
Version:
Company
Ricoh
Description
Setup Launcher Unicode
Version
1.3.0.28
Modules
Image
c:\users\admin\desktop\204635\setup.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\version.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\shell32.dll
c:\windows\system32\shlwapi.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\user32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
c:\windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_41e6975e2bd6f2b2\comctl32.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\ole32.dll
c:\windows\system32\oleaut32.dll
c:\windows\system32\apphelp.dll
c:\windows\apppatch\acgenral.dll
c:\windows\system32\sspicli.dll
c:\windows\system32\uxtheme.dll
c:\windows\system32\winmm.dll
c:\windows\system32\samcli.dll
c:\windows\system32\msacm32.dll
c:\windows\system32\sfc.dll
c:\windows\system32\sfc_os.dll
c:\windows\system32\userenv.dll
c:\windows\system32\profapi.dll
c:\windows\system32\dwmapi.dll
c:\windows\system32\setupapi.dll
c:\windows\system32\cfgmgr32.dll
c:\windows\system32\devobj.dll
c:\windows\system32\urlmon.dll
c:\windows\system32\wininet.dll
c:\windows\system32\iertutil.dll
c:\windows\system32\crypt32.dll
c:\windows\system32\msasn1.dll
c:\windows\system32\mpr.dll
c:\windows\system32\imm32.dll
c:\windows\system32\msctf.dll
c:\windows\system32\cryptbase.dll
c:\windows\system32\ntmarta.dll
c:\windows\system32\wldap32.dll
c:\windows\system32\msi.dll
c:\windows\system32\msiexec.exe

PID
4012
CMD
MSIEXEC.EXE /i "C:\Users\admin\AppData\Local\Temp\{BD343DB5-63FC-43A3-82C1-0D442A34B730}\RICOH QuickProjection.msi" TRANSFORMS="C:\Users\admin\AppData\Local\Temp\{BD343DB5-63FC-43A3-82C1-0D442A34B730}\1033.MST" SETUPEXEDIR="C:\Users\admin\Desktop\204635" SETUPEXENAME="setup.exe"
Path
C:\Windows\system32\MSIEXEC.EXE
Indicators
No indicators
Parent process
setup.exe
User
admin
Integrity Level
MEDIUM
Exit code
0
Version:
Company
Microsoft Corporation
Description
Windows® installer
Version
5.0.7600.16385 (win7_rtm.090713-1255)
Modules
Image
c:\windows\system32\msiexec.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
c:\windows\system32\ole32.dll
c:\windows\system32\msi.dll
c:\windows\system32\shlwapi.dll
c:\windows\system32\apphelp.dll
c:\windows\apppatch\aclayers.dll
c:\windows\system32\sspicli.dll
c:\windows\system32\shell32.dll
c:\windows\system32\oleaut32.dll
c:\windows\system32\userenv.dll
c:\windows\system32\profapi.dll
c:\windows\system32\winspool.drv
c:\windows\system32\mpr.dll
c:\windows\apppatch\acgenral.dll
c:\windows\system32\uxtheme.dll
c:\windows\system32\winmm.dll
c:\windows\system32\samcli.dll
c:\windows\system32\msacm32.dll
c:\windows\system32\version.dll
c:\windows\system32\sfc.dll
c:\windows\system32\sfc_os.dll
c:\windows\system32\dwmapi.dll
c:\windows\system32\setupapi.dll
c:\windows\system32\cfgmgr32.dll
c:\windows\system32\devobj.dll
c:\windows\system32\urlmon.dll
c:\windows\system32\iertutil.dll
c:\windows\system32\wininet.dll
c:\windows\system32\crypt32.dll
c:\windows\system32\msasn1.dll
c:\windows\system32\imm32.dll
c:\windows\system32\msctf.dll
c:\windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_41e6975e2bd6f2b2\comctl32.dll
c:\windows\system32\cryptsp.dll
c:\windows\system32\rsaenh.dll
c:\windows\system32\cryptbase.dll
c:\windows\system32\msimsg.dll
c:\windows\system32\propsys.dll
c:\windows\system32\netapi32.dll
c:\windows\system32\netutils.dll
c:\windows\system32\srvcli.dll
c:\windows\system32\wkscli.dll
c:\windows\system32\clbcatq.dll
c:\windows\system32\rpcrtremote.dll
c:\windows\system32\sxs.dll
c:\windows\system32\mscoree.dll
c:\windows\microsoft.net\framework\v4.0.30319\mscoreei.dll
c:\windows\microsoft.net\framework\v4.0.30319\clr.dll
c:\windows\microsoft.net\framework\v4.0.30319\fusion.dll
c:\windows\system32\msihnd.dll
c:\windows\system32\comdlg32.dll
c:\windows\system32\riched20.dll
c:\windows\system32\msls31.dll

PID
3212
CMD
C:\Windows\system32\msiexec.exe /V
Path
C:\Windows\system32\msiexec.exe
Indicators
Parent process
––
User
SYSTEM
Integrity Level
SYSTEM
Version:
Company
Microsoft Corporation
Description
Windows® installer
Version
5.0.7600.16385 (win7_rtm.090713-1255)
Modules
Image
c:\windows\system32\msiexec.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\user32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\usp10.dll
c:\windows\system32\ole32.dll
c:\windows\system32\msi.dll
c:\windows\system32\shlwapi.dll
c:\windows\system32\apphelp.dll
c:\windows\apppatch\aclayers.dll
c:\windows\system32\sspicli.dll
c:\windows\system32\shell32.dll
c:\windows\system32\oleaut32.dll
c:\windows\system32\userenv.dll
c:\windows\system32\profapi.dll
c:\windows\system32\winspool.drv
c:\windows\system32\mpr.dll
c:\windows\apppatch\acgenral.dll
c:\windows\system32\uxtheme.dll
c:\windows\system32\winmm.dll
c:\windows\system32\samcli.dll
c:\windows\system32\msacm32.dll
c:\windows\system32\version.dll
c:\windows\system32\sfc.dll
c:\windows\system32\sfc_os.dll
c:\windows\system32\dwmapi.dll
c:\windows\system32\setupapi.dll
c:\windows\system32\cfgmgr32.dll
c:\windows\system32\devobj.dll
c:\windows\system32\urlmon.dll
c:\windows\system32\wininet.dll
c:\windows\system32\iertutil.dll
c:\windows\system32\crypt32.dll
c:\windows\system32\msasn1.dll
c:\windows\system32\imm32.dll
c:\windows\system32\msctf.dll
c:\windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_41e6975e2bd6f2b2\comctl32.dll
c:\windows\system32\cryptbase.dll
c:\windows\system32\clbcatq.dll
c:\windows\system32\cryptsp.dll
c:\windows\system32\rsaenh.dll
c:\windows\system32\rpcrtremote.dll
c:\windows\system32\msimsg.dll
c:\windows\system32\netapi32.dll
c:\windows\system32\netutils.dll
c:\windows\system32\srvcli.dll
c:\windows\system32\wkscli.dll
c:\windows\system32\srclient.dll
c:\windows\system32\spp.dll
c:\windows\system32\vssapi.dll
c:\windows\system32\atl.dll
c:\windows\system32\vsstrace.dll
c:\windows\system32\vss_ps.dll
c:\windows\system32\dsrole.dll
c:\windows\system32\msxml3.dll
c:\windows\system32\es.dll
c:\windows\system32\sxs.dll
c:\windows\system32\propsys.dll
c:\windows\system32\samlib.dll
c:\windows\system32\mscoree.dll
c:\windows\microsoft.net\framework\v4.0.30319\mscoreei.dll
c:\windows\microsoft.net\framework\v4.0.30319\clr.dll
c:\windows\microsoft.net\framework\v4.0.30319\fusion.dll
c:\windows\system32\rstrtmgr.dll
c:\windows\system32\ncrypt.dll
c:\windows\system32\bcrypt.dll
c:\windows\system32\bcryptprimitives.dll
c:\windows\system32\devrtl.dll
c:\windows\system32\cabinet.dll
c:\windows\system32\ntmarta.dll
c:\windows\system32\wldap32.dll

PID
2140
CMD
C:\Windows\system32\vssvc.exe
Path
C:\Windows\system32\vssvc.exe
Indicators
No indicators
Parent process
––
User
SYSTEM
Integrity Level
SYSTEM
Version:
Company
Microsoft Corporation
Description
Microsoft® Volume Shadow Copy Service
Version
6.1.7600.16385 (win7_rtm.090713-1255)
Modules
Image
c:\windows\system32\vssvc.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
c:\windows\system32\atl.dll
c:\windows\system32\ole32.dll
c:\windows\system32\shlwapi.dll
c:\windows\system32\oleaut32.dll
c:\windows\system32\vssapi.dll
c:\windows\system32\vsstrace.dll
c:\windows\system32\netapi32.dll
c:\windows\system32\netutils.dll
c:\windows\system32\srvcli.dll
c:\windows\system32\wkscli.dll
c:\windows\system32\samcli.dll
c:\windows\system32\clusapi.dll
c:\windows\system32\cryptdll.dll
c:\windows\system32\xolehlp.dll
c:\windows\system32\version.dll
c:\windows\system32\resutils.dll
c:\windows\system32\setupapi.dll
c:\windows\system32\cfgmgr32.dll
c:\windows\system32\devobj.dll
c:\windows\system32\authz.dll
c:\windows\system32\virtdisk.dll
c:\windows\system32\fltlib.dll
c:\windows\system32\imm32.dll
c:\windows\system32\msctf.dll
c:\windows\system32\cryptbase.dll
c:\windows\system32\cryptsp.dll
c:\windows\system32\rsaenh.dll
c:\windows\system32\rpcrtremote.dll
c:\windows\system32\clbcatq.dll
c:\windows\system32\vss_ps.dll
c:\windows\system32\samlib.dll
c:\windows\system32\es.dll
c:\windows\system32\propsys.dll
c:\windows\system32\catsrvut.dll
c:\windows\system32\mfcsubs.dll
c:\windows\system32\sxs.dll
c:\windows\system32\msxml3.dll
c:\windows\system32\wintrust.dll
c:\windows\system32\crypt32.dll
c:\windows\system32\msasn1.dll

PID
3096
CMD
DrvInst.exe "1" "200" "STORAGE\VolumeSnapshot\HarddiskVolumeSnapshot18" "" "" "6792c44eb" "00000000" "00000550" "00000330"
Path
C:\Windows\system32\DrvInst.exe
Indicators
No indicators
Parent process
––
User
SYSTEM
Integrity Level
SYSTEM
Exit code
0
Version:
Company
Microsoft Corporation
Description
Driver Installation Module
Version
6.1.7600.16385 (win7_rtm.090713-1255)
Modules
Image
c:\windows\system32\drvinst.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\setupapi.dll
c:\windows\system32\cfgmgr32.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\sechost.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\user32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
