ProductSetup::ProductSetup: Begin product setup ProductSetup::InstUninstEntry: Begin install setup::TamperProtectionControl::TamperProtectionControl: Disabled tamper protection for component NTP setup::TamperProtectionControl::TamperProtectionControl: Disabled tamper protection for service Sophos Network Threat Protection setup::TamperProtectionControl::TamperProtectionControl: Disabled tamper protection for service sntp ProductSetup::InstUninstEntry: Show gui: false ProductSetup::InstUninstEntry: Existing product code: <none> ProductSetup::InstUninstEntry: Install from: C:\ProgramData\Sophos\AutoUpdate\Cache\decoded\ntp64 ProductSetup::InstUninstEntry: Install to: <default> === Verbose logging started: 7/21/2020 22:03:31 Build type: SHIP UNICODE 5.00.7601.00 Calling process: C:\ProgramData\Sophos\AutoUpdate\Cache\sophos_autoupdate1.dir\su-setup32.exe === MSI (c) (68:6C) [22:03:31:516]: Cloaking enabled. MSI (c) (68:6C) [22:03:31:516]: Attempting to enable all disabled privileges before calling Install on Server MSI (c) (68:6C) [22:03:31:516]: End dialog not enabled MSI (c) (68:6C) [22:03:31:516]: Original package ==> C:\ProgramData\Sophos\AutoUpdate\Cache\decoded\ntp64\Sophos Network Threat Protection.msi MSI (c) (68:6C) [22:03:31:516]: Package we're running from ==> C:\ProgramData\Sophos\AutoUpdate\Cache\decoded\ntp64\Sophos Network Threat Protection.msi MSI (c) (68:6C) [22:03:31:516]: Machine policy value 'DisableUserInstalls' is 0 MSI (c) (68:6C) [22:03:31:516]: APPCOMPAT: Compatibility mode property overrides found. MSI (c) (68:6C) [22:03:31:516]: APPCOMPAT: looking for appcompat database entry with ProductCode '{4B1F9009-CD85-43C0-BCBD-D491908D5A52}'. MSI (c) (68:6C) [22:03:31:516]: APPCOMPAT: no matching ProductCode found in database. MSI (c) (68:6C) [22:03:31:531]: MSCOREE not loaded loading copy from system32 MSI (c) (68:6C) [22:03:31:531]: APPCOMPAT: looking for appcompat database entry with ProductCode '{4B1F9009-CD85-43C0-BCBD-D491908D5A52}'. MSI (c) (68:6C) [22:03:31:531]: APPCOMPAT: no matching ProductCode found in database. MSI (c) (68:6C) [22:03:31:531]: Transforms are not secure. MSI (c) (68:6C) [22:03:31:531]: Note: 1: 2205 2: 3: Control MSI (c) (68:6C) [22:03:31:531]: PROPERTY CHANGE: Adding MsiLogFileLocation property. Its value is 'C:\windows\TEMP\Sophos Network Threat Protection Install Log 20200721 220331.txt'. MSI (c) (68:6C) [22:03:31:531]: No Command Line. MSI (c) (68:6C) [22:03:31:531]: PROPERTY CHANGE: Adding PackageCode property. Its value is '{33601027-BB79-4C6F-B891-2D4A958AED7F}'. MSI (c) (68:6C) [22:03:31:531]: Product Code passed to Engine.Initialize: '(none)' MSI (c) (68:6C) [22:03:31:531]: Product Code from property table before transforms: '{4B1F9009-CD85-43C0-BCBD-D491908D5A52}' MSI (c) (68:6C) [22:03:31:531]: Product Code from property table after transforms: '{4B1F9009-CD85-43C0-BCBD-D491908D5A52}' MSI (c) (68:6C) [22:03:31:531]: Product not registered: beginning first-time install MSI (c) (68:6C) [22:03:31:531]: PROPERTY CHANGE: Adding ProductState property. Its value is '-1'. MSI (c) (68:6C) [22:03:31:531]: Note: 1: 1402 2: HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer 3: 2 MSI (c) (68:6C) [22:03:31:531]: Entering CMsiConfigurationManager::SetLastUsedSource. MSI (c) (68:6C) [22:03:31:531]: User policy value 'SearchOrder' is 'nmu' MSI (c) (68:6C) [22:03:31:531]: Adding new sources is allowed. MSI (c) (68:6C) [22:03:31:531]: PROPERTY CHANGE: Adding PackagecodeChanging property. Its value is '1'. MSI (c) (68:6C) [22:03:31:531]: Package name extracted from package path: 'Sophos Network Threat Protection.msi' MSI (c) (68:6C) [22:03:31:531]: Package to be registered: 'Sophos Network Threat Protection.msi' MSI (c) (68:6C) [22:03:31:531]: Note: 1: 2262 2: AdminProperties 3: -2147287038 MSI (c) (68:6C) [22:03:31:531]: TRANSFORMS property is now: MSI (c) (68:6C) [22:03:31:531]: PROPERTY CHANGE: Adding VersionDatabase property. Its value is '405'. MSI (c) (68:6C) [22:03:31:531]: SHELL32::SHGetFolderPath returned: C:\windows\system32\config\systemprofile\AppData\Roaming MSI (c) (68:6C) [22:03:31:531]: SHELL32::SHGetFolderPath returned: C:\windows\system32\config\systemprofile\Favorites MSI (c) (68:6C) [22:03:31:531]: SHELL32::SHGetFolderPath returned: C:\windows\system32\config\systemprofile\AppData\Roaming\Microsoft\Windows\Network Shortcuts MSI (c) (68:6C) [22:03:31:531]: SHELL32::SHGetFolderPath returned: C:\windows\system32\config\systemprofile\Documents MSI (c) (68:6C) [22:03:31:531]: SHELL32::SHGetFolderPath returned: C:\windows\system32\config\systemprofile\AppData\Roaming\Microsoft\Windows\Printer Shortcuts MSI (c) (68:6C) [22:03:31:531]: SHELL32::SHGetFolderPath returned: C:\windows\system32\config\systemprofile\AppData\Roaming\Microsoft\Windows\Recent MSI (c) (68:6C) [22:03:31:531]: SHELL32::SHGetFolderPath returned: C:\windows\system32\config\systemprofile\AppData\Roaming\Microsoft\Windows\SendTo MSI (c) (68:6C) [22:03:31:531]: SHELL32::SHGetFolderPath returned: C:\windows\system32\config\systemprofile\AppData\Roaming\Microsoft\Windows\Templates MSI (c) (68:6C) [22:03:31:531]: SHELL32::SHGetFolderPath returned: C:\ProgramData MSI (c) (68:6C) [22:03:31:547]: SHELL32::SHGetFolderPath returned: C:\windows\system32\config\systemprofile\AppData\Local MSI (c) (68:6C) [22:03:31:547]: SHELL32::SHGetFolderPath returned: C:\windows\system32\config\systemprofile\Pictures MSI (c) (68:6C) [22:03:31:547]: SHELL32::SHGetFolderPath returned: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Administrative Tools MSI (c) (68:6C) [22:03:31:547]: SHELL32::SHGetFolderPath returned: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup MSI (c) (68:6C) [22:03:31:547]: SHELL32::SHGetFolderPath returned: C:\ProgramData\Microsoft\Windows\Start Menu\Programs MSI (c) (68:6C) [22:03:31:547]: SHELL32::SHGetFolderPath returned: C:\ProgramData\Microsoft\Windows\Start Menu MSI (c) (68:6C) [22:03:31:547]: SHELL32::SHGetFolderPath returned: C:\Users\Public\Desktop MSI (c) (68:6C) [22:03:31:547]: SHELL32::SHGetFolderPath returned: C:\windows\system32\config\systemprofile\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Administrative Tools MSI (c) (68:6C) [22:03:31:547]: SHELL32::SHGetFolderPath returned: C:\windows\system32\config\systemprofile\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup MSI (c) (68:6C) [22:03:31:547]: SHELL32::SHGetFolderPath returned: C:\windows\system32\config\systemprofile\AppData\Roaming\Microsoft\Windows\Start Menu\Programs MSI (c) (68:6C) [22:03:31:547]: SHELL32::SHGetFolderPath returned: C:\windows\system32\config\systemprofile\AppData\Roaming\Microsoft\Windows\Start Menu MSI (c) (68:6C) [22:03:31:547]: SHELL32::SHGetFolderPath returned: C:\windows\system32\config\systemprofile\Desktop MSI (c) (68:6C) [22:03:31:547]: SHELL32::SHGetFolderPath returned: C:\ProgramData\Microsoft\Windows\Templates MSI (c) (68:6C) [22:03:31:547]: SHELL32::SHGetFolderPath returned: C:\windows\Fonts MSI (c) (68:6C) [22:03:31:547]: Note: 1: 2898 2: MS Sans Serif 3: MS Sans Serif 4: 0 5: 16 MSI (c) (68:6C) [22:03:31:547]: MSI_LUA: Setting AdminUser property to 1 because this is the client or the user has already permitted elevation MSI (c) (68:6C) [22:03:31:547]: MSI_LUA: Setting MsiRunningElevated property to 1 because the install is already running elevated. MSI (c) (68:6C) [22:03:31:547]: PROPERTY CHANGE: Adding MsiRunningElevated property. Its value is '1'. MSI (c) (68:6C) [22:03:31:547]: PROPERTY CHANGE: Adding Privileged property. Its value is '1'. MSI (c) (68:6C) [22:03:31:547]: Note: 1: 1402 2: HKEY_CURRENT_USER\Software\Microsoft\MS Setup (ACME)\User Info 3: 2 MSI (c) (68:6C) [22:03:31:547]: PROPERTY CHANGE: Adding USERNAME property. Its value is 'Binzagr Co.'. MSI (c) (68:6C) [22:03:31:547]: Note: 1: 1402 2: HKEY_CURRENT_USER\Software\Microsoft\MS Setup (ACME)\User Info 3: 2 MSI (c) (68:6C) [22:03:31:547]: PROPERTY CHANGE: Adding COMPANYNAME property. Its value is 'Binzagr Co.'