c:\windows\system32\oleaut32.dll
c:\windows\system32\ole32.dll
c:\windows\system32\devobj.dll
c:\windows\system32\devrtl.dll
c:\windows\system32\imm32.dll
c:\windows\system32\msctf.dll
c:\windows\system32\spinf.dll
c:\windows\system32\wintrust.dll
c:\windows\system32\crypt32.dll
c:\windows\system32\msasn1.dll
c:\windows\system32\cryptsp.dll
c:\windows\system32\rsaenh.dll
c:\windows\system32\cryptbase.dll
c:\windows\system32\ncrypt.dll
c:\windows\system32\bcrypt.dll
c:\windows\system32\bcryptprimitives.dll
c:\windows\system32\userenv.dll
c:\windows\system32\profapi.dll
c:\windows\system32\gpapi.dll
c:\windows\system32\cryptnet.dll
c:\windows\system32\wldap32.dll
c:\windows\system32\shlwapi.dll
c:\windows\system32\spfileq.dll

PID
3736
CMD
"C:\Program Files\Ricoh\QuickProjection\AdhocSettingService.exe"
Path
C:\Program Files\Ricoh\QuickProjection\AdhocSettingService.exe
Indicators
No indicators
Parent process
––
User
SYSTEM
Integrity Level
SYSTEM
Version:
Company
Description
Version
Modules
Image
c:\program files\ricoh\quickprojection\adhocsettingservice.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\wlanapi.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\wlanutil.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\user32.dll
c:\windows\system32\usp10.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\sechost.dll
c:\windows\system32\ole32.dll
c:\windows\system32\imm32.dll
c:\windows\system32\msctf.dll

PID
2308
CMD
"C:\Program Files\Ricoh\QuickProjection\QuickProjection.exe"
Path
C:\Program Files\Ricoh\QuickProjection\QuickProjection.exe
Indicators
Parent process
––
User
admin
Integrity Level
MEDIUM
Exit code
0
Version:
Company
RICOH
Description
QuickProjection
Version
1.3.0.28
Modules
Image
c:\program files\ricoh\quickprojection\quickprojection.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\dbghelp.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\cabinet.dll
c:\windows\system32\winhttp.dll
c:\windows\system32\webio.dll
c:\windows\system32\wlanapi.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\wlanutil.dll
c:\windows\system32\iphlpapi.dll
c:\windows\system32\nsi.dll
c:\windows\system32\winnsi.dll
c:\windows\system32\winmm.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
c:\windows\system32\version.dll
c:\windows\system32\msimg32.dll
c:\windows\system32\comdlg32.dll
c:\windows\system32\shlwapi.dll
c:\windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_41e6975e2bd6f2b2\comctl32.dll
c:\windows\system32\shell32.dll
c:\windows\system32\winspool.drv
c:\windows\system32\advapi32.dll
c:\windows\system32\sechost.dll
c:\windows\system32\ole32.dll
c:\windows\system32\oleaut32.dll
c:\windows\system32\oledlg.dll
c:\windows\winsxs\x86_microsoft.windows.gdiplus_6595b64144ccf1df_1.1.7601.17514_none_72d18a4386696c80\gdiplus.dll
c:\windows\system32\ws2_32.dll
c:\windows\system32\oleacc.dll
c:\windows\system32\imm32.dll
c:\windows\system32\msctf.dll
c:\windows\system32\uxtheme.dll
c:\windows\system32\dwmapi.dll
c:\windows\system32\cryptbase.dll
c:\windows\system32\sspicli.dll
c:\windows\system32\windowscodecs.dll
c:\windows\system32\mswsock.dll
c:\windows\system32\wshtcpip.dll
c:\windows\system32\cryptsp.dll
c:\windows\system32\rsaenh.dll
c:\windows\system32\asycfilt.dll
c:\windows\system32\dnsapi.dll
c:\windows\system32\rasadhlp.dll
c:\windows\system32\wship6.dll
c:\windows\system32\userenv.dll
c:\windows\system32\profapi.dll

Registry activity

Total events
726
Read events
473
Write events
246
Delete events
7

Modification events

PID
Process
Operation
Key
Name
Value
3760
sfx.exe
write
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap
UNCAsIntranet
0
3760
sfx.exe
write
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap
AutoDetect
1
3212
msiexec.exe
write
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\VSS\Diag\SystemRestore
SrCreateRp (Enter)
4000000000000000FAE68669668DD4018C0C0000340F0000D5070000000000000000000000000000000000000000000000000000000000000000000000000000
3212
msiexec.exe
write
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\VSS\Diag\SPP
SppCreate (Enter)
4000000000000000FAE68669668DD4018C0C0000340F0000D0070000000000000000000000000000000000000000000000000000000000000000000000000000
3212
msiexec.exe
write
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\SPP
LastIndex
20
3212
msiexec.exe
write
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\VSS\Diag\SPP
SppGatherWriterMetadata (Enter)
4000000000000000F6A5076A668DD4018C0C0000340F0000D3070000000000000000000000000000000000000000000000000000000000000000000000000000
3212
msiexec.exe
write
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\VSS\Diag\VssapiPublisher
IDENTIFY (Enter)
400000000000000050080A6A668DD4018C0C0000E80D0000E8030000010000000000000000000000403345210F1C374387E6E33A5F735D200000000000000000
3212
msiexec.exe
write
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\VSS\Diag\VssapiPublisher
IDENTIFY (Leave)
40000000000000007873F86A668DD4018C0C0000E80D0000E8030000000000000000000000000000403345210F1C374387E6E33A5F735D200000000000000000
3212
msiexec.exe
write
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\VSS\Diag\SPP
SppGatherWriterMetadata (Leave)
4000000000000000DEA69F70668DD4018C0C0000340F0000D3070000010000000000000000000000000000000000000000000000000000000000000000000000
3212
msiexec.exe
write
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\VSS\Diag\SPP
SppAddInterestingComponents (Enter)
4000000000000000DEA69F70668DD4018C0C0000340F0000D4070000000000000000000000000000000000000000000000000000000000000000000000000000
3212
msiexec.exe
write
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\VSS\Diag\SPP
SppAddInterestingComponents (Leave)
40000000000000005457B070668DD4018C0C0000340F0000D4070000010000000000000000000000000000000000000000000000000000000000000000000000
3212
msiexec.exe
write
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\VSS\Diag\VssapiPublisher
PREPAREBACKUP (Enter)
4000000000000000246AC370668DD4018C0C000014080000E9030000010000000000000000000000403345210F1C374387E6E33A5F735D200000000000000000
3212
msiexec.exe
write
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\VSS\Diag\VssapiPublisher
PREPAREBACKUP (Leave)
4000000000000000A841DB70668DD4018C0C000014080000E9030000000000000000000000000000403345210F1C374387E6E33A5F735D200000000000000000
3212
msiexec.exe
write
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\VSS\Diag\VssapiPublisher
GETSTATE (Enter)
4000000000000000A841DB70668DD4018C0C0000D00A0000F9030000010000000000000000000000403345210F1C374387E6E33A5F735D200000000000000000
3212
msiexec.exe
write
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\VSS\Diag\VssapiPublisher
GETSTATE (Leave)
40000000000000006A2DE770668DD4018C0C0000D00A0000F9030000000000000000000000000000403345210F1C374387E6E33A5F735D200000000000000000
3212
msiexec.exe
write
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\VSS\Diag\VssapiPublisher
DOSNAPSHOT (Enter)
40000000000000001EF2EB70668DD4018C0C0000340F00000A040000010000000000000000000000403345210F1C374387E6E33A5F735D200000000000000000
3212
msiexec.exe
write
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\VSS\Diag\VssapiPublisher
DOSNAPSHOT (Leave)
40000000000000007EF9F671668DD4018C0C0000E80B00000A040000000000000000000000000000403345210F1C374387E6E33A5F735D200000000000000000
3212
msiexec.exe
write
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\VSS\Diag\SPP
SppCreate (Leave)
40000000000000007EF9F671668DD4018C0C0000340F0000D0070000010000000000000000000000000000000000000000000000000000000000000000000000
3212
msiexec.exe
write
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\VSS\Diag\SystemRestore
SrCreateRp (Leave)
40000000000000007EF9F671668DD4018C0C0000340F0000D5070000010000000000000000000000000000000000000000000000000000000000000000000000
3212
msiexec.exe
write
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\SystemRestore
FirstRun
0
3212
msiexec.exe
write
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\SystemRestore
LastIndex
20
3212
msiexec.exe
write
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\SystemRestore\Volatile
NestingLevel
1
3212
msiexec.exe
write
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\SystemRestore\Volatile
StartNesting
FAE68669668DD401
3212
msiexec.exe
write
HKEY_USERS\S-1-5-21-1302019708-1500728564-335382590-1000\Software\Microsoft\RestartManager\Session0000
Owner
8C0C00000A912165668DD401
3212
msiexec.exe
write
HKEY_USERS\S-1-5-21-1302019708-1500728564-335382590-1000\Software\Microsoft\RestartManager\Session0000
SessionHash
F861612FA4481D6B4A508CCCC3EDEA038189BC67121F7B9D0DF7F341F4928CC7
3212
msiexec.exe
write
HKEY_USERS\S-1-5-21-1302019708-1500728564-335382590-1000\Software\Microsoft\RestartManager\Session0000
Sequence
1
3212
msiexec.exe
write
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\InProgress
C:\Windows\Installer\256511.ipi
3212
msiexec.exe
write
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\Rollback\Scripts
C:\Config.Msi\256512.rbs
30707046
3212
msiexec.exe
write
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\Rollback\Scripts
C:\Config.Msi\256512.rbsLow
1924352384
3212
msiexec.exe
write
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\86909C9F9555E7246964F51FFDF7772D
76396891177255849A58A7A8FFF3A29F
C:\Program Files\Ricoh\QuickProjection\AdhocSettingService.exe
3212
msiexec.exe
write
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\FD42BC512928211408319BC108128A6C
76396891177255849A58A7A8FFF3A29F
C:\Program Files\Ricoh\QuickProjection\QuickProjection.exe
3212
msiexec.exe
write
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\771E8C0537764034A831D8F23B291E25
76396891177255849A58A7A8FFF3A29F
C:\Program Files\Ricoh\QuickProjection\DeleteSettingFiles.exe
3212
msiexec.exe
write
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\Folders
C:\Program Files\Ricoh\QuickProjection\
3212
msiexec.exe
write
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\Folders
C:\Program Files\Ricoh\
3212
msiexec.exe
write
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\Folders
C:\Windows\Installer\{19869367-2771-4855-A985-7A8AFF3F2AF9}\
3212
msiexec.exe
write
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\Folders
C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Ricoh\QuickProjection\
3212
msiexec.exe
write
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\Folders
C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Ricoh\
3212
msiexec.exe
write
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Products\76396891177255849A58A7A8FFF3A29F\InstallProperties
RegOwner
admin
3212
msiexec.exe
write
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Products\76396891177255849A58A7A8FFF3A29F\InstallProperties
RegCompany
3212
msiexec.exe
write
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Products\76396891177255849A58A7A8FFF3A29F\InstallProperties
ProductID
none
3212
msiexec.exe
write
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Products\76396891177255849A58A7A8FFF3A29F\InstallProperties
LocalPackage
C:\Windows\Installer\256513.msi
3212
msiexec.exe
write
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Products\76396891177255849A58A7A8FFF3A29F\InstallProperties
AuthorizedCDFPrefix
3212
msiexec.exe
write
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Products\76396891177255849A58A7A8FFF3A29F\InstallProperties
Comments
3212
msiexec.exe
write
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Products\76396891177255849A58A7A8FFF3A29F\InstallProperties
Contact
3212
msiexec.exe
write
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Products\76396891177255849A58A7A8FFF3A29F\InstallProperties
DisplayVersion
1.3.0.28
3212
msiexec.exe
write
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Products\76396891177255849A58A7A8FFF3A29F\InstallProperties
HelpLink
3212
msiexec.exe
write
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Products\76396891177255849A58A7A8FFF3A29F\InstallProperties
HelpTelephone
3212
msiexec.exe
write
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Products\76396891177255849A58A7A8FFF3A29F\InstallProperties
InstallDate
20181206
3212
msiexec.exe
write
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Products\76396891177255849A58A7A8FFF3A29F\InstallProperties
InstallLocation
C:\Program Files\Ricoh\QuickProjection\
3212
msiexec.exe
write
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Products\76396891177255849A58A7A8FFF3A29F\InstallProperties
InstallSource
C:\Users\admin\AppData\Local\Temp\{BD343DB5-63FC-43A3-82C1-0D442A34B730}\
3212
msiexec.exe
write
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Products\76396891177255849A58A7A8FFF3A29F\InstallProperties
ModifyPath
MsiExec.exe /I{19869367-2771-4855-A985-7A8AFF3F2AF9}
3212
msiexec.exe
write
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Products\76396891177255849A58A7A8FFF3A29F\InstallProperties
Publisher
Ricoh
3212
msiexec.exe
write
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Products\76396891177255849A58A7A8FFF3A29F\InstallProperties
Readme
3212
msiexec.exe
write
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Products\76396891177255849A58A7A8FFF3A29F\InstallProperties
Size
3212
msiexec.exe
write
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Products\76396891177255849A58A7A8FFF3A29F\InstallProperties
EstimatedSize
7672
3212
msiexec.exe
write
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Products\76396891177255849A58A7A8FFF3A29F\InstallProperties
UninstallString
MsiExec.exe /I{19869367-2771-4855-A985-7A8AFF3F2AF9}
3212
msiexec.exe
write
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Products\76396891177255849A58A7A8FFF3A29F\InstallProperties
URLInfoAbout
http://www.Ricoh.com
3212
msiexec.exe
write
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Products\76396891177255849A58A7A8FFF3A29F\InstallProperties
URLUpdateInfo
3212
msiexec.exe
write
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Products\76396891177255849A58A7A8FFF3A29F\InstallProperties
VersionMajor
1
3212
msiexec.exe
write
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Products\76396891177255849A58A7A8FFF3A29F\InstallProperties
VersionMinor
3
3212
msiexec.exe
write
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Products\76396891177255849A58A7A8FFF3A29F\InstallProperties
WindowsInstaller
1
3212
msiexec.exe
write
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Products\76396891177255849A58A7A8FFF3A29F\InstallProperties
Version
16973824
3212
msiexec.exe
write
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Products\76396891177255849A58A7A8FFF3A29F\InstallProperties
Language
0
3212
msiexec.exe
write
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{19869367-2771-4855-A985-7A8AFF3F2AF9}
AuthorizedCDFPrefix
3212
msiexec.exe
write
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{19869367-2771-4855-A985-7A8AFF3F2AF9}
Comments
3212
msiexec.exe
write
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{19869367-2771-4855-A985-7A8AFF3F2AF9}
Contact
3212
msiexec.exe
write
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{19869367-2771-4855-A985-7A8AFF3F2AF9}
DisplayVersion
1.3.0.28
3212
msiexec.exe
write
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{19869367-2771-4855-A985-7A8AFF3F2AF9}
HelpLink
3212
msiexec.exe
write
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{19869367-2771-4855-A985-7A8AFF3F2AF9}
HelpTelephone
3212
msiexec.exe
write
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{19869367-2771-4855-A985-7A8AFF3F2AF9}
InstallDate
20181206
3212
msiexec.exe
write
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{19869367-2771-4855-A985-7A8AFF3F2AF9}
InstallLocation
C:\Program Files\Ricoh\QuickProjection\
3212
msiexec.exe
write
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{19869367-2771-4855-A985-7A8AFF3F2AF9}
InstallSource
C:\Users\admin\AppData\Local\Temp\{BD343DB5-63FC-43A3-82C1-0D442A34B730}\
3212
msiexec.exe
write
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{19869367-2771-4855-A985-7A8AFF3F2AF9}
ModifyPath
MsiExec.exe /I{19869367-2771-4855-A985-7A8AFF3F2AF9}
3212
msiexec.exe
write
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{19869367-2771-4855-A985-7A8AFF3F2AF9}
Publisher
Ricoh
3212
msiexec.exe
write
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{19869367-2771-4855-A985-7A8AFF3F2AF9}
Readme
3212
msiexec.exe
write
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{19869367-2771-4855-A985-7A8AFF3F2AF9}
Size
3212
msiexec.exe
write
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{19869367-2771-4855-A985-7A8AFF3F2AF9}
EstimatedSize
7672
3212
msiexec.exe
write
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{19869367-2771-4855-A985-7A8AFF3F2AF9}
UninstallString
MsiExec.exe /I{19869367-2771-4855-A985-7A8AFF3F2AF9}
3212
msiexec.exe
write
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{19869367-2771-4855-A985-7A8AFF3F2AF9}
URLInfoAbout
http://www.Ricoh.com
3212
msiexec.exe
write
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{19869367-2771-4855-A985-7A8AFF3F2AF9}
URLUpdateInfo
3212
msiexec.exe
write
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{19869367-2771-4855-A985-7A8AFF3F2AF9}
VersionMajor
1
3212
msiexec.exe
write
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{19869367-2771-4855-A985-7A8AFF3F2AF9}
VersionMinor
3
3212
msiexec.exe
write
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{19869367-2771-4855-A985-7A8AFF3F2AF9}
WindowsInstaller
1
3212
msiexec.exe
write