. MSI (c) (68:6C) [22:03:31:547]: PROPERTY CHANGE: Adding DATABASE property. Its value is 'C:\ProgramData\Sophos\AutoUpdate\Cache\decoded\ntp64\Sophos Network Threat Protection.msi'. MSI (c) (68:6C) [22:03:31:547]: PROPERTY CHANGE: Adding OriginalDatabase property. Its value is 'C:\ProgramData\Sophos\AutoUpdate\Cache\decoded\ntp64\Sophos Network Threat Protection.msi'. MSI (c) (68:6C) [22:03:31:547]: Machine policy value 'MsiDisableEmbeddedUI' is 0 MSI (c) (68:6C) [22:03:31:547]: EEUI - Disabling MsiEmbeddedUI due to existing external or embedded UI MSI (c) (68:6C) [22:03:31:547]: EEUI - Disabling MsiEmbeddedUI in quiet mode === Logging started: 7/21/2020 22:03:31 === MSI (c) (68:6C) [22:03:31:547]: Machine policy value 'DisableRollback' is 0 MSI (c) (68:6C) [22:03:31:547]: User policy value 'DisableRollback' is 0 MSI (c) (68:6C) [22:03:31:547]: PROPERTY CHANGE: Adding UILevel property. Its value is '2'. MSI (c) (68:6C) [22:03:31:547]: Creating MSIHANDLE (1) of type 790537 for thread 7532 MSI (c) (68:6C) [22:03:31:547]: MsiOpenPackageEx is returning 0 MSI (c) (68:6C) [22:03:31:547]: Closing MSIHANDLE (1) of type 790537 for thread 7532 === Verbose logging stopped: 7/21/2020 22:03:31 === setup::MsiInstaller::install: New version: {4B1F9009-CD85-43C0-BCBD-D491908D5A52}, version: 1.9.2373.0 setup::MsiInstaller::install: Performing clean install setup::MsiInstaller::cleanInstall: Running clean install setup::MsiInstaller::installOrUpgrade: Executing: C:\ProgramData\Sophos\AutoUpdate\Cache\decoded\ntp64\Sophos Network Threat Protection.msi INSTALLDIR="" REBOOT=ReallySuppress INSTALLINGVERSION="1.9.2373.0" ARPSYSTEMCOMPONENT=1 setup::MsiInstaller::tryRunMsi: Running MSI command, attempt (1 of 10) === Verbose logging started: 7/21/2020 22:03:31 Build type: SHIP UNICODE 5.00.7601.00 Calling process: C:\ProgramData\Sophos\AutoUpdate\Cache\sophos_autoupdate1.dir\su-setup32.exe === MSI (c) (68:C0) [22:03:31:563]: Resetting cached policy values MSI (c) (68:C0) [22:03:31:563]: Machine policy value 'Debug' is 0 MSI (c) (68:C0) [22:03:31:563]: ******* RunEngine: ******* Product: C:\ProgramData\Sophos\AutoUpdate\Cache\decoded\ntp64\Sophos Network Threat Protection.msi ******* Action: ******* CommandLine: ********** MSI (c) (68:C0) [22:03:31:563]: Client-side and UI is none or basic: Running entire install on the server. MSI (c) (68:C0) [22:03:31:563]: Grabbed execution mutex. MSI (c) (68:C0) [22:03:31:563]: Cloaking enabled. MSI (c) (68:C0) [22:03:31:563]: Attempting to enable all disabled privileges before calling Install on Server MSI (c) (68:C0) [22:03:31:563]: Incrementing counter to disable shutdown. Counter after increment: 0 MSI (s) (80:20) [22:03:31:578]: Running installation inside multi-package transaction C:\ProgramData\Sophos\AutoUpdate\Cache\decoded\ntp64\Sophos Network Threat Protection.msi MSI (s) (80:20) [22:03:31:578]: Grabbed execution mutex. MSI (s) (80:B0) [22:03:31:578]: Resetting cached policy values MSI (s) (80:B0) [22:03:31:578]: Machine policy value 'Debug' is 0 MSI (s) (80:B0) [22:03:31:578]: ******* RunEngine: ******* Product: C:\ProgramData\Sophos\AutoUpdate\Cache\decoded\ntp64\Sophos Network Threat Protection.msi ******* Action: ******* CommandLine: ********** MSI (s) (80:B0) [22:03:31:578]: Machine policy value 'DisableUserInstalls' is 0 MSI (s) (80:B0) [22:03:31:578]: Setting cached product context: machine assigned for product: 00005109090090400000000000F01FEC MSI (s) (80:B0) [22:03:31:578]: Using cached product context: machine assigned for product: 00005109090090400000000000F01FEC MSI (s) (80:B0) [22:03:31:578]: Setting cached product context: machine assigned for product: 00005109110000000000000000F01FEC MSI (s) (80:B0) [22:03:31:578]: Using cached product context: machine assigned for product: 00005109110000000000000000F01FEC MSI (s) (80:B0) [22:03:31:578]: Setting cached product context: machine assigned for product: 000051091A0090400000000000F01FEC MSI (s) (80:B0) [22:03:31:578]: Using cached product context: machine assigned for product: 000051091A0090400000000000F01FEC MSI (s) (80:B0) [22:03:31:578]: Setting cached product context: machine assigned for product: 000051091E0090400000000000F01FEC MSI (s) (80:B0) [22:03:31:578]: Using cached product context: machine assigned for product: 000051091E0090400000000000F01FEC MSI (s) (80:B0) [22:03:31:578]: Setting cached product context: machine assigned for product: 000051092E0090400000000000F01FEC MSI (s) (80:B0) [22:03:31:578]: Using cached product context: machine assigned for product: 000051092E0090400000000000F01FEC MSI (s) (80:B0) [22:03:31:578]: Setting cached product context: machine assigned for product: 00005109440090400000000000F01FEC MSI (s) (80:B0) [22:03:31:578]: Using cached product context: machine assigned for product: 00005109440090400000000000F01FEC MSI (s) (80:B0) [22:03:31:578]: Setting cached product context: machine assigned for product: 00005109510090400000000000F01FEC MSI (s) (80:B0) [22:03:31:578]: Using cached product context: machine assigned for product: 00005109510090400000000000F01FEC MSI (s) (80:B0) [22:03:31:578]: Setting cached product context: machine assigned for product: 00005109511090400000000000F01FEC MSI (s) (80:B0) [22:03:31:578]: Using cached product context: machine assigned for product: 00005109511090400000000000F01FEC MSI (s) (80:B0) [22:03:31:578]: Setting cached product context: machine assigned for product: 00005109610090400000000000F01FEC MSI (s) (80:B0) [22:03:31:578]: Using cached product context: machine assigned for product: 00005109610090400000000000F01FEC MSI (s) (80:B0) [22:03:31:578]: Setting cached product context: machine assigned for product: 00005109611090400100000000F01FEC MSI (s) (80:B0) [22:03:31:578]: Using cached product context: machine assigned for product: 00005109611090400100000000F01FEC MSI (s) (80:B0) [22:03:31:578]: Setting cached product context: machine assigned for product: 00005109711090400000000000F01FEC MSI (s) (80:B0) [22:03:31:578]: Using cached product context: machine assigned for product: 00005109711090400000000000F01FEC MSI (s) (80:B0) [22:03:31:578]: Setting cached product context: machine assigned for product: 00005109810090400000000000F01FEC MSI (s) (80:B0) [22:03:31:578]: Using cached product context: machine assigned for product: 00005109810090400000000000F01FEC MSI (s) (80:B0) [22:03:31:578]: Setting cached product context: machine assigned for product: 00005109910090400000000000F01FEC MSI (s) (80:B0) [22:03:31:578]: Using cached product context: machine assigned for product: 00005109910090400000000000F01FEC MSI (s) (80:B0) [22:03:31:578]: Setting cached product context: machine assigned for product: 00005109A10090400000000000F01FEC MSI (s) (80:B0) [22:03:31:578]: Using cached product context: machine assigned for product: 00005109A10090400000000000F01FEC MSI (s) (80:B0) [22:03:31:578]: Setting cached product context: machine assigned for product: 00005109A20000000100000000F01FEC MSI (s) (80:B0) [22:03:31:578]: Using cached product context: machine assigned for product: 00005109A20000000100000000F01FEC MSI (s) (80:B0) [22:03:31:578]: Setting cached product context: machine assigned for product: 00005109A20090400100000000F01FEC MSI (s) (80:B0) [22:03:31:578]: Using cached product context: machine assigned for product: 00005109A20090400100000000F01FEC MSI (s) (80:B0) [22:03:31:578]: Setting cached product context: machine assigned for product: 00005109AB0090400000000000F01FEC MSI (s) (80:B0) [22:03:31:578]: Using cached product context: machine assigned for product: 00005109AB0090400000000000F01FEC MSI (s) (80:B0) [22:03:31:578]: Setting cached product context: machine assigned for product: 00005109B10090400000000000F01FEC MSI (s) (80:B0) [22:03:31:578]: Using cached product context: machine assigned for product: 00005109B10090400000000000F01FEC MSI (s) (80:B0) [22:03:31:578]: Setting cached product context: machine assigned for product: 00005109B21090400000000000F01FEC MSI (s) (80:B0) [22:03:31:578]: Using cached product context: machine assigned for product: 00005109B21090400000000000F01FEC MSI (s) (80:B0) [22:03:31:578]: Setting cached product context: machine assigned for product: 00005109C20090400000000000F01FEC MSI (s) (80:B0) [22:03:31:578]: Using cached product context: machine