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{19869367-2771-4855-A985-7A8AFF3F2AF9}
Version
16973824
3212
msiexec.exe
write
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{19869367-2771-4855-A985-7A8AFF3F2AF9}
Language
0
3212
msiexec.exe
write
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UpgradeCodes\08D8DF0D7A09CD2418716B4FF4034742
76396891177255849A58A7A8FFF3A29F
3212
msiexec.exe
write
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Products\76396891177255849A58A7A8FFF3A29F\InstallProperties
DisplayName
RICOH QuickProjection
3212
msiexec.exe
write
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{19869367-2771-4855-A985-7A8AFF3F2AF9}
DisplayName
RICOH QuickProjection
3212
msiexec.exe
write
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Installer\Features\76396891177255849A58A7A8FFF3A29F
QPApp_Files
3212
msiexec.exe
write
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Products\76396891177255849A58A7A8FFF3A29F\Features
QPApp_Files
^yq?yBxTG9Vj$Yv~5f_lctG!*7ldv88hb7,5(*qhE]yzAJ'pU9(`&@3Mm6_B
3212
msiexec.exe
write
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Products\76396891177255849A58A7A8FFF3A29F\Patches
AllPatches
3212
msiexec.exe
write
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Installer\Products\76396891177255849A58A7A8FFF3A29F
ProductName
RICOH QuickProjection
3212
msiexec.exe
write
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Installer\Products\76396891177255849A58A7A8FFF3A29F
PackageCode
8F1A5BCC627110D4DAF23D810653EB3D
3212
msiexec.exe
write
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Installer\Products\76396891177255849A58A7A8FFF3A29F
Language
0
3212
msiexec.exe
write
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Installer\Products\76396891177255849A58A7A8FFF3A29F
Version
16973824
3212
msiexec.exe
write
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Installer\Products\76396891177255849A58A7A8FFF3A29F
Transforms
C:\Windows\Installer\{19869367-2771-4855-A985-7A8AFF3F2AF9}\1033.MST
3212
msiexec.exe
write
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Installer\Products\76396891177255849A58A7A8FFF3A29F
Assignment
1
3212
msiexec.exe
write
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Installer\Products\76396891177255849A58A7A8FFF3A29F
AdvertiseFlags
388
3212
msiexec.exe
write
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Installer\Products\76396891177255849A58A7A8FFF3A29F
ProductIcon
C:\Windows\Installer\{19869367-2771-4855-A985-7A8AFF3F2AF9}\ARPPRODUCTICON.exe
3212
msiexec.exe
write
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Installer\Products\76396891177255849A58A7A8FFF3A29F
InstanceType
0
3212
msiexec.exe
write
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Installer\Products\76396891177255849A58A7A8FFF3A29F
AuthorizedLUAApp
0
3212
msiexec.exe
write
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Installer\Products\76396891177255849A58A7A8FFF3A29F
DeploymentFlags
2
3212
msiexec.exe
write
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Installer\UpgradeCodes\08D8DF0D7A09CD2418716B4FF4034742
76396891177255849A58A7A8FFF3A29F
3212
msiexec.exe
write
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Installer\Products\76396891177255849A58A7A8FFF3A29F\SourceList
PackageName
RICOH QuickProjection.msi
3212
msiexec.exe
write
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Installer\Products\76396891177255849A58A7A8FFF3A29F\SourceList\Net
1
C:\Users\admin\AppData\Local\Temp\{BD343DB5-63FC-43A3-82C1-0D442A34B730}\
3212
msiexec.exe
write
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Installer\Products\76396891177255849A58A7A8FFF3A29F\SourceList\Media
DiskPrompt
[1]
3212
msiexec.exe
write
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Installer\Products\76396891177255849A58A7A8FFF3A29F\SourceList\Media
1
DISK1;1
3212
msiexec.exe
write
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Installer\Products\76396891177255849A58A7A8FFF3A29F
Clients
:
3212
msiexec.exe
write
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Installer\Products\76396891177255849A58A7A8FFF3A29F\SourceList
LastUsedSource
n;1;C:\Users\admin\AppData\Local\Temp\{BD343DB5-63FC-43A3-82C1-0D442A34B730}\
3212
msiexec.exe
write
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\TempPackages
C:\Windows\Installer\256510.mst
0
3212
msiexec.exe
write
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\MUI\StringCacheSettings
StringCacheGeneration
96
3212
msiexec.exe
delete key
HKEY_USERS\.DEFAULT\Software\Classes\Local Settings\MuiCache\5F\52C64B7E
3212
msiexec.exe
delete key
HKEY_USERS\.DEFAULT\Software\Classes\Local Settings\MuiCache\5F
3212
msiexec.exe
delete key
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\Rollback\Scripts
3212
msiexec.exe
delete key
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\Rollback
3212
msiexec.exe
write
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\SystemRestore\Volatile
NestingLevel
0
3212
msiexec.exe
delete key
HKEY_USERS\S-1-5-21-1302019708-1500728564-335382590-1000\Software\Microsoft\RestartManager\Session0000
3212
msiexec.exe
delete key
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\InProgress
3212
msiexec.exe
delete key
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\TempPackages
2140
vssvc.exe
write
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\VSS\Diag\COM+ REGDB Writer
IDENTIFY (Enter)
400000000000000088A4266A668DD4015C0800005C0E0000E8030000010000000100000000000000000000000000000000000000000000000000000000000000
2140
vssvc.exe
write
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\VSS\Diag\Shadow Copy Optimization Writer
IDENTIFY (Enter)
400000000000000088A4266A668DD4015C080000440A0000E8030000010000000100000000000000000000000000000000000000000000000000000000000000
2140
vssvc.exe
write
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\VSS\Diag\ASR Writer
IDENTIFY (Enter)
400000000000000088A4266A668DD4015C080000740E0000E8030000010000000100000000000000000000000000000000000000000000000000000000000000
2140
vssvc.exe
write
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\VSS\Diag\Registry Writer
IDENTIFY (Enter)
400000000000000088A4266A668DD4015C080000400A0000E8030000010000000100000000000000000000000000000000000000000000000000000000000000
2140
vssvc.exe
write
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\VSS\Diag\COM+ REGDB Writer
IDENTIFY (Leave)
400000000000000096CB2D6A668DD4015C0800005C0E0000E8030000000000000100000000000000000000000000000000000000000000000000000000000000
2140
vssvc.exe
write
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\VSS\Diag\Registry Writer
IDENTIFY (Leave)
4000000000000000F02D306A668DD4015C080000400A0000E8030000000000000100000000000000000000000000000000000000000000000000000000000000
2140
vssvc.exe
write
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\VSS\Diag\ASR Writer
IDENTIFY (Leave)
40000000000000004A90326A668DD4015C080000740E0000E8030000000000000100000000000000000000000000000000000000000000000000000000000000
2140
vssvc.exe
write
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\VSS\Diag\Shadow Copy Optimization Writer
IDENTIFY (Leave)
4000000000000000FE54376A668DD4015C080000440A0000E8030000000000000100000000000000000000000000000000000000000000000000000000000000
2140
vssvc.exe
write
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\VSS\Diag\SwProvider_{b5946137-7b9f-4925-af80-51abd60b20d5}
PROVIDER_BEGINPREPARE (Enter)
4000000000000000246AC370668DD4015C080000440A000001040000010000000000000000000000403345210F1C374387E6E33A5F735D200000000000000000
2140
vssvc.exe
write
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\VSS\Diag\SwProvider_{b5946137-7b9f-4925-af80-51abd60b20d5}
PROVIDER_BEGINPREPARE (Leave)
4000000000000000246AC370668DD4015C080000440A000001040000000000000000000000000000403345210F1C374387E6E33A5F735D200000000000000000
2140
vssvc.exe
write
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\VSS\Diag\Shadow Copy Optimization Writer
PREPAREBACKUP (Enter)
4000000000000000D82EC870668DD4015C080000400A0000E9030000010000000100000000000000403345210F1C374387E6E33A5F735D200000000000000000
2140
vssvc.exe
write
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\VSS\Diag\COM+ REGDB Writer
PREPAREBACKUP (Enter)
4000000000000000D82EC870668DD4015C080000740E0000E9030000010000000100000000000000403345210F1C374387E6E33A5F735D200000000000000000
2140
vssvc.exe
write
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\VSS\Diag\Registry Writer
PREPAREBACKUP (Enter)
4000000000000000D82EC870668DD4015C080000440A0000E9030000010000000100000000000000403345210F1C374387E6E33A5F735D200000000000000000
2140
vssvc.exe
write
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\VSS\Diag\Shadow Copy Optimization Writer
PREPAREBACKUP (Leave)