assigned for product: 00005109C20090400000000000F01FEC MSI (s) (80:B0) [22:03:31:578]: Setting cached product context: machine assigned for product: 00005109E60090400000000000F01FEC MSI (s) (80:B0) [22:03:31:578]: Using cached product context: machine assigned for product: 00005109E60090400000000000F01FEC MSI (s) (80:B0) [22:03:31:578]: Setting cached product context: machine assigned for product: 00005109F10090400000000000F01FEC MSI (s) (80:B0) [22:03:31:578]: Using cached product context: machine assigned for product: 00005109F10090400000000000F01FEC MSI (s) (80:B0) [22:03:31:578]: Setting cached product context: machine assigned for product: 00005109F100A0C00000000000F01FEC MSI (s) (80:B0) [22:03:31:578]: Using cached product context: machine assigned for product: 00005109F100A0C00000000000F01FEC MSI (s) (80:B0) [22:03:31:578]: Setting cached product context: machine assigned for product: 00005109F100C0400000000000F01FEC MSI (s) (80:B0) [22:03:31:578]: Using cached product context: machine assigned for product: 00005109F100C0400000000000F01FEC MSI (s) (80:B0) [22:03:31:578]: Setting cached product context: machine assigned for product: 070C583262CE9BA478816E509C770CDE MSI (s) (80:B0) [22:03:31:578]: Using cached product context: machine assigned for product: 070C583262CE9BA478816E509C770CDE MSI (s) (80:B0) [22:03:31:578]: Setting cached product context: machine assigned for product: 12B8D03ED28D112328CCF0A0D541598E MSI (s) (80:B0) [22:03:31:578]: Using cached product context: machine assigned for product: 12B8D03ED28D112328CCF0A0D541598E MSI (s) (80:B0) [22:03:31:578]: Setting cached product context: machine assigned for product: 1926E8D15D0BCE53481466615F760A7F MSI (s) (80:B0) [22:03:31:578]: Using cached product context: machine assigned for product: 1926E8D15D0BCE53481466615F760A7F MSI (s) (80:B0) [22:03:31:578]: Setting cached product context: machine assigned for product: 19BF4688EE4961F41A44D0282A2340D9 MSI (s) (80:B0) [22:03:31:578]: Using cached product context: machine assigned for product: 19BF4688EE4961F41A44D0282A2340D9 MSI (s) (80:B0) [22:03:31:578]: Setting cached product context: machine assigned for product: 1A74565F7A4ED7140B675DDBCDFD7090 MSI (s) (80:B0) [22:03:31:578]: Using cached product context: machine assigned for product: 1A74565F7A4ED7140B675DDBCDFD7090 MSI (s) (80:B0) [22:03:31:578]: Setting cached product context: machine assigned for product: 1af2a8da7e60d0b429d7e6453b3d0182 MSI (s) (80:B0) [22:03:31:578]: Using cached product context: machine assigned for product: 1af2a8da7e60d0b429d7e6453b3d0182 MSI (s) (80:B0) [22:03:31:578]: Setting cached product context: machine assigned for product: 1D5E3C0FEDA1E123187686FED06E995A MSI (s) (80:B0) [22:03:31:578]: Using cached product context: machine assigned for product: 1D5E3C0FEDA1E123187686FED06E995A MSI (s) (80:B0) [22:03:31:578]: Setting cached product context: machine assigned for product: 2E60A197F0430B34F8BA261D15333926 MSI (s) (80:B0) [22:03:31:578]: Using cached product context: machine assigned for product: 2E60A197F0430B34F8BA261D15333926 MSI (s) (80:B0) [22:03:31:578]: Setting cached product context: machine assigned for product: 4393CA004B62E60408C76129CA3792CE MSI (s) (80:B0) [22:03:31:578]: Using cached product context: machine assigned for product: 4393CA004B62E60408C76129CA3792CE MSI (s) (80:B0) [22:03:31:578]: Setting cached product context: machine assigned for product: 44DB0475D85BA123FA0CD6D35465DDC6 MSI (s) (80:B0) [22:03:31:578]: Using cached product context: machine assigned for product: 44DB0475D85BA123FA0CD6D35465DDC6 MSI (s) (80:B0) [22:03:31:578]: Setting cached product context: machine assigned for product: 51DDCFE42A4298D4484A58D7B16FF88A MSI (s) (80:B0) [22:03:31:578]: Using cached product context: machine assigned for product: 51DDCFE42A4298D4484A58D7B16FF88A MSI (s) (80:B0) [22:03:31:578]: Setting cached product context: machine assigned for product: 5D0735ED53266CA4989D138E1B49A13E MSI (s) (80:B0) [22:03:31:578]: Using cached product context: machine assigned for product: 5D0735ED53266CA4989D138E1B49A13E MSI (s) (80:B0) [22:03:31:578]: Setting cached product context: machine assigned for product: 608BC8AE901C0074694B1F2F865E30C6 MSI (s) (80:B0) [22:03:31:578]: Using cached product context: machine assigned for product: 608BC8AE901C0074694B1F2F865E30C6 MSI (s) (80:B0) [22:03:31:578]: Setting cached product context: machine assigned for product: 6414876250E69FF3395387C6C7F05BEB MSI (s) (80:B0) [22:03:31:578]: Using cached product context: machine assigned for product: 6414876250E69FF3395387C6C7F05BEB MSI (s) (80:B0) [22:03:31:578]: Setting cached product context: machine assigned for product: 687A7CEC8C9A7FE4BB9556813E3B8C87 MSI (s) (80:B0) [22:03:31:578]: Using cached product context: machine assigned for product: 687A7CEC8C9A7FE4BB9556813E3B8C87 MSI (s) (80:B0) [22:03:31:578]: Setting cached product context: machine assigned for product: 68AB67CA7DA73301B744BA0000000010 MSI (s) (80:B0) [22:03:31:578]: Using cached product context: machine assigned for product: 68AB67CA7DA73301B744BA0000000010 MSI (s) (80:B0) [22:03:31:578]: Setting cached product context: machine assigned for product: 8520DAD7C5154DD39846DB1714990E7F MSI (s) (80:B0) [22:03:31:578]: Using cached product context: machine assigned for product: 8520DAD7C5154DD39846DB1714990E7F MSI (s) (80:B0) [22:03:31:578]: Setting cached product context: machine assigned for product: 8B592D0980ABE7849B40E02624904A01 MSI (s) (80:B0) [22:03:31:578]: Using cached product context: machine assigned for product: 8B592D0980ABE7849B40E02624904A01 MSI (s) (80:B0) [22:03:31:578]: Setting cached product context: machine assigned for product: 9B21398DF26A1FF47A9E70D7C4F40E20 MSI (s) (80:B0) [22:03:31:578]: Using cached product context: machine assigned for product: 9B21398DF26A1FF47A9E70D7C4F40E20 MSI (s) (80:B0) [22:03:31:578]: Setting cached product context: machine assigned for product: 9D87EB681A5696E4688F1C5F82F15835 MSI (s) (80:B0) [22:03:31:578]: Using cached product context: machine assigned for product: 9D87EB681A5696E4688F1C5F82F15835 MSI (s) (80:B0) [22:03:31:578]: Setting cached product context: machine assigned for product: B1F2A2BE2666E4449838BAB9E6D96F6A MSI (s) (80:B0) [22:03:31:578]: Using cached product context: machine assigned for product: B1F2A2BE2666E4449838BAB9E6D96F6A MSI (s) (80:B0) [22:03:31:578]: Setting cached product context: machine assigned for product: B7B81D081FD8ACB409F1EB8CB6EA7247 MSI (s) (80:B0) [22:03:31:578]: Using cached product context: machine assigned for product: B7B81D081FD8ACB409F1EB8CB6EA7247 MSI (s) (80:B0) [22:03:31:578]: Setting cached product context: machine assigned for product: C025571B2A687A53689168CD7369889B MSI (s) (80:B0) [22:03:31:578]: Using cached product context: machine assigned for product: C025571B2A687A53689168CD7369889B MSI (s) (80:B0) [22:03:31:578]: Setting cached product context: machine assigned for product: C21BB7D84586FD646AD78FD277D8578C MSI (s) (80:B0) [22:03:31:578]: Using cached product context: machine assigned for product: C21BB7D84586FD646AD78FD277D8578C MSI (s) (80:B0) [22:03:31:578]: Setting cached product context: machine assigned for product: C94587080FFC5C84B977B64AA84176D3 MSI (s) (80:B0) [22:03:31:578]: Using cached product context: machine assigned for product: C94587080FFC5C84B977B64AA84176D3 MSI (s) (80:B0) [22:03:31:578]: Setting cached product context: machine assigned for product: CE6380BC270BD863282B3D74B09F7570 MSI (s) (80:B0) [22:03:31:578]: Using cached product context: machine assigned for product: CE6380BC270BD863282B3D74B09F7570 MSI (s) (80:B0) [22:03:31:578]: Setting cached product context: machine assigned for product: D2821382915801943B93322048A0EB3F MSI (s) (80:B0) [22:03:31:578]: Using cached product context: machine assigned for product: D2821382915801943B93322048A0EB3F MSI (s) (80:B0) [22:03:31:578]: Setting cached product context: machine assigned for product: D7314F9862C648A4DB8BE2A5B47BE100 MSI (s) (80:B0) [22:03:31:578]: Using cached product context: machine assigned for product: D7314F9862C648A4DB8BE2A5B47BE100 MSI (s) (80:B0) [22:03:31:578]: Setting cached product context: machine assigned for product: DC8A59DBF9D1DA5389A1E3975220E6BB MSI (s) (80:B0) [22:03:31:578]: Using cached product context: machine assigned for product: DC8A59DBF9D1DA5389A1E3975220E6BB MSI (s) (80:B0) [22:03:31:578]: SRSetRestorePoint skipped for this transaction. MSI (s) (80:B0) [22:03:31:578]: Note: 1: 1402 2: HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer 3: 2 MSI (s) (80:B0) [22:03:31:594]: File will have security applied from OpCode. MSI (s) (80:B0) [22:03:31:594]: SOFTWARE RESTRICTION POLICY: Verifying package --> 'C:\ProgramData\Sophos\AutoUpdate\Cache\decoded\ntp64\Sophos Network Threat Protection.msi' against software restriction policy MSI (s) (80:B0) [22:03:31:594]: SOFTWARE RESTRICTION POLICY: C:\ProgramData\Sophos\AutoUpdate\Cache\decoded\ntp64\Sophos Network Threat Protection.msi has a digital signature MSI (s) (80:B0) [22:03:31:594]: SOFTWARE RESTRICTION POLICY: C:\ProgramData\Sophos\AutoUpdate\Cache\decoded\ntp64\Sophos Network Threat Protection.msi is permitted to run because the user token authorizes execution (system or service token). MSI (s) (80:B0) [22:03:31:594]: End dialog not enabled MSI (s) (80:B0) [22:03:31:594]: Original package ==> C:\ProgramData\Sophos\AutoUpdate\Cache\decoded\ntp64\Sophos Network Threat Protection.msi MSI (s) (80:B0) [22:03:31:594]: Package we're running from ==> C:\windows\Installer\6406dff.msi MSI (s) (80:B0) [22:03:31:594]: APPCOMPAT: Compatibility mode property overrides found. MSI (s) (80:B0) [22:03:31:594]: APPCOMPAT: looking for appcompat database entry with ProductCode '{4B1F9009-CD85-43C0-BCBD-D491908D5A52}'. MSI (s) (80:B0) [22:03:31:594]: APPCOMPAT: no matching ProductCode found in database. MSI (s) (80:B0) [22:03:31:594]: MSCOREE not loaded loading copy from system32 MSI (s) (80:B0) [22:03:31:609]: Machine policy value 'TransformsSecure' is 0 MSI (s) (80:B0) [22:03:31:609]: User policy value 'TransformsAtSource' is 0 MSI (s) (80:B0) [22:03:31:609]: Machine policy value 'DisablePatch' is 0 MSI (s) (80:B0) [22:03:31:609]: Machine policy value 'AllowLockdownPatch' is 0 MSI (s) (80:B0) [22:03:31:609]: Machine policy value 'DisableLUAPatching' is 0 MSI (s) (80:B0) [22:03:31:609]: Machine policy value 'DisableFlyWeightPatching' is 0 MSI (s) (80:B0) [22:03:31:609]: Enabling baseline caching for this transaction since all active patches are MSI 3.0 style MSPs or at least one MSI 3.0 minor update patch is active MSI (s) (80:B0) [22:03:31:609]: APPCOMPAT: looking for appcompat database entry with ProductCode '{4B1F9009-CD85-43C0-BCBD-D491908D5A52}'. MSI (s) (80:B0) [22:03:31:609]: APPCOMPAT: no matching ProductCode found in database. MSI (s) (80:B0) [22:03:31:609]: Transforms are not secure. MSI (s) (80:B0) [22:03:31:609]: Note: 1: 2205 2: 3: Control MSI (s) (80:B0) [22:03:31:609]: PROPERTY CHANGE: Adding MsiLogFileLocation property. Its value is 'C:\windows\TEMP\Sophos Network Threat Protection Install Log 20200721 220331.txt'. MSI (s) (80:B0) [22:03:31:609]: Command Line: INSTALLDIR= REBOOT=ReallySuppress INSTALLINGVERSION=1.9.2373.0 ARPSYSTEMCOMPONENT=1 CURRENTDIRECTORY=C:\windows\system32 CLIENTUILEVEL=3 MSICLIENTUSESEXTERNALUI=1 CLIENTPROCESSID=6504 MSI (s) (80:B0) [22:03:31:609]: PROPERTY CHANGE: Adding PackageCode property. Its value is '{33601027-BB79-4C6F-B891-2D4A958AED7F}'. MSI (s) (80:B0) [22:03:31:609]: Product Code passed to Engine.Initialize: '' MSI (s) (80:B0) [22:03:31:609]: Product Code from property table before transforms: '{4B1F9009-CD85-43C0-BCBD-D491908D5A52}' MSI (s) (80:B0) [22:03:31:609]: Product Code from property table after transforms: '{4B1F9009-CD85-43C0-BCBD-D491908D5A52}' MSI (s) (80:B0) [22:03:31:609]: Product not registered: beginning first-time install MSI (s) (80:B0) [22:03:31:609]: Product {4B1F9009-CD85-43C0-BCBD-D491908D5A52} is not managed. MSI (s) (80:B0) [22:03:31:609]: MSI_LUA: Credential prompt not required, user is an admin MSI (s) (80:B0) [22:03:31:609]: PROPERTY CHANGE: Adding ProductState property. Its value is '-1'. MSI (s) (80:B0) [22:03:31:609]: Entering CMsiConfigurationManager::SetLastUsedSource. MSI (s) (80:B0) [22:03:31:609]: User policy value 'SearchOrder' is 'nmu' MSI (s) (80:B0) [22:03:31:609]: Adding new sources is allowed. MSI (s) (80:B0) [22:03:31:609]: PROPERTY CHANGE: Adding PackagecodeChanging property. Its value is '1'. MSI (s) (80:B0) [22:03:31:609]: Package name extracted from package path: 'Sophos Network Threat Protection.msi' MSI (s) (80:B0) [22:03:31:609]: Package to be registered: 'Sophos Network Threat Protection.msi' MSI (s) (80:B0) [22:03:31:609]: Note: 1: 2262 2: AdminProperties 3: -2147287038 MSI (s) (80:B0) [22:03:31:609]: Machine policy value 'DisableMsi' is 0 MSI (s) (80:B0) [22:03:31:609]: Machine policy value 'AlwaysInstallElevated' is 1 MSI (s) (80:B0) [22:03:31:609]: User policy value 'AlwaysInstallElevated' is 0 MSI (s) (80:B0) [22:03:31:609]: Product installation will be elevated because user is admin and product is being installed per-machine. MSI (s) (80:B0) [22:03:31:609]: Running product '{4B1F9009-CD85-43C0-BCBD-D491908D5A52}' with elevated privileges: Product is assigned. MSI (s) (80:B0) [22:03:31:609]: PROPERTY CHANGE: Adding REBOOT property. Its value is 'ReallySuppress'. MSI (s) (80:B0) [22:03:31:609]: PROPERTY CHANGE: Adding INSTALLINGVERSION property. Its value is '1.9.2373.0'. MSI (s) (80:B0) [22:03:31:609]: PROPERTY CHANGE: Adding ARPSYSTEMCOMPONENT property. Its value is '1'. MSI (s) (80:B0) [22:03:31:609]: PROPERTY CHANGE: Adding CURRENTDIRECTORY property. Its value is 'C:\windows\system32'. MSI (s) (80:B0) [22:03:31:609]: PROPERTY CHANGE: Adding CLIENTUILEVEL property. Its value is '3'. MSI (s) (80:B0) [22:03:31:609]: PROPERTY CHANGE: Adding MSICLIENTUSESEXTERNALUI property. Its value is '1'. MSI (s) (80:B0) [22:03:31:609]: PROPERTY CHANGE: Adding CLIENTPROCESSID property. Its value is '6504'. MSI (s) (80:B0) [22:03:31:609]: Machine policy value 'DisableAutomaticApplicationShutdown' is 0 MSI (s) (80:B0) [22:03:31:609]: RESTART MANAGER: Disabled by MSIRESTARTMANAGERCONTROL property; Windows Installer will use the built-in FilesInUse functionality. MSI (s) (80:B0) [22:03:31:609]: TRANSFORMS property is now: MSI (s) (80:B0) [22:03:31:609]: PROPERTY CHANGE: Adding VersionDatabase property. Its value is '405'. MSI (s) (80:B0) [22:03:31:609]: SHELL32::SHGetFolderPath returned: C:\windows\system32\config\systemprofile\AppData\Roaming MSI (s) (80:B0) [22:03:31:609]: SHELL32::SHGetFolderPath returned: C:\windows\system32\config\systemprofile\Favorites MSI (s) (80:B0) [22:03:31:609]: SHELL32::SHGetFolderPath returned: C:\windows\system32\config\systemprofile\AppData\Roaming\Microsoft\Windows\Network Shortcuts MSI (s) (80:B0) [22:03:31:609]: SHELL32::SHGetFolderPath returned: C:\windows\system32\config\systemprofile\Documents MSI (s) (80:B0) [22:03:31:609]: SHELL32::SHGetFolderPath returned: C:\windows\system32\config\systemprofile\AppData\Roaming\Microsoft\Windows\Printer Shortcuts MSI (s) (80:B0) [22:03:31:609]: SHELL32::SHGetFolderPath returned: C:\windows\system32\config\systemprofile\AppData\Roaming\Microsoft\Windows\Recent MSI (s) (80:B0) [22:03:31:609]: SHELL32::SHGetFolderPath returned: C:\windows\system32\config\systemprofile\AppData\Roaming\Microsoft\Windows\SendTo MSI (s) (80:B0) [22:03:31:609]: SHELL32::SHGetFolderPath returned: C:\windows\system32\config\systemprofile\AppData\Roaming\Microsoft\Windows\Templates MSI (s) (80:B0) [22:03:31:609]: SHELL32::SHGetFolderPath returned: C:\ProgramData MSI (s) (80:B0) [22:03:31:609]: SHELL32::SHGetFolderPath returned: C:\windows\system32\config\systemprofile\AppData\Local MSI (s) (80:B0) [22:03:31:609]: SHELL32::SHGetFolderPath returned: C:\windows\system32\config\systemprofile\Pictures MSI (s) (80:B0) [22:03:31:609]: SHELL32::SHGetFolderPath returned: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Administrative Tools MSI (s) (80:B0) [22:03:31:609]: SHELL32::SHGetFolderPath returned: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup MSI (s) (80:B0) [22:03:31:609]: SHELL32::SHGetFolderPath returned: C:\ProgramData\Microsoft\Windows\Start