40000000000000008CF3CC70668DD4015C080000400A0000E9030000000000000100000000000000403345210F1C374387E6E33A5F735D200000000000000000
2140
vssvc.exe
write
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\VSS\Diag\Shadow Copy Optimization Writer
VSS_WS_STABLE (SetCurrentState)
40000000000000008CF3CC70668DD4015C080000400A000001000000010000000100000000000000403345210F1C374387E6E33A5F735D200000000000000000
2140
vssvc.exe
write
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\VSS\Diag\Registry Writer
PREPAREBACKUP (Leave)
40000000000000008CF3CC70668DD4015C080000440A0000E9030000000000000100000000000000403345210F1C374387E6E33A5F735D200000000000000000
2140
vssvc.exe
write
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\VSS\Diag\Registry Writer
VSS_WS_STABLE (SetCurrentState)
40000000000000008CF3CC70668DD4015C080000440A000001000000010000000100000000000000403345210F1C374387E6E33A5F735D200000000000000000
2140
vssvc.exe
write
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\VSS\Diag\COM+ REGDB Writer
PREPAREBACKUP (Leave)
4000000000000000E655CF70668DD4015C080000740E0000E9030000000000000100000000000000403345210F1C374387E6E33A5F735D200000000000000000
2140
vssvc.exe
write
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\VSS\Diag\COM+ REGDB Writer
VSS_WS_STABLE (SetCurrentState)
4000000000000000E655CF70668DD4015C080000740E000001000000010000000100000000000000403345210F1C374387E6E33A5F735D200000000000000000
2140
vssvc.exe
write
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\VSS\Diag\Registry Writer
GETSTATE (Enter)
400000000000000010CBE470668DD4015C080000740E0000F9030000010000000100000000000000403345210F1C374387E6E33A5F735D200000000000000000
2140
vssvc.exe
write
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\VSS\Diag\Shadow Copy Optimization Writer
GETSTATE (Enter)
400000000000000010CBE470668DD4015C080000440A0000F9030000010000000100000000000000403345210F1C374387E6E33A5F735D200000000000000000
2140
vssvc.exe
write
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\VSS\Diag\COM+ REGDB Writer
GETSTATE (Enter)
400000000000000010CBE470668DD4015C080000400A0000F9030000010000000100000000000000403345210F1C374387E6E33A5F735D200000000000000000
2140
vssvc.exe
write
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\VSS\Diag\Shadow Copy Optimization Writer
GETSTATE (Leave)
400000000000000010CBE470668DD4015C080000440A0000F9030000000000000100000000000000403345210F1C374387E6E33A5F735D200000000000000000
2140
vssvc.exe
write
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\VSS\Diag\Registry Writer
GETSTATE (Leave)
400000000000000010CBE470668DD4015C080000740E0000F9030000000000000100000000000000403345210F1C374387E6E33A5F735D200000000000000000
2140
vssvc.exe
write
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\VSS\Diag\COM+ REGDB Writer
GETSTATE (Leave)
400000000000000010CBE470668DD4015C080000400A0000F9030000000000000100000000000000403345210F1C374387E6E33A5F735D200000000000000000
2140
vssvc.exe
write
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\VSS\Diag\SwProvider_{b5946137-7b9f-4925-af80-51abd60b20d5}
PROVIDER_ENDPREPARE (Enter)
40000000000000001EF2EB70668DD4015C080000D80B000002040000010000000000000000000000403345210F1C374387E6E33A5F735D200000000000000000
2140
vssvc.exe
write
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\VSS\Diag\SwProvider_{b5946137-7b9f-4925-af80-51abd60b20d5}
PROVIDER_ENDPREPARE (Leave)
4000000000000000B2276371668DD4015C080000D80B000002040000000000000000000000000000403345210F1C374387E6E33A5F735D200000000000000000
2140
vssvc.exe
write
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\VSS\Diag\VssvcPublisher
PREPARESNAPSHOT (Enter)
40000000000000000C8A6571668DD4015C080000D80B0000EA030000010000000000000000000000403345210F1C374387E6E33A5F735D200000000000000000
2140
vssvc.exe
write
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\VSS\Diag\COM+ REGDB Writer
PREPARESNAPSHOT (Enter)
400000000000000074136F71668DD4015C080000100B0000EA030000010000000100000000000000403345210F1C374387E6E33A5F735D200000000000000000
2140
vssvc.exe
write
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\VSS\Diag\Shadow Copy Optimization Writer
PREPARESNAPSHOT (Enter)
400000000000000074136F71668DD4015C080000240B0000EA030000010000000100000000000000403345210F1C374387E6E33A5F735D200000000000000000
2140
vssvc.exe
write
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\VSS\Diag\Registry Writer
PREPARESNAPSHOT (Enter)
400000000000000074136F71668DD4015C080000180B0000EA030000010000000100000000000000403345210F1C374387E6E33A5F735D200000000000000000
2140
vssvc.exe
write
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\VSS\Diag\Shadow Copy Optimization Writer
PREPARESNAPSHOT (Leave)
40000000000000006E9B9771668DD4015C080000240B0000EA030000000000000100000000000000403345210F1C374387E6E33A5F735D200000000000000000
2140
vssvc.exe
write
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\VSS\Diag\Shadow Copy Optimization Writer
VSS_WS_WAITING_FOR_FREEZE (SetCurrentState)
40000000000000006E9B9771668DD4015C080000240B000002000000010000000100000000000000403345210F1C374387E6E33A5F735D200000000000000000
2140
vssvc.exe
write
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\VSS\Diag\Registry Writer
PREPARESNAPSHOT (Leave)
4000000000000000C8FD9971668DD4015C080000180B0000EA030000000000000100000000000000403345210F1C374387E6E33A5F735D200000000000000000
2140
vssvc.exe
write
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\VSS\Diag\Registry Writer
VSS_WS_WAITING_FOR_FREEZE (SetCurrentState)
4000000000000000C8FD9971668DD4015C080000180B000002000000010000000100000000000000403345210F1C374387E6E33A5F735D200000000000000000
2140
vssvc.exe
write
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\VSS\Diag\COM+ REGDB Writer
PREPARESNAPSHOT (Leave)
4000000000000000C8FD9971668DD4015C080000100B0000EA030000000000000100000000000000403345210F1C374387E6E33A5F735D200000000000000000
2140
vssvc.exe
write
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\VSS\Diag\COM+ REGDB Writer
VSS_WS_WAITING_FOR_FREEZE (SetCurrentState)
4000000000000000C8FD9971668DD4015C080000100B000002000000010000000100000000000000403345210F1C374387E6E33A5F735D200000000000000000
2140
vssvc.exe
write
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\VSS\Diag\VssvcPublisher
PREPARESNAPSHOT (Leave)
4000000000000000D0ACC971668DD4015C080000D80B0000EA030000000000000000000000000000403345210F1C374387E6E33A5F735D200000000000000000
2140
vssvc.exe
write
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\VSS\Diag\VssvcPublisher
FREEZE (Enter)
4000000000000000D0ACC971668DD4015C080000D80B0000EB030000010000000000000000000000403345210F1C374387E6E33A5F735D200000000000000000
2140
vssvc.exe
write
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\VSS\Diag\VssvcPublisher
FREEZE_FRONT (Enter)
4000000000000000D0ACC971668DD4015C080000D80B0000EC030000010000000000000000000000403345210F1C374387E6E33A5F735D200000000000000000
2140
vssvc.exe
write
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\VSS\Diag\Shadow Copy Optimization Writer
FREEZE (Enter)
40000000000000002A0FCC71668DD4015C080000240B0000EB030000010000000200000000000000403345210F1C374387E6E33A5F735D200000000000000000
2140
vssvc.exe
write
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\VSS\Diag\Shadow Copy Optimization Writer
FREEZE (Leave)
40000000000000002A0FCC71668DD4015C080000240B0000EB030000000000000200000000000000403345210F1C374387E6E33A5F735D200000000000000000
2140
vssvc.exe
write
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\VSS\Diag\Shadow Copy Optimization Writer
VSS_WS_WAITING_FOR_THAW (SetCurrentState)
40000000000000002A0FCC71668DD4015C080000240B000003000000010000000200000000000000403345210F1C374387E6E33A5F735D200000000000000000
2140
vssvc.exe
write
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\VSS\Diag\Shadow Copy Optimization Writer
BKGND_FREEZE_THREAD (Enter)
40000000000000002A0FCC71668DD4015C080000480C0000FC030000010000000300000000000000403345210F1C374387E6E33A5F735D200000000000000000
2140
vssvc.exe
write
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\VSS\Diag\VssvcPublisher
FREEZE_FRONT (Leave)
40000000000000002A0FCC71668DD4015C080000D80B0000EC030000000000000000000000000000403345210F1C374387E6E33A5F735D200000000000000000
2140
vssvc.exe
write
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\VSS\Diag\VssvcPublisher
FREEZE_BACK (Enter)
40000000000000002A0FCC71668DD4015C080000D80B0000ED030000010000000000000000000000403345210F1C374387E6E33A5F735D200000000000000000
2140
vssvc.exe
write
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\VSS\Diag\VssvcPublisher
FREEZE_BACK (Leave)
4000000000000000DED3D071668DD4015C080000D80B0000ED030000000000000000000000000000403345210F1C374387E6E33A5F735D200000000000000000
2140
vssvc.exe
write
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\VSS\Diag\VssvcPublisher
FREEZE_SYSTEM (Enter)
4000000000000000DED3D071668DD4015C080000D80B0000EE030000010000000000000000000000403345210F1C374387E6E33A5F735D200000000000000000
2140
vssvc.exe
write
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\VSS\Diag\COM+ REGDB Writer
FREEZE (Enter)
40000000000000009298D571668DD4015C080000080B0000EB030000010000000200000000000000403345210F1C374387E6E33A5F735D200000000000000000
2140
vssvc.exe
write
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\VSS\Diag\COM+ REGDB Writer
FREEZE (Leave)
40000000000000009298D571668DD4015C080000080B0000EB030000000000000200000000000000403345210F1C374387E6E33A5F735D200000000000000000
2140
vssvc.exe
write
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\VSS\Diag\COM+ REGDB Writer
VSS_WS_WAITING_FOR_THAW (SetCurrentState)
40000000000000009298D571668DD4015C080000080B000003000000010000000200000000000000403345210F1C374387E6E33A5F735D200000000000000000
2140
vssvc.exe
write
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\VSS\Diag\COM+ REGDB Writer
BKGND_FREEZE_THREAD (Enter)
40000000000000009298D571668DD4015C080000600C0000FC030000010000000300000000000000403345210F1C374387E6E33A5F735D200000000000000000
2140
vssvc.exe
write
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\VSS\Diag\VssvcPublisher
FREEZE_SYSTEM (Leave)
4000000000000000ECFAD771668DD4015C080000D80B0000EE030000000000000000000000000000403345210F1C374387E6E33A5F735D200000000000000000
2140
vssvc.exe
write
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\VSS\Diag\VssvcPublisher
FREEZE_KTM (Enter)
4000000000000000ECFAD771668DD4015C080000D80B0000F0030000010000000000000000000000403345210F1C374387E6E33A5F735D200000000000000000
2140
vssvc.exe
write
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\VSS\Diag\VssvcPublisher
FREEZE_KTM (Leave)
4000000000000000ECFAD771668DD4015C080000D80B0000F0030000000000000000000000000000403345210F1C374387E6E33A5F735D200000000000000000
2140
vssvc.exe
write
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\VSS\Diag\VssvcPublisher
FREEZE_RM (Enter)
4000000000000000ECFAD771668DD4015C080000D80B0000EF030000010000000000000000000000403345210F1C374387E6E33A5F735D200000000000000000
2140
vssvc.exe
write
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\VSS\Diag\Registry Writer
FREEZE (Enter)
4000000000000000A0BFDC71668DD4015C080000100B0000EB030000010000000200000000000000403345210F1C374387E6E33A5F735D200000000000000000
2140
vssvc.exe
write
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\VSS\Diag\Registry Writer
FREEZE (Leave)
40000000000000005484E171668DD4015C080000100B0000EB030000000000000200000000000000403345210F1C374387E6E33A5F735D200000000000000000
2140
vssvc.exe
write
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\VSS\Diag\Registry Writer
VSS_WS_WAITING_FOR_THAW (SetCurrentState)
40000000000000005484E171668DD4015C080000100B000003000000010000000200000000000000403345210F1C374387E6E33A5F735D200000000000000000
2140
vssvc.exe
write
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\VSS\Diag\Registry Writer
BKGND_FREEZE_THREAD (Enter)
40000000000000005484E171668DD4015C080000C80D0000FC030000010000000300000000000000403345210F1C374387E6E33A5F735D200000000000000000
2140
vssvc.exe
write
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\VSS\Diag\VssvcPublisher
FREEZE_RM (Leave)
40000000000000005484E171668DD4015C080000D80B0000EF030000000000000000000000000000403345210F1C374387E6E33A5F735D200000000000000000
2140
vssvc.exe
write
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\VSS\Diag\VssvcPublisher
FREEZE (Leave)
40000000000000005484E171668DD4015C080000D80B0000EB030000000000000000000000000000403345210F1C374387E6E33A5F735D200000000000000000
2140
vssvc.exe
write
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\VSS\Diag\SwProvider_{b5946137-7b9f-4925-af80-51abd60b20d5}
PROVIDER_PRECOMMIT (Enter)
40000000000000005484E171668DD4015C080000D80B000003040000010000000000000000000000403345210F1C374387E6E33A5F735D200000000000000000
2140
vssvc.exe
write
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\VSS\Diag\SwProvider_{b5946137-7b9f-4925-af80-51abd60b20d5}
PROVIDER_PRECOMMIT (Leave)
40000000000000005484E171668DD4015C080000D80B000003040000000000000000000000000000403345210F1C374387E6E33A5F735D200000000000000000
2140
vssvc.exe
write
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\VSS\Diag\Lovelace
OPEN_VOLUME_HANDLE (Enter)
40000000000000005484E171668DD4015C080000D80B0000FD030000010000000000000000000000403345210F1C374387E6E33A5F735D200000000000000000
2140
vssvc.exe
write
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\VSS\Diag\Lovelace(__?_Volume{e1a82db4-a9f0-11e7-b142-806e6f6e6963}_)
OPEN_VOLUME_HANDLE (Enter)
40000000000000005484E171668DD4015C080000A80D0000FD030000010000000000000000000000403345210F1C374387E6E33A5F735D200000000000000000
2140
vssvc.exe
write
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\VSS\Diag\Lovelace(__?_Volume{e1a82db4-a9f0-11e7-b142-806e6f6e6963}_)
OPEN_VOLUME_HANDLE (Leave)
400000000000000070D2EF71668DD4015C080000A80D0000FD030000000000000000000000000000403345210F1C374387E6E33A5F735D200000000000000000
2140
vssvc.exe
write
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\VSS\Diag\Lovelace
OPEN_VOLUME_HANDLE (Leave)
400000000000000070D2EF71668DD4015C080000D80B0000FD030000000000000000000000000000403345210F1C374387E6E33A5F735D200000000000000000
2140
vssvc.exe
write
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\VSS\Diag\Lovelace(__?_Volume{e1a82db4-a9f0-11e7-b142-806e6f6e6963}_)
IOCTL_FLUSH_AND_HOLD (Enter)
400000000000000070D2EF71668DD4015C080000A80D0000FE030000010000000000000000000000403345210F1C374387E6E33A5F735D200000000000000000
2140
vssvc.exe
write
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\VSS\Diag\Lovelace(__?_Volume{e1a82db4-a9f0-11e7-b142-806e6f6e6963}_)
IOCTL_FLUSH_AND_HOLD (Leave)
40000000000000007EF9F671668DD4015C080000A80D0000FE030000000000000000000000000000403345210F1C374387E6E33A5F735D200000000000000000
2140
vssvc.exe
write
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\VSS\Diag\Lovelace(__?_Volume{e1a82db4-a9f0-11e7-b142-806e6f6e6963}_)
IOCTL_RELEASE (Enter)
40000000000000007EF9F671668DD4015C080000A80D0000FF030000010000000000000000000000403345210F1C374387E6E33A5F735D200000000000000000
2140
vssvc.exe
write
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\VSS\Diag\Lovelace(__?_Volume{e1a82db4-a9f0-11e7-b142-806e6f6e6963}_)
IOCTL_RELEASE (Leave)
40000000000000007EF9F671668DD4015C080000A80D0000FF030000000000000000000000000000403345210F1C374387E6E33A5F735D200000000000000000
2140
vssvc.exe
write
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\VSS\Diag\Lovelace
IOCTL_FLUSH_AND_HOLD (Enter)
400000000000000070D2EF71668DD4015C080000D80B0000FE030000010000000000000000000000403345210F1C374387E6E33A5F735D200000000000000000
2140
vssvc.exe
write
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\VSS\Diag\Lovelace
IOCTL_FLUSH_AND_HOLD (Leave)
40000000000000007EF9F671668DD4015C080000D80B0000FE030000000000000000000000000000403345210F1C374387E6E33A5F735D200000000000000000
2140
vssvc.exe
write
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\VSS\Diag\Lovelace
IOCTL_RELEASE (Enter)
40000000000000007EF9F671668DD4015C080000D80B0000FF030000010000000000000000000000000000000000000000000000000000000000000000000000
2140
vssvc.exe
write
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\VSS\Diag\Lovelace
IOCTL_RELEASE (Leave)
40000000000000007EF9F671668DD4015C080000D80B0000FF030000000000000000000000000000000000000000000000000000000000000000000000000000
2140
vssvc.exe
write
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\VSS\Diag\SwProvider_{b5946137-7b9f-4925-af80-51abd60b20d5}
PROVIDER_COMMIT (Enter)
40000000000000007EF9F671668DD4015C080000E00D000004040000010000000000000000000000403345210F1C374387E6E33A5F735D200000000000000000
2140
vssvc.exe
write
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\VSS\Diag\SwProvider_{b5946137-7b9f-4925-af80-51abd60b20d5}
PROVIDER_COMMIT (Leave)
40000000000000007EF9F671668DD4015C080000E00D000004040000000000000000000000000000403345210F1C374387E6E33A5F735D200000000000000000
2140
vssvc.exe
write
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\VSS\Diag\SwProvider_{b5946137-7b9f-4925-af80-51abd60b20d5}
PROVIDER_POSTCOMMIT (Enter)
40000000000000007EF9F671668DD4015C080000D80B000005040000010000000000000000000000403345210F1C374387E6E33A5F735D200000000000000000
2140
vssvc.exe
write
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\VSS\Diag\SwProvider_{b5946137-7b9f-4925-af80-51abd60b20d5}
PROVIDER_POSTCOMMIT (Leave)
40000000000000007EF9F671668DD4015C080000D80B000005040000000000000000000000000000403345210F1C374387E6E33A5F735D200000000000000000
2140
vssvc.exe
write
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\VSS\Diag\VssvcPublisher