Menu\Programs MSI (s) (80:B0) [22:03:31:609]: SHELL32::SHGetFolderPath returned: C:\ProgramData\Microsoft\Windows\Start Menu MSI (s) (80:B0) [22:03:31:625]: SHELL32::SHGetFolderPath returned: C:\Users\Public\Desktop MSI (s) (80:B0) [22:03:31:625]: SHELL32::SHGetFolderPath returned: C:\windows\system32\config\systemprofile\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Administrative Tools MSI (s) (80:B0) [22:03:31:625]: SHELL32::SHGetFolderPath returned: C:\windows\system32\config\systemprofile\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup MSI (s) (80:B0) [22:03:31:625]: SHELL32::SHGetFolderPath returned: C:\windows\system32\config\systemprofile\AppData\Roaming\Microsoft\Windows\Start Menu\Programs MSI (s) (80:B0) [22:03:31:625]: SHELL32::SHGetFolderPath returned: C:\windows\system32\config\systemprofile\AppData\Roaming\Microsoft\Windows\Start Menu MSI (s) (80:B0) [22:03:31:625]: SHELL32::SHGetFolderPath returned: C:\windows\system32\config\systemprofile\Desktop MSI (s) (80:B0) [22:03:31:625]: SHELL32::SHGetFolderPath returned: C:\ProgramData\Microsoft\Windows\Templates MSI (s) (80:B0) [22:03:31:625]: SHELL32::SHGetFolderPath returned: C:\windows\Fonts MSI (s) (80:B0) [22:03:31:625]: Note: 1: 2898 2: MS Sans Serif 3: MS Sans Serif 4: 0 5: 16 MSI (s) (80:B0) [22:03:31:625]: MSI_LUA: Setting MsiRunningElevated property to 1 because the install is already running elevated. MSI (s) (80:B0) [22:03:31:625]: PROPERTY CHANGE: Adding MsiRunningElevated property. Its value is '1'. MSI (s) (80:B0) [22:03:31:625]: PROPERTY CHANGE: Adding Privileged property. Its value is '1'. MSI (s) (80:B0) [22:03:31:625]: Note: 1: 1402 2: HKEY_CURRENT_USER\Software\Microsoft\MS Setup (ACME)\User Info 3: 2 MSI (s) (80:B0) [22:03:31:625]: PROPERTY CHANGE: Adding USERNAME property. Its value is 'Binzagr Co.'. MSI (s) (80:B0) [22:03:31:625]: Note: 1: 1402 2: HKEY_CURRENT_USER\Software\Microsoft\MS Setup (ACME)\User Info 3: 2 MSI (s) (80:B0) [22:03:31:625]: PROPERTY CHANGE: Adding COMPANYNAME property. Its value is 'Binzagr Co.'. MSI (s) (80:B0) [22:03:31:625]: PROPERTY CHANGE: Adding DATABASE property. Its value is 'C:\windows\Installer\6406dff.msi'. MSI (s) (80:B0) [22:03:31:625]: PROPERTY CHANGE: Adding OriginalDatabase property. Its value is 'C:\ProgramData\Sophos\AutoUpdate\Cache\decoded\ntp64\Sophos Network Threat Protection.msi'. MSI (s) (80:B0) [22:03:31:625]: Machine policy value 'MsiDisableEmbeddedUI' is 0 MSI (s) (80:B0) [22:03:31:625]: EEUI - Disabling MsiEmbeddedUI due to existing external or embedded UI MSI (s) (80:B0) [22:03:31:625]: EEUI - Disabling MsiEmbeddedUI for service because it's not a quiet/basic install MSI (s) (80:B0) [22:03:31:625]: Note: 1: 2205 2: 3: PatchPackage MSI (s) (80:B0) [22:03:31:625]: Machine policy value 'DisableRollback' is 0 MSI (s) (80:B0) [22:03:31:625]: User policy value 'DisableRollback' is 0 MSI (s) (80:B0) [22:03:31:625]: PROPERTY CHANGE: Adding UILevel property. Its value is '2'. === Logging started: 7/21/2020 22:03:31 === MSI (s) (80:B0) [22:03:31:625]: PROPERTY CHANGE: Adding ACTION property. Its value is 'INSTALL'. MSI (s) (80:B0) [22:03:31:625]: Doing action: INSTALL MSI (s) (80:B0) [22:03:31:625]: Note: 1: 2205 2: 3: ActionText Action start 22:03:31: INSTALL. MSI (s) (80:B0) [22:03:31:625]: Running ExecuteSequence MSI (s) (80:B0) [22:03:31:625]: Doing action: System64Folder_amd64_VC.05F0B5F5_44A8_3793_976B_A4F17AECF92C MSI (s) (80:B0) [22:03:31:625]: Note: 1: 2205 2: 3: ActionText MSI (s) (80:B0) [22:03:31:625]: PROPERTY CHANGE: Adding System64Folder_amd64_VC.05F0B5F5_44A8_3793_976B_A4F17AECF92C property. Its value is 'C:\windows\system32\'. Action start 22:03:31: System64Folder_amd64_VC.05F0B5F5_44A8_3793_976B_A4F17AECF92C. MSI (s) (80:B0) [22:03:31:625]: Doing action: SystemFolder_x86_VC.194841A2_D0F2_3B96_9F71_05BA91BEA0FA MSI (s) (80:B0) [22:03:31:625]: Note: 1: 2205 2: 3: ActionText Action ended 22:03:31: System64Folder_amd64_VC.05F0B5F5_44A8_3793_976B_A4F17AECF92C. Return value 1. MSI (s) (80:B0) [22:03:31:625]: PROPERTY CHANGE: Adding SystemFolder_x86_VC.194841A2_D0F2_3B96_9F71_05BA91BEA0FA property. Its value is 'C:\windows\SysWOW64\'. Action start 22:03:31: SystemFolder_x86_VC.194841A2_D0F2_3B96_9F71_05BA91BEA0FA. MSI (s) (80:B0) [22:03:31:625]: Doing action: FindRelatedProducts MSI (s) (80:B0) [22:03:31:625]: Note: 1: 2205 2: 3: ActionText Action ended 22:03:31: SystemFolder_x86_VC.194841A2_D0F2_3B96_9F71_05BA91BEA0FA. Return value 1. Action start 22:03:31: FindRelatedProducts. MSI (s) (80:B0) [22:03:31:625]: Doing action: AppSearch MSI (s) (80:B0) [22:03:31:625]: Note: 1: 2205 2: 3: ActionText Action ended 22:03:31: FindRelatedProducts. Return value 1. Action start 22:03:31: AppSearch. MSI (s) (80:B0) [22:03:31:641]: Note: 1: 2262 2: Signature 3: -2147287038 MSI (s) (80:B0) [22:03:31:641]: PROPERTY CHANGE: Adding INSTALLTYPE_IS_CENTRAL property. Its value is '#1'. MSI (s) (80:B0) [22:03:31:641]: Doing action: LaunchConditions MSI (s) (80:B0) [22:03:31:641]: Note: 1: 2205 2: 3: ActionText Action ended 22:03:31: AppSearch. Return value 1. Action start 22:03:31: LaunchConditions. MSI (s) (80:B0) [22:03:31:641]: Doing action: ValidateProductID MSI (s) (80:B0) [22:03:31:641]: Note: 1: 2205 2: 3: ActionText Action ended 22:03:31: LaunchConditions. Return value 1. Action start 22:03:31: ValidateProductID. MSI (s) (80:B0) [22:03:31:641]: Skipping action: TamperProtectionCheckRemove (condition is false) MSI (s) (80:B0) [22:03:31:641]: Doing action: CostInitialize MSI (s) (80:B0) [22:03:31:641]: Note: 1: 2205 2: 3: ActionText Action ended 22:03:31: ValidateProductID. Return value 1. MSI (s) (80:B0) [22:03:31:641]: Machine policy value 'MaxPatchCacheSize' is 10 MSI (s) (80:B0) [22:03:31:641]: Baseline: Sorting baselines for {4B1F9009-CD85-43C0-BCBD-D491908D5A52}. MSI (s) (80:B0) [22:03:31:641]: Baseline: New baseline 1.9.2373 from transaction. MSI (s) (80:B0) [22:03:31:641]: Baseline: Sorted order Native: Order 0. MSI (s) (80:B0) [22:03:31:641]: Baseline Data Table: MSI (s) (80:B0) [22:03:31:641]: ProductCode: {4B1F9009-CD85-43C0-BCBD-D491908D5A52} Version: 1.9.2373 Attributes: 0 PatchId: Native BaselineId: -2147483648 Order: 0 MSI (s) (80:B0) [22:03:31:641]: Baseline File Table: MSI (s) (80:B0) [22:03:31:641]: PROPERTY CHANGE: Adding ROOTDRIVE property. Its value is 'C:\'. MSI (s) (80:B0) [22:03:31:641]: PROPERTY CHANGE: Adding CostingComplete property. Its value is '0'. MSI (s) (80:B0) [22:03:31:641]: Note: 1: 2205 2: 3: Patch MSI (s) (80:B0) [22:03:31:641]: Note: 1: 2205 2: 3: PatchPackage MSI (s) (80:B0) [22:03:31:641]: Note: 1: 2205 2: 3: MsiPatchHeaders MSI (s) (80:B0) [22:03:31:641]: Note: 1: 2205 2: 3: __MsiPatchFileList MSI (s) (80:B0) [22:03:31:641]: Note: 1: 2205 2: 3: PatchPackage MSI (s) (80:B0) [22:03:31:641]: Note: 1: 2228 2: 3: PatchPackage 4: SELECT `DiskId`, `PatchId`, `LastSequence` FROM `Media`, `PatchPackage` WHERE `Media`.`DiskId`=`PatchPackage`.