THAW_KTM (Enter)
40000000000000007EF9F671668DD4015C080000D80B0000F4030000010000000000000000000000403345210F1C374387E6E33A5F735D200000000000000000
2140
vssvc.exe
write
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\VSS\Diag\VssvcPublisher
THAW_KTM (Leave)
40000000000000007EF9F671668DD4015C080000D80B0000F4030000000000000000000000000000403345210F1C374387E6E33A5F735D200000000000000000
2140
vssvc.exe
write
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\VSS\Diag\VssvcPublisher
THAW (Enter)
40000000000000007EF9F671668DD4015C080000D80B0000F2030000010000000000000000000000403345210F1C374387E6E33A5F735D200000000000000000
2140
vssvc.exe
write
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\VSS\Diag\COM+ REGDB Writer
THAW (Enter)
40000000000000008C20FE71668DD4015C080000240B0000F2030000010000000300000000000000403345210F1C374387E6E33A5F735D200000000000000000
2140
vssvc.exe
write
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\VSS\Diag\Shadow Copy Optimization Writer
THAW (Enter)
40000000000000008C20FE71668DD4015C080000080B0000F2030000010000000300000000000000403345210F1C374387E6E33A5F735D200000000000000000
2140
vssvc.exe
write
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\VSS\Diag\COM+ REGDB Writer
BKGND_FREEZE_THREAD (Leave)
40000000000000008C20FE71668DD4015C080000600C0000FC030000000000000300000000000000403345210F1C374387E6E33A5F735D200000000000000000
2140
vssvc.exe
write
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\VSS\Diag\Shadow Copy Optimization Writer
BKGND_FREEZE_THREAD (Leave)
40000000000000008C20FE71668DD4015C080000480C0000FC030000000000000300000000000000403345210F1C374387E6E33A5F735D200000000000000000
2140
vssvc.exe
write
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\VSS\Diag\COM+ REGDB Writer
THAW (Leave)
40000000000000008C20FE71668DD4015C080000240B0000F2030000000000000300000000000000403345210F1C374387E6E33A5F735D200000000000000000
2140
vssvc.exe
write
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\VSS\Diag\COM+ REGDB Writer
VSS_WS_WAITING_FOR_POST_SNAPSHOT (SetCurrentState)
40000000000000008C20FE71668DD4015C080000240B000004000000010000000300000000000000403345210F1C374387E6E33A5F735D200000000000000000
2140
vssvc.exe
write
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\VSS\Diag\Shadow Copy Optimization Writer
THAW (Leave)
40000000000000008C20FE71668DD4015C080000080B0000F2030000000000000300000000000000403345210F1C374387E6E33A5F735D200000000000000000
2140
vssvc.exe
write
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\VSS\Diag\Registry Writer
THAW (Enter)
40000000000000008C20FE71668DD4015C080000040B0000F2030000010000000300000000000000403345210F1C374387E6E33A5F735D200000000000000000
2140
vssvc.exe
write
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\VSS\Diag\Shadow Copy Optimization Writer
VSS_WS_WAITING_FOR_POST_SNAPSHOT (SetCurrentState)
40000000000000008C20FE71668DD4015C080000080B000004000000010000000300000000000000403345210F1C374387E6E33A5F735D200000000000000000
2140
vssvc.exe
write
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\VSS\Diag\Registry Writer
BKGND_FREEZE_THREAD (Leave)
40000000000000008C20FE71668DD4015C080000C80D0000FC030000000000000300000000000000403345210F1C374387E6E33A5F735D200000000000000000
2140
vssvc.exe
write
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\VSS\Diag\Registry Writer
THAW (Leave)
40000000000000008C20FE71668DD4015C080000040B0000F2030000000000000300000000000000403345210F1C374387E6E33A5F735D200000000000000000
2140
vssvc.exe
write
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\VSS\Diag\Registry Writer
VSS_WS_WAITING_FOR_POST_SNAPSHOT (SetCurrentState)
40000000000000008C20FE71668DD4015C080000040B000004000000010000000300000000000000403345210F1C374387E6E33A5F735D200000000000000000
2140
vssvc.exe
write
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\VSS\Diag\VssvcPublisher
THAW (Leave)
40000000000000008C20FE71668DD4015C080000D80B0000F2030000000000000000000000000000403345210F1C374387E6E33A5F735D200000000000000000
2140
vssvc.exe
write
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\VSS\Diag\SwProvider_{b5946137-7b9f-4925-af80-51abd60b20d5}
PROVIDER_PREFINALCOMMIT (Enter)
40000000000000008C20FE71668DD4015C080000D80B000006040000010000000000000000000000403345210F1C374387E6E33A5F735D200000000000000000
2140
vssvc.exe
write
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\VSS\Diag\SwProvider_{b5946137-7b9f-4925-af80-51abd60b20d5}
PROVIDER_PREFINALCOMMIT (Leave)
40000000000000000A803E72668DD4015C080000D80B000006040000000000000000000000000000403345210F1C374387E6E33A5F735D200000000000000000
2140
vssvc.exe
write
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\VSS\Diag\VssvcPublisher
POSTSNAPSHOT (Enter)
40000000000000000A803E72668DD4015C080000D80B0000F5030000010000000000000000000000403345210F1C374387E6E33A5F735D200000000000000000
2140
vssvc.exe
write
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\VSS\Diag\Shadow Copy Optimization Writer
POSTSNAPSHOT (Enter)
4000000000000000CC6B4A72668DD4015C080000180B0000F5030000010000000400000000000000403345210F1C374387E6E33A5F735D200000000000000000
2140
vssvc.exe
write
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\VSS\Diag\COM+ REGDB Writer
POSTSNAPSHOT (Enter)
4000000000000000CC6B4A72668DD4015C080000240B0000F5030000010000000400000000000000403345210F1C374387E6E33A5F735D200000000000000000
2140
vssvc.exe
write
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\VSS\Diag\Registry Writer
POSTSNAPSHOT (Enter)
4000000000000000CC6B4A72668DD4015C080000100B0000F5030000010000000400000000000000403345210F1C374387E6E33A5F735D200000000000000000
2140
vssvc.exe
write
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\VSS\Diag\Registry Writer
POSTSNAPSHOT (Leave)
4000000000000000CC6B4A72668DD4015C080000100B0000F5030000000000000400000000000000403345210F1C374387E6E33A5F735D200000000000000000
2140
vssvc.exe
write
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\VSS\Diag\Registry Writer
VSS_WS_WAITING_FOR_BACKUP_COMPLETE (SetCurrentState)
4000000000000000CC6B4A72668DD4015C080000100B000005000000010000000400000000000000403345210F1C374387E6E33A5F735D200000000000000000
2140
vssvc.exe
write
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\VSS\Diag\COM+ REGDB Writer
POSTSNAPSHOT (Leave)
4000000000000000CC6B4A72668DD4015C080000240B0000F5030000000000000400000000000000403345210F1C374387E6E33A5F735D200000000000000000
2140
vssvc.exe
write
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\VSS\Diag\COM+ REGDB Writer
VSS_WS_WAITING_FOR_BACKUP_COMPLETE (SetCurrentState)
4000000000000000CC6B4A72668DD4015C080000240B000005000000010000000400000000000000403345210F1C374387E6E33A5F735D200000000000000000
2140
vssvc.exe
write
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\VSS\Diag\Shadow Copy Optimization Writer
POSTSNAPSHOT (Leave)
4000000000000000228DCD72668DD4015C080000180B0000F5030000000000000400000000000000403345210F1C374387E6E33A5F735D200000000000000000
2140
vssvc.exe
write
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\VSS\Diag\Shadow Copy Optimization Writer
VSS_WS_WAITING_FOR_BACKUP_COMPLETE (SetCurrentState)
4000000000000000228DCD72668DD4015C080000180B000005000000010000000400000000000000403345210F1C374387E6E33A5F735D200000000000000000
2140
vssvc.exe
write
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\VSS\Diag\VssvcPublisher
POSTSNAPSHOT (Leave)
4000000000000000228DCD72668DD4015C080000D80B0000F5030000000000000000000000000000403345210F1C374387E6E33A5F735D200000000000000000
2140
vssvc.exe
write
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\VSS\Diag\SwProvider_{b5946137-7b9f-4925-af80-51abd60b20d5}
PROVIDER_POSTFINALCOMMIT (Enter)
4000000000000000228DCD72668DD4015C080000D80B000007040000010000000000000000000000403345210F1C374387E6E33A5F735D200000000000000000
2140
vssvc.exe
write
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\VSS\Diag\SwProvider_{b5946137-7b9f-4925-af80-51abd60b20d5}
PROVIDER_POSTFINALCOMMIT (Leave)
40000000000000000EEEEE72668DD4015C080000D80B000007040000000000000000000000000000403345210F1C374387E6E33A5F735D200000000000000000
2140
vssvc.exe
write
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\VSS\Diag\VssvcPublisher
BACKUPSHUTDOWN (Enter)
4000000000000000468A0B73668DD4015C080000D80B0000FB030000010000000000000000000000403345210F1C374387E6E33A5F735D200000000000000000
2140
vssvc.exe
write
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\VSS\Diag\Registry Writer
BACKUPSHUTDOWN (Enter)
4000000000000000A0EC0D73668DD4015C080000040B0000FB030000010000000500000000000000403345210F1C374387E6E33A5F735D200000000000000000
2140
vssvc.exe
write
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\VSS\Diag\COM+ REGDB Writer
BACKUPSHUTDOWN (Enter)
4000000000000000A0EC0D73668DD4015C080000080B0000FB030000010000000500000000000000403345210F1C374387E6E33A5F735D200000000000000000