`Media_` ORDER BY `DiskId` MSI (s) (80:B0) [22:03:31:641]: Delta compression fallback method for this product transaction is 'MSI 2.0 legacy obsolescence' MSI (s) (80:B0) [22:03:31:641]: Note: 1: 2205 2: 3: Patch Action start 22:03:31: CostInitialize. MSI (s) (80:B0) [22:03:31:641]: Doing action: FileCost MSI (s) (80:B0) [22:03:31:641]: Note: 1: 2205 2: 3: ActionText Action ended 22:03:31: CostInitialize. Return value 1. MSI (s) (80:B0) [22:03:31:641]: Note: 1: 2205 2: 3: MsiAssembly MSI (s) (80:B0) [22:03:31:641]: Note: 1: 2205 2: 3: Class MSI (s) (80:B0) [22:03:31:641]: Note: 1: 2205 2: 3: Extension MSI (s) (80:B0) [22:03:31:641]: Note: 1: 2205 2: 3: TypeLib Action start 22:03:31: FileCost. MSI (s) (80:B0) [22:03:31:641]: Doing action: CostFinalize MSI (s) (80:B0) [22:03:31:641]: Note: 1: 2205 2: 3: ActionText Action ended 22:03:31: FileCost. Return value 1. MSI (s) (80:B0) [22:03:31:641]: PROPERTY CHANGE: Adding OutOfDiskSpace property. Its value is '0'. MSI (s) (80:B0) [22:03:31:641]: PROPERTY CHANGE: Adding OutOfNoRbDiskSpace property. Its value is '0'. MSI (s) (80:B0) [22:03:31:641]: PROPERTY CHANGE: Adding PrimaryVolumeSpaceAvailable property. Its value is '0'. MSI (s) (80:B0) [22:03:31:641]: PROPERTY CHANGE: Adding PrimaryVolumeSpaceRequired property. Its value is '0'. MSI (s) (80:B0) [22:03:31:641]: PROPERTY CHANGE: Adding PrimaryVolumeSpaceRemaining property. Its value is '0'. MSI (s) (80:B0) [22:03:31:641]: Note: 1: 2205 2: 3: Patch MSI (s) (80:B0) [22:03:31:641]: Note: 1: 2205 2: 3: Condition MSI (s) (80:B0) [22:03:31:641]: PROPERTY CHANGE: Adding TARGETDIR property. Its value is 'C:\'. MSI (s) (80:B0) [22:03:31:641]: PROPERTY CHANGE: Adding INSTALLDIR.4D96E9F9_7E7B_4556_8D25_ABEE814FE4E0 property. Its value is 'C:\'. MSI (s) (80:B0) [22:03:31:641]: PROPERTY CHANGE: Adding SophosAppData property. Its value is 'C:\ProgramData\Sophos\'. MSI (s) (80:B0) [22:03:31:641]: PROPERTY CHANGE: Adding HeartbeatData property. Its value is 'C:\ProgramData\Sophos\Heartbeat\'. MSI (s) (80:B0) [22:03:31:641]: PROPERTY CHANGE: Adding HeartbeatPersist property. Its value is 'C:\ProgramData\Sophos\Heartbeat\Persist\'. MSI (s) (80:B0) [22:03:31:641]: PROPERTY CHANGE: Adding HeartbeatLogs property. Its value is 'C:\ProgramData\Sophos\Heartbeat\Logs\'. MSI (s) (80:B0) [22:03:31:641]: PROPERTY CHANGE: Adding HeartbeatConfig property. Its value is 'C:\ProgramData\Sophos\Heartbeat\Config\'. MSI (s) (80:B0) [22:03:31:641]: PROPERTY CHANGE: Adding ProductData property. Its value is 'C:\ProgramData\Sophos\Sophos Network Threat Protection\'. MSI (s) (80:B0) [22:03:31:641]: PROPERTY CHANGE: Adding SnortData property. Its value is 'C:\ProgramData\Sophos\Sophos Network Threat Protection\IPS\'. MSI (s) (80:B0) [22:03:31:641]: PROPERTY CHANGE: Adding Logs property. Its value is 'C:\ProgramData\Sophos\Sophos Network Threat Protection\Logs\'. MSI (s) (80:B0) [22:03:31:641]: PROPERTY CHANGE: Adding Config property. Its value is 'C:\ProgramData\Sophos\Sophos Network Threat Protection\Config\'. MSI (s) (80:B0) [22:03:31:641]: PROPERTY CHANGE: Adding Status property. Its value is 'C:\ProgramData\Sophos\Sophos Network Threat Protection\Config\Status\'. MSI (s) (80:B0) [22:03:31:641]: PROPERTY CHANGE: Adding Sophos property. Its value is 'C:\Program Files\Sophos\'. MSI (s) (80:B0) [22:03:31:641]: PROPERTY CHANGE: Adding INSTALLDIR property. Its value is 'C:\Program Files\Sophos\Sophos Network Threat Protection\'. MSI (s) (80:B0) [22:03:31:641]: PROPERTY CHANGE: Adding SnortConfDir property. Its value is 'C:\Program Files\Sophos\Sophos Network Threat Protection\IPS Configuration\'. MSI (s) (80:B0) [22:03:31:641]: PROPERTY CHANGE: Adding SnortPreProcDir property. Its value is 'C:\Program Files\Sophos\Sophos Network Threat Protection\IPS Dynamic Preprocessors\'. MSI (s) (80:B0) [22:03:31:641]: PROPERTY CHANGE: Adding SnortDynModulesDir property. Its value is 'C:\Program Files\Sophos\Sophos Network Threat Protection\IPS Dynamic Modules\'. MSI (s) (80:B0) [22:03:31:641]: PROPERTY CHANGE: Adding plugins property. Its value is 'C:\Program Files\Sophos\Sophos Network Threat Protection\plugins\'. MSI (s) (80:B0) [22:03:31:641]: PROPERTY CHANGE: Adding SophosNTPLWFDir property. Its value is 'C:\Program Files\Sophos\Sophos Network Threat Protection\SophosNTPLWF\'. MSI (s) (80:B0) [22:03:31:641]: Target path resolution complete. Dumping Directory table... MSI (s) (80:B0) [22:03:31:641]: Note: target paths subject to change (via custom actions or browsing) MSI (s) (80:B0) [22:03:31:641]: Dir (target): Key: TARGETDIR , Object: C:\ MSI (s) (80:B0) [22:03:31:641]: Dir (target): Key: WindowsFolder , Object: C:\windows\ MSI (s) (80:B0) [22:03:31:641]: Dir (target): Key: System64Folder , Object: C:\windows\system32\ MSI (s) (80:B0) [22:03:31:641]: Dir (target): Key: System64Folder_amd64_VC.05F0B5F5_44A8_3793_976B_A4F17AECF92C , Object: C:\windows\system32\ MSI (s) (80:B0) [22:03:31:641]: Dir (target): Key: SystemFolder , Object: C:\windows\SysWOW64\ MSI (s) (80:B0) [22:03:31:641]: Dir (target): Key: SystemFolder_x86_VC.194841A2_D0F2_3B96_9F71_05BA91BEA0FA , Object: C:\windows\SysWOW64\ MSI (s) (80:B0) [22:03:31:641]: Dir (target): Key: INSTALLDIR.4D96E9F9_7E7B_4556_8D25_ABEE814FE4E0 , Object: C:\ MSI (s) (80:B0) [22:03:31:641]: Dir (target): Key: CommonAppDataFolder , Object: C:\ProgramData\ MSI (s) (80:B0) [22:03:31:641]: Dir (target): Key: SophosAppData , Object: C:\ProgramData\Sophos\ MSI (s) (80:B0) [22:03:31:641]: Dir (target): Key: HeartbeatData , Object: C:\ProgramData\Sophos\Heartbeat\ MSI (s) (80:B0) [22:03:31:641]: Dir (target): Key: HeartbeatPersist , Object: C:\ProgramData\Sophos\Heartbeat\Persist\ MSI (s) (80:B0) [22:03:31:641]: Dir (target): Key: HeartbeatLogs , Object: C:\ProgramData\Sophos\Heartbeat\Logs\ MSI (s) (80:B0) [22:03:31:641]: Dir (target): Key: HeartbeatConfig , Object: C:\ProgramData\Sophos\Heartbeat\Config\ MSI (s) (80:B0) [22:03:31:641]: Dir (target): Key: ProductData , Object: C:\ProgramData\Sophos\Sophos Network Threat Protection\ MSI (s) (80:B0) [22:03:31:641]: Dir (target): Key: SnortData , Object: C:\ProgramData\Sophos\Sophos Network Threat Protection\IPS\ MSI (s) (80:B0) [22:03:31:641]: Dir (target): Key: Logs , Object: C:\ProgramData\Sophos\Sophos Network Threat Protection\Logs\ MSI (s) (80:B0) [22:03:31:641]: Dir (target): Key: Config , Object: C:\ProgramData\Sophos\Sophos Network Threat Protection\Config\ MSI (s) (80:B0) [22:03:31:641]: Dir (target): Key: Status , Object: C:\ProgramData\Sophos\Sophos Network Threat Protection\Config\Status\ MSI (s) (80:B0) [22:03:31:641]: Dir (target): Key: ProgramFiles64Folder , Object: C:\Program Files\ MSI (s) (80:B0) [22:03:31:641]: Dir (target): Key: Sophos , Object: C:\Program Files\Sophos\ MSI (s) (80:B0) [22:03:31:641]: Dir (target): Key: INSTALLDIR , Object: C:\Program Files\Sophos\Sophos Network Threat Protection\ MSI (s) (80:B0) [22:03:31:641]: Dir (target): Key: SnortConfDir , Object: C:\Program Files\Sophos\Sophos Network Threat Protection\IPS Configuration\ MSI (s) (80:B0) [22:03:31:641]: Dir (target): Key: SnortPreProcDir , Object: C:\Program Files\Sophos\Sophos Network Threat Protection\IPS Dynamic Preprocessors\ MSI (s) (80:B0) [22:03:31:641]: Dir (target): Key: SnortDynModulesDir , Object: C:\Program Files\Sophos\Sophos Network Threat Protection\IPS Dynamic Modules\ MSI (s) (80:B0) [22:03:31:641]: Dir (target): Key: plugins , Object: C:\Program Files\Sophos\Sophos Network Threat Protection\plugins\ MSI (s) (80:B0) [22:03:31:641]: Dir (target): Key: SophosNTPLWFDir , Object: C:\Program Files\Sophos\Sophos Network Threat Protection\SophosNTPLWF\ MSI (s) (80:B0) [22:03:31:641]: PROPERTY CHANGE: Adding INSTALLLEVEL property. Its value is '1'. MSI (s) (80:B0) [22:03:31:641]: Note: 1: 2205 2: 3: MsiAssembly MSI (s) (80:B0) [22:03:31:641]: Note: 1: 2228 2: 3: MsiAssembly 4: SELECT `MsiAssembly`.`Attributes`, `MsiAssembly`.`File_Application`, `MsiAssembly`.`File_Manifest`, `Component`.`KeyPath` FROM `MsiAssembly`, `Component` WHERE `MsiAssembly`.`Component_` = `Component`.`Component` AND `MsiAssembly`.`Component_` = ? MSI (s) (80:B0) [22:03:31:641]: Disallowing installation of component: {14E8634F-8AEA-4CD1-AC48-BEBFDA18523A} since the same component with higher versioned keyfile exists MSI (s) (80:B0) [22:03:31:641]: Disallowing installation of component: {570C624B-D57C-4CD1-9013-1B80C800093B} since the same component with higher versioned keyfile exists MSI (s) (80:B0) [22:03:31:641]: Disallowing installation of component: {63B83B20-1AB9-4F49-B0B2-4489724CA96C} since the same component with higher versioned keyfile exists MSI (s) (80:B0) [22:03:31:656]: Disallowing installation of component: {74260D9F-D644-423B-B2D4-0291EA4BA8BE} since the same component with higher versioned keyfile exists MSI (s) (80:B0) [22:03:31:656]: Disallowing installation of component: {0835C947-D6D2-4E52-AF14-0231D04E88EA} since the same component with higher versioned keyfile exists Action start 22:03:31: CostFinalize. MSI (s) (80:B0) [22:03:31:656]: Doing action: MigrateFeatureStates MSI (s) (80:B0) [22:03:31:656]: Note: 1: 2205 2: 3: ActionText Action ended 22:03:31: CostFinalize. Return value 1. Action start 22:03:31: MigrateFeatureStates. MSI (s) (80:B0) [22:03:31:656]: Doing action: InstallValidate MSI (s) (80:B0) [22:03:31:656]: Note: 1: 2205 2: 3: ActionText Action ended 22:03:31: MigrateFeatureStates. Return value 0. MSI (s) (80:B0) [22:03:31:656]: Note: 1: 2205 2: 3: Dialog MSI (s) (80:B0) [22:03:31:656]: Feature: AllComponents; Installed: Absent; Request: Local; Action: Local MSI (s) (80:B0) [22:03:31:656]: Component: InstallationFolder; Installed: Absent; Request: Local; Action: Local; Client State: Unknown MSI (s) (80:B0) [22:03:31:656]: Component: ProductDataFolder; Installed: Absent; Request: Local; Action: Local; Client State: Unknown MSI (s) (80:B0) [22:03:31:656]: Component: ConfigDataFolder; Installed: Absent; Request: Local; Action: Local; Client State: Unknown MSI (s) (80:B0) [22:03:31:656]: Component: StatusFolder; Installed: Absent; Request: Local; Action: Local; Client State: Unknown MSI (s) (80:B0) [22:03:31:656]: Component: LogsDataFolder; Installed: Absent; Request: Local; Action: Local; Client State: Unknown MSI (s) (80:B0) [22:03:31:656]: Component: SnortDataFolder; Installed: Absent; Request: Local; Action: Local; Client State: Unknown MSI (s) (80:B0) [22:03:31:656]: Component: HeartbeatProductDataFolder; Installed: Absent; Request: Local; Action: Local; Client State: Unknown MSI (s) (80:B0) [22:03:31:656]: Component: HeartbeatConfigFolder; Installed: Absent; Request: Local; Action: Local; Client State: Unknown MSI (s) (80:B0) [22:03:31:656]: Component: HeartbeatLogsFolder; Installed: Absent; Request: Local; Action: Local; Client State: Unknown MSI (s) (80:B0) [22:03:31:656]: Component: HeartbeatPersistFolder; Installed: Absent; Request: Local; Action: Local; Client State: Unknown MSI (s) (80:B0) [22:03:31:656]: Component: Driver; Installed: Absent; Request: Local; Action: Local; Client State: Unknown MSI (s) (80:B0) [22:03:31:656]: Component: LWF; Installed: Absent; Request: Local; Action: Local; Client State: Unknown MSI (s) (80:B0) [22:03:31:656]: Component: navl.dll; Installed: Absent; Request: Local; Action: Local; Client State: Unknown MSI (s) (80:B0) [22:03:31:656]: Component: integrity.dat; Installed: Absent; Request: Local; Action: Local; Client State: Unknown MSI (s) (80:B0) [22:03:31:656]: Component: ProductInformation; Installed: Absent; Request: Local; Action: Local; Client State: Unknown MSI (s) (80:B0) [22:03:31:656]: Component: ServiceInstallWin8Plus; Installed: Absent; Request: Local; Action: Null; Client State: Unknown MSI (s) (80:B0) [22:03:31:656]: Component: ServiceInstallWin7Only; Installed: Absent; Request: Local; Action: Local; Client State: Unknown MSI (s) (80:B0) [22:03:31:656]: Component: ServiceCommon; Installed: Absent; Request: Local; Action: Local; Client State: Unknown MSI (s) (80:B0) [22:03:31:656]: Component: NTPAdapter; Installed: Absent; Request: Local; Action: Local; Client State: Unknown MSI (s) (80:B0) [22:03:31:656]: Component: Heartbeat.dll; Installed: Absent; Request: Local; Action: Local; Client State: Unknown MSI (s) (80:B0) [22:03:31:656]: Component: HeartbeatRegistry; Installed: Absent; Request: Local; Action: Local; Client State: Unknown MSI (s) (80:B0) [22:03:31:656]: Component: HeartbeatNativeRegistry; Installed: Absent; Request: Local; Action: Local; Client State: Unknown MSI (s) (80:B0) [22:03:31:656]: Component: Heartbeat.xml; Installed: Absent; Request: Local; Action: Local; Client State: Unknown MSI (s) (80:B0) [22:03:31:656]: Component: Notice.txt; Installed: Absent; Request: Local; Action: Local; Client State: Unknown MSI (s) (80:B0) [22:03:31:656]: Component: HealthApi; Installed: Absent; Request: Local; Action: Local; Client State: Unknown MSI (s) (80:B0) [22:03:31:656]: Component: HbtAdapter; Installed: Absent; Request: Local; Action: Local; Client State: Unknown MSI (s) (80:B0) [22:03:31:656]: Component: SspInterface; Installed: Absent; Request: Local; Action: Local; Client State: Unknown MSI (s) (80:B0) [22:03:31:656]: Component: Telemetry.exe; Installed: Absent; Request: Local; Action: Local; Client State: Unknown MSI (s) (80:B0) [22:03:31:656]: Component: TelemetryRegistry; Installed: Absent; Request: Local; Action: Local; Client State: Unknown MSI (s) (80:B0) [22:03:31:656]: Component: RemoveObsoleteAutoUpdateRegistration; Installed: Absent; Request: Local; Action: Local; Client State: Unknown MSI (s) (80:B0) [22:03:31:656]: Component: ScfDat; Installed: Absent; Request: Local; Action: Local; Client State: Unknown MSI (s) (80:B0) [22:03:31:656]: Component: SofDat; Installed: Absent; Request: Local; Action: Local; Client State: Unknown MSI (s) (80:B0) [22:03:31:656]: Component: C_CENTRAL_msvcr120_x86.194841A2_D0F2_3B96_9F71_05BA91BEA0FA; Installed: Absent; Request: Local; Action: Null; Client State: Unknown MSI (s) (80:B0) [22:03:31:656]: Component: C_CENTRAL_msvcp120_x86.194841A2_D0F2_3B96_9F71_05BA91BEA0FA; Installed: Absent; Request: Local; Action: Null; Client State: Unknown MSI (s) (80:B0) [22:03:31:656]: Component: C_CENTRAL_vccorlib120_x86.194841A2_D0F2_3B96_9F71_05BA91BEA0FA; Installed: Absent; Request: Local; Action: Null; Client State: Unknown MSI (s) (80:B0) [22:03:31:656]: Component: C_CENTRAL_msvcr120_x64.05F0B5F5_44A8_3793_976B_A4F17AECF92C; Installed: Absent; Request: Local; Action: Local; Client State: Unknown MSI (s) (80:B0) [22:03:31:656]: Component: C_CENTRAL_msvcp120_x64.05F0B5F5_44A8_3793_976B_A4F17AECF92C; Installed: Absent; Request: Local; Action: Null; Client State: Unknown MSI (s) (80:B0) [22:03:31:656]: Component: C_CENTRAL_vccorlib120_x64.05F0B5F5_44A8_3793_976B_A4F17AECF92C; Installed: Absent; Request: Local; Action: Null; Client State: Unknown MSI (s) (80:B0) [22:03:31:656]: Component: __ServiceCommon65; Installed: Null; Request: Local; Action: Local; Client State: Null MSI (s) (80:B0) [22:03:31:656]: Component: __TelemetryRegistry65; Installed: Null; Request: Local; Action: Local; Client State: Null MSI (s) (80:B0) [22:03:31:656]: Component: __ProductInformation65; Installed: Null; Request: Local; Action: Local; Client State: Null MSI (s) (80:B0) [22:03:31:656]: Component: __HeartbeatRegistry65; Installed: Null; Request: Local; Action: Local; Client State: Null MSI (s) (80:B0) [22:03:31:656]: Component: __HeartbeatNativeRegistry65; Installed: Null; Request: Local; Action: Local; Client State: Null MSI (s) (80:B0) [22:03:31:656]: Note: 1: 2205 2: 3: BindImage MSI (s) (80:B0) [22:03:31:656]: Note: 1: 2205 2: 3: ProgId MSI (s) (80:B0) [22:03:31:656]: Note: 1: 2205 2: 3: PublishComponent MSI (s) (80:B0) [22:03:31:656]: Note: 1: 2205 2: 3: SelfReg MSI (s) (80:B0) [22:03:31:656]: Note: 1: 2205 2: 3: Extension MSI (s) (80:B0) [22:03:31:656]: Note: 1: 2205 2: 3: Font MSI (s) (80:B0) [22:03:31:656]: Note: 1: 2205 2: 3: Shortcut MSI (s) (80:B0) [22:03:31:656]: Note: 1: 2205 2: 3: Class MSI (s) (80:B0) [22:03:31:656]: Note: 1: 2205 2: 3: TypeLib Action start 22:03:31: InstallValidate. MSI (s) (80:B0) [22:03:31:656]: Note: 1: 2205 2: 3: _RemoveFilePath MSI (s) (80:B0) [22:03:31:672]: PROPERTY CHANGE: Modifying CostingComplete property. Its current value is '0'. Its new value: '1'. MSI (s) (80:B0) [22:03:31:672]: Note: 1: 2205 2: 3: BindImage MSI (s) (80:B0) [22:03:31:672]: Note: 1: 2205 2: 3: ProgId MSI (s) (80:B0) [22:03:31:672]: Note: 1: 2205 2: 3: PublishComponent MSI (s) (80:B0) [22:03:31:672]: Note: 1: 2205 2: 3: SelfReg MSI (s) (80:B0) [22:03:31:672]: Note: 1: 2205 2: 3: Extension MSI (s) (80:B0) [22:03:31:672]: Note: 1: 2205 2: 3: Font MSI (s) (80:B0) [22:03:31:672]: Note: 1: 2205 2: 3: Shortcut MSI (s) (80:B0) [22:03:31:672]: Note: 1: 2205 2: 3: Class MSI (s) (80:B0) [22:03:31:672]: Note: 1: 2205 2: 3: TypeLib MSI (s) (80:B0) [22:03:31:672]: Note: 1: 2727 2: MSI (s) (80:B0) [22:03:31:687]: Note: 1: 2727 2: MSI (s) (80:B0) [22:03:31:687]: Doing action: RemoveExistingProducts MSI (s) (80:B0) [22:03:31:687]: Note: 1: 2205 2: 3: ActionText Action ended 22:03:31: InstallValidate. Return value 1. Action start 22:03:31: RemoveExistingProducts. MSI (s) (80:B0) [22:03:31:687]: Doing action: InstallInitialize MSI (s) (80:B0) [22:03:31:687]: Note: 1: 2205 2: 3: ActionText Action ended 22:03:31: RemoveExistingProducts. Return value 1. MSI (s) (80:B0) [22:03:31:687]: Machine policy value 'AlwaysInstallElevated' is 