2140
vssvc.exe
write
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\VSS\Diag\Registry Writer
BACKUPSHUTDOWN (Leave)
4000000000000000A0EC0D73668DD4015C080000040B0000FB030000000000000500000000000000403345210F1C374387E6E33A5F735D200000000000000000
2140
vssvc.exe
write
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\VSS\Diag\COM+ REGDB Writer
BACKUPSHUTDOWN (Leave)
4000000000000000A0EC0D73668DD4015C080000080B0000FB030000000000000500000000000000403345210F1C374387E6E33A5F735D200000000000000000
2140
vssvc.exe
write
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\VSS\Diag\Shadow Copy Optimization Writer
BACKUPSHUTDOWN (Enter)
4000000000000000A0EC0D73668DD4015C080000240B0000FB030000010000000500000000000000403345210F1C374387E6E33A5F735D200000000000000000
2140
vssvc.exe
write
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\VSS\Diag\Shadow Copy Optimization Writer
BACKUPSHUTDOWN (Leave)
4000000000000000A0EC0D73668DD4015C080000240B0000FB030000000000000500000000000000403345210F1C374387E6E33A5F735D200000000000000000
2140
vssvc.exe
write
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\VSS\Diag\VssvcPublisher
BACKUPSHUTDOWN (Leave)
4000000000000000A0EC0D73668DD4015C080000D80B0000FB030000000000000000000000000000403345210F1C374387E6E33A5F735D200000000000000000
3096
DrvInst.exe
write
HKEY_USERS\.DEFAULT\Software\Classes\Local Settings\MuiCache\5F\52C64B7E
LanguageList
en-US

Files activity

Executable files
10
Suspicious files
12
Text files
414
Unknown types
2

Dropped files

PID Process Filename Type
3760 sfx.exe C:\Users\admin\Desktop\204635\setup.exe executable
3212 msiexec.exe C:\Windows\Installer\{19869367-2771-4855-A985-7A8AFF3F2AF9}\QuickProjection.ex_F9E1CC139A4842EAB3ED3AEB78FC555C.exe executable
3212 msiexec.exe C:\Windows\Installer\{19869367-2771-4855-A985-7A8AFF3F2AF9}\QuickProjection.ex_7A5641CDFCA0401BA0BE45A902DC5294.exe executable
3212 msiexec.exe C:\Windows\Installer\{19869367-2771-4855-A985-7A8AFF3F2AF9}\ARPPRODUCTICON.exe executable
3212 msiexec.exe C:\Program Files\Ricoh\QuickProjection\DeleteSettingFiles.exe executable
3212 msiexec.exe C:\Program Files\Ricoh\QuickProjection\QuickProjection.exe executable
3212 msiexec.exe C:\Program Files\Ricoh\QuickProjection\AdhocSettingService.exe executable
3212 msiexec.exe C:\Windows\Installer\25650f.msi executable
3824 setup.exe C:\Users\admin\AppData\Local\Temp\{BD343DB5-63FC-43A3-82C1-0D442A34B730}\RICOH QuickProjection.msi executable
3212 msiexec.exe C:\Windows\Installer\256513.msi executable
2308 QuickProjection.exe C:\Users\admin\AppData\Local\Temp\cabFEF0.tmp ––
2308 QuickProjection.exe C:\Users\admin\AppData\Roaming\Ricoh\QuickProjection\log\20181206132103268.cab compressed
2308 QuickProjection.exe C:\Users\admin\AppData\Local\Temp\cabFEEF.tmp ––
2308 QuickProjection.exe C:\Users\admin\AppData\Local\Temp\cabFEEE.tmp ––
2308 QuickProjection.exe C:\Users\admin\AppData\Local\Temp\cabFEED.tmp ––
2308 QuickProjection.exe C:\Users\admin\AppData\Roaming\Ricoh\QuickProjection\log\20181206132103268\app_20181206132103268.log ––
2308 QuickProjection.exe C:\Users\admin\AppData\Roaming\Ricoh\QuickProjection\help\zh\tr0300.html html
2308 QuickProjection.exe C:\Users\admin\AppData\Roaming\Ricoh\QuickProjection\help\zh\st0004.html html
2308 QuickProjection.exe C:\Users\admin\AppData\Roaming\Ricoh\QuickProjection\help\zh\st0007.html html
2308 QuickProjection.exe C:\Users\admin\AppData\Roaming\Ricoh\QuickProjection\help\zh\tr0200.html html
2308 QuickProjection.exe C:\Users\admin\AppData\Roaming\Ricoh\QuickProjection\help\zh\st0005.html html
2308 QuickProjection.exe C:\Users\admin\AppData\Roaming\Ricoh\QuickProjection\help\zh\tr0100.html html
2308 QuickProjection.exe C:\Users\admin\AppData\Roaming\Ricoh\QuickProjection\help\zh\st0003.html html
2308 QuickProjection.exe C:\Users\admin\AppData\Roaming\Ricoh\QuickProjection\help\zh\pj0003.html html
2308 QuickProjection.exe C:\Users\admin\AppData\Roaming\Ricoh\QuickProjection\help\zh\pj0000.html html
2308 QuickProjection.exe C:\Users\admin\AppData\Roaming\Ricoh\QuickProjection\help\zh\pj0001.html html
2308 QuickProjection.exe C:\Users\admin\AppData\Roaming\Ricoh\QuickProjection\help\zh\st0001.html html
2308 QuickProjection.exe C:\Users\admin\AppData\Roaming\Ricoh\QuickProjection\help\zh\pj0002.html html
2308 QuickProjection.exe C:\Users\admin\AppData\Roaming\Ricoh\QuickProjection\help\zh\img\X_Button.gif image
2308 QuickProjection.exe C:\Users\admin\AppData\Roaming\Ricoh\QuickProjection\help\zh\img\spacer.gif image
2308 QuickProjection.exe C:\Users\admin\AppData\Roaming\Ricoh\QuickProjection\help\zh\nwu_help.js text
2308 QuickProjection.exe C:\Users\admin\AppData\Roaming\Ricoh\QuickProjection\help\zh\index.html html
2308 QuickProjection.exe C:\Users\admin\AppData\Roaming\Ricoh\QuickProjection\help\zh\img\start.gif image
2308 QuickProjection.exe C:\Users\admin\AppData\Roaming\Ricoh\QuickProjection\help\zh\img\RefreshButton.gif image
2308 QuickProjection.exe C:\Users\admin\AppData\Roaming\Ricoh\QuickProjection\help\zh\img\Setting Screen Advanced.gif image
2308 QuickProjection.exe C:\Users\admin\AppData\Roaming\Ricoh\QuickProjection\help\zh\img\Setting Screen.gif image
2308 QuickProjection.exe C:\Users\admin\AppData\Roaming\Ricoh\QuickProjection\help\zh\img\Projection Screen (Play)_presentation.gif image
2308 QuickProjection.exe C:\Users\admin\AppData\Roaming\Ricoh\QuickProjection\help\zh\img\item_title_head.gif image
2308 QuickProjection.exe C:\Users\admin\AppData\Roaming\Ricoh\QuickProjection\help\zh\img\Projection Screen (Play).gif image
2308 QuickProjection.exe C:\Users\admin\AppData\Roaming\Ricoh\QuickProjection\help\zh\img\Minimization_Button.gif image
2308 QuickProjection.exe C:\Users\admin\AppData\Roaming\Ricoh\QuickProjection\help\zh\img\homemenuBG-r.gif image
2308 QuickProjection.exe C:\Users\admin\AppData\Roaming\Ricoh\QuickProjection\help\zh\img\homemenuBG.gif image
2308 QuickProjection.exe C:\Users\admin\AppData\Roaming\Ricoh\QuickProjection\help\zh\img\H2.gif image
2308 QuickProjection.exe C:\Users\admin\AppData\Roaming\Ricoh\QuickProjection\help\zh\img\homemenuBG-hover.gif image
2308 QuickProjection.exe C:\Users\admin\AppData\Roaming\Ricoh\QuickProjection\help\zh\img\ExitButton.gif image
2308 QuickProjection.exe C:\Users\admin\AppData\Roaming\Ricoh\QuickProjection\help\zh\img\item_name_head.gif image
2308 QuickProjection.exe C:\Users\admin\AppData\Roaming\Ricoh\QuickProjection\help\zh\img\help.gif image
2308 QuickProjection.exe C:\Users\admin\AppData\Roaming\Ricoh\QuickProjection\help\zh\img\DismissButton.gif image
2308 QuickProjection.exe C:\Users\admin\AppData\Roaming\Ricoh\QuickProjection\help\zh\img\Display_Change.gif image
2308 QuickProjection.exe C:\Users\admin\AppData\Roaming\Ricoh\QuickProjection\help\zh\img\control_panel.gif image
2308 QuickProjection.exe C:\Users\admin\AppData\Roaming\Ricoh\QuickProjection\help\zh\img\Connect Screen Infra_Selected.gif image
2308 QuickProjection.exe C:\Users\admin\AppData\Roaming\Ricoh\QuickProjection\help\zh\img\Connect Screen.gif image
2308 QuickProjection.exe C:\Users\admin\AppData\Roaming\Ricoh\QuickProjection\help\zh\img\Connect Screen_Inputed.gif image
2308 QuickProjection.exe C:\Users\admin\AppData\Roaming\Ricoh\QuickProjection\help\zh\img\Connect Screen Infra.gif image
2308 QuickProjection.exe C:\Users\admin\AppData\Roaming\Ricoh\QuickProjection\help\zh\copyright.html html
2308 QuickProjection.exe C:\Users\admin\AppData\Roaming\Ricoh\QuickProjection\help\zh\img\Broadcast_On.gif image
2308 QuickProjection.exe C:\Users\admin\AppData\Roaming\Ricoh\QuickProjection\help\zh\css\wim_menu.css text
2308 QuickProjection.exe C:\Users\admin\AppData\Roaming\Ricoh\QuickProjection\help\zh\css\wim_help.css text
2308 QuickProjection.exe C:\Users\admin\AppData\Roaming\Ricoh\QuickProjection\help\nl\tr0200.html html
2308 QuickProjection.exe C:\Users\admin\AppData\Roaming\Ricoh\QuickProjection\help\nl\tr0300.html html
2308 QuickProjection.exe C:\Users\admin\AppData\Roaming\Ricoh\QuickProjection\help\nl\st0007.html html
2308 QuickProjection.exe C:\Users\admin\AppData\Roaming\Ricoh\QuickProjection\help\nl\tr0100.html html
2308 QuickProjection.exe C:\Users\admin\AppData\Roaming\Ricoh\QuickProjection\help\nl\st0004.html html
2308 QuickProjection.exe C:\Users\admin\AppData\Roaming\Ricoh\QuickProjection\help\nl\st0003.html html
2308 QuickProjection.exe C:\Users\admin\AppData\Roaming\Ricoh\QuickProjection\help\nl\st0005.html html
2308 QuickProjection.exe C:\Users\admin\AppData\Roaming\Ricoh\QuickProjection\help\nl\st0001.html html
2308 QuickProjection.exe C:\Users\admin\AppData\Roaming\Ricoh\QuickProjection\help\nl\pj0001.html html
2308 QuickProjection.exe C:\Users\admin\AppData\Roaming\Ricoh\QuickProjection\help\nl\pj0002.html html