1 MSI (s) (80:B0) [22:03:31:687]: User policy value 'AlwaysInstallElevated' is 0 MSI (s) (80:B0) [22:03:31:687]: BeginTransaction: Locking Server MSI (s) (80:B0) [22:03:31:687]: SRSetRestorePoint skipped for this transaction. MSI (s) (80:B0) [22:03:31:687]: Server not locked: locking for product {4B1F9009-CD85-43C0-BCBD-D491908D5A52} Action start 22:03:31: InstallInitialize. MSI (s) (80:B0) [22:03:32:436]: Doing action: CheckMaxNumFilters MSI (s) (80:B0) [22:03:32:436]: Note: 1: 2205 2: 3: ActionText Action ended 22:03:32: InstallInitialize. Return value 1. MSI (s) (80:B0) [22:03:32:436]: Note: 1: 2205 2: 3: MsiPatchCertificate MSI (s) (80:B0) [22:03:32:436]: LUA patching is disabled: missing MsiPatchCertificate table MSI (s) (80:B0) [22:03:32:436]: Resolving source. MSI (s) (80:B0) [22:03:32:436]: Resolving source to launched-from source. MSI (s) (80:B0) [22:03:32:436]: Setting launched-from source as last-used. MSI (s) (80:B0) [22:03:32:436]: PROPERTY CHANGE: Adding SourceDir property. Its value is 'C:\ProgramData\Sophos\AutoUpdate\Cache\decoded\ntp64\'. MSI (s) (80:B0) [22:03:32:436]: PROPERTY CHANGE: Adding SOURCEDIR property. Its value is 'C:\ProgramData\Sophos\AutoUpdate\Cache\decoded\ntp64\'. MSI (s) (80:B0) [22:03:32:436]: PROPERTY CHANGE: Adding SourcedirProduct property. Its value is '{4B1F9009-CD85-43C0-BCBD-D491908D5A52}'. MSI (s) (80:B0) [22:03:32:436]: SOURCEDIR ==> C:\ProgramData\Sophos\AutoUpdate\Cache\decoded\ntp64\ MSI (s) (80:B0) [22:03:32:436]: SOURCEDIR product ==> {4B1F9009-CD85-43C0-BCBD-D491908D5A52} MSI (s) (80:B0) [22:03:32:436]: SECREPAIR: CryptAcquireContext succeeded MSI (s) (80:B0) [22:03:32:436]: Determining source type MSI (s) (80:B0) [22:03:32:436]: Source type from package 'Sophos Network Threat Protection.msi': 0 MSI (s) (80:B0) [22:03:32:436]: SECREPAIR: Hash Database: C:\windows\Installer\SourceHash{4B1F9009-CD85-43C0-BCBD-D491908D5A52} MSI (s) (80:B0) [22:03:32:436]: Note: 1: 2262 2: SourceHash 3: -2147287038 MSI (s) (80:B0) [22:03:32:530]: SECREPAIR: New Hash Database creation complete. MSI (s) (80:B0) [22:03:32:545]: SECREPAIR: Hash Value for the file:Sophos Network Threat Protection.msi is: CeEOPosOOO4Prszqtu0Ek2XhuvJ5q2Bkh1OieVB14zw= MSI (s) (80:B0) [22:03:32:561]: SECREPAIR: Hash Value for the file:Sophos\Sophos Network Threat Protection\Sntp.sys is: ccozYAQLMiFsS3xK1DRV/jB9V2T7WG5QEGwidzMsDdw= MSI (s) (80:B0) [22:03:32:561]: SECREPAIR: Hash Value for the file:Sophos\Sophos Network Threat Protection\SophosNTPLWF\SophosNTPLWF.sys is: bm4toGwwEqZ9hyhkM6qLYyeYJpPrzbgY94ZIqPR/+Iw= MSI (s) (80:B0) [22:03:32:623]: SECREPAIR: Hash Value for the file:Sophos\Sophos Network Threat Protection\navl.dll is: Kyc1afLCMfGU4IAk1a7/27uY96wXHCxrOKe6MEtCjHg= MSI (s) (80:B0) [22:03:32:623]: SECREPAIR: Hash Value for the file:Sophos\Sophos Network Threat Protection\integrity.dat is: icctKX3etti+iIM1gI+l/UbpYEt4vwQkMtdZz0MuUog= MSI (s) (80:B0) [22:03:32:655]: SECREPAIR: Hash Value for the file:Sophos\Sophos Network Threat Protection\SophosNtpService.exe is: cAEzJbSo20jnI3us60jJKK+lzQxbOhkkUFt6LtS9big= MSI (s) (80:B0) [22:03:32:686]: SECREPAIR: Hash Value for the file:Sophos\Sophos Network Threat Protection\SophosNtpService.exe is: cAEzJbSo20jnI3us60jJKK+lzQxbOhkkUFt6LtS9big= MSI (s) (80:B0) [22:03:32:686]: SECREPAIR: Hash Value for the file:Sophos\Sophos Network Threat Protection\NTPAdapter.dll is: RxjG+qo2oDs3ckSzjChYD78Qde67Iyc4UDdLjz/aKyA= MSI (s) (80:B0) [22:03:32:733]: SECREPAIR: Hash Value for the file:Sophos\Sophos Network Threat Protection\Heartbeat.dll is: uWkPY7ObxsKl22h3ECFjdpvTHmsa5jiEDVcNccHtVdg= MSI (s) (80:B0) [22:03:32:733]: SECREPAIR: Hash Value for the file:Sophos\Heartbeat\Config\Heartbeat.xml is: shh3Zis1kKba08xo73HxQMEJRnp3kJzZv0TiLSt92pg= MSI (s) (80:B0) [22:03:32:733]: SECREPAIR: Hash Value for the file:Sophos\Sophos Network Threat Protection\Notice.txt is: jIJwIN7VbhfeUB/yaU6aBo46AYREvPxxc/xFBOhyltw= MSI (s) (80:B0) [22:03:32:733]: SECREPAIR: Hash Value for the file:Sophos\Sophos Network Threat Protection\HealthApi.dll is: 5UcGH/Fwv2V5rWFPHTnZpzkvYkaefG74JFUWqOb+Uag= MSI (s) (80:B0) [22:03:32:748]: SECREPAIR: Hash Value for the file:Sophos\Sophos Network Threat Protection\HbtAdapter.dll is: i6fuu9tA49HQ4u0oZwwtMIQqbutS3KC578ol4FWt7lA= MSI (s) (80:B0) [22:03:32:748]: SECREPAIR: Hash Value for the file:Sophos\Sophos Network Threat Protection\BPAIF.dll is: c7lyVQvyNdgjWPqrjFvPx1VgxiY87cgJxwWeKUhw4+Q= MSI (s) (80:B0) [22:03:32:748]: SECREPAIR: Hash Value for the file:Sophos\Sophos Network Threat Protection\SophosNtpTelemetry.exe is: AIx08Q2uUt1c9qb86UUTWSfTXtjXYSqXunWK2kXA/8w= MSI (s) (80:B0) [22:03:32:748]: SECREPAIR: Hash Value for the file:Sophos\Sophos Network Threat Protection\scf.dat is: xBDFNO7XjEY3Fh/Mls9zjKQOOWgWJuFBMYiLS80Df1Q= MSI (s) (80:B0) [22:03:32:748]: SECREPAIR: Hash Value for the file:Sophos\Sophos Network Threat Protection\sof.dat is: WzGs74i63g1C4KKjS6LrqB2+bxvl7moJYioGCN/tXqQ= MSI (s) (80:B0) [22:03:32:748]: SECREPAIR: Hash Value for the file:Sophos\Sophos Network Threat Protection\Sntp.inf is: V4qyelG6ptxLB5sKvChTr96FWlqEhyWlKPHf2mt6Zxw= MSI (s) (80:B0) [22:03:32:748]: SECREPAIR: Hash Value for the file:Sophos\Sophos Network Threat Protection\Sntp.cat is: G2cgtPtxT00LZkXgsn1vIR6OfrrgOaippEFGI3LST5A= MSI (s) (80:B0) [22:03:32:748]: SECREPAIR: Hash Value for the file:Sophos\Sophos Network Threat Protection\Sntp.man is: QAzyouqgI0/miqnpfe4uPDJKS5ZTT0bFZ7b6RlwWCtw= MSI (s) (80:B0) [22:03:32:748]: SECREPAIR: Hash Value for the file:Sophos\Sophos Network Threat Protection\SophosNTPLWF\SophosNTPLWF.inf is: En+nxzXd7N1ZMBWn0TueqnezHn02ifF8S1g34pbjcsw= MSI (s) (80:B0) [22:03:32:748]: SECREPAIR: Hash Value for the file:Sophos\Sophos Network Threat Protection\SophosNTPLWF\SophosNTPLWF.cat is: snrpUtaJzGpBCGsPELggzMu/aGHSpI/WPmtHfQSKckA= MSI (s) (80:B0) [22:03:32:764]: SECREPAIR: Hash Value for the file:System\msvcr120.dll is: huObWZWvDgQvzaqF/irv18ndx61l5jJ71ecFi8OrYVw= MSI (s) (80:B0) [22:03:32:764]: SECREPAIR: Hash Value for the file:System\msvcp120.dll is: h8QsoVVHPk5xhX0DSXyMvCj6j/fyyNcuih85txB49gA= MSI (s) (80:B0) [22:03:32:764]: SECREPAIR: Hash Value for the file:System\vccorlib120.dll is: nJ1OQhxV9+9ORV51tYpmOUKMzXXHblcX9Eiv5MIcUrA= MSI (s) (80:B0) [22:03:32:764]: SECREPAIR: Hash Value for the file:System64\msvcr120.dll is: rTIkC7HeVcP1/KyHifWDoXBX+dFJFMU4wqelrTRrNBA= MSI (s) (80:B0) [22:03:32:779]: SECREPAIR: Hash Value for the file:System64\msvcp120.dll is: Kr8Kq1o8WulCS2Tp0Z2dbUrrxngU1+kuSSe5eY/vKEA= MSI (s) (80:B0) [22:03:32:779]: SECREPAIR: Hash Value for the file:System64\vccorlib120.dll is: YCrdd8vYB9AjBt4dAXnLcakI7ssRZ3EW/CBqfnFKttg= Action start 22:03:32: CheckMaxNumFilters. MSI (s) (80:B0) [22:03:32:795]: Source path resolution complete. Dumping Directory table... MSI (s) (80:B0) [22:03:32:795]: Dir (source): Key: TARGETDIR , Object: C:\ProgramData\Sophos\AutoUpdate\Cache\decoded\ntp64\ , LongSubPath: , ShortSubPath: MSI (s) (80:B0) [22:03:32:795]: Dir (source): Key: WindowsFolder , Object: C:\ProgramData\Sophos\AutoUpdate\Cache\decoded\ntp64\ , LongSubPath: , ShortSubPath: MSI (s) (80:B0) [22:03:32:795]: Dir (source): Key: System64Folder , Object: C:\ProgramData\Sophos\AutoUpdate\Cache\decoded\ntp64\System64\ , LongSubPath: System64\ , ShortSubPath: Sys64\ MSI (s) (80:B0) [22:03:32:795]: Dir (source): Key: System64Folder_amd64_VC.05F0B5F5_44A8_3793_976B_A4F17AECF92C , Object: C:\ProgramData\Sophos\AutoUpdate\Cache\decoded\ntp64\System64\ , LongSubPath: System64\ , ShortSubPath: Sys64\ MSI (s) (80:B0) [22:03:32:795]: Dir (source): Key: SystemFolder , Object: C:\ProgramData\Sophos\AutoUpdate\Cache\decoded\ntp64\System\ , LongSubPath: System\ , ShortSubPath: Sys\ MSI (s) (80:B0) [22:03:32:795]: Dir (source): Key: SystemFolder_x86_VC.194841A2_D0F2_3B96_9F71_05BA91BEA0FA , Object: C:\ProgramData\Sophos\AutoUpdate\Cache\decoded\ntp64\System\ , LongSubPath: System\ , ShortSubPath: Sys\ MSI (s) (80:B0) [22:03:32:795]: Dir (source): Key: INSTALLDIR.4D96E9F9_7E7B_4556_8D25_ABEE814FE4E0 , Object: C:\ProgramData\Sophos\AutoUpdate\Cache\decoded\ntp64\ , LongSubPath: , ShortSubPath: MSI (s) (80:B0) [22:03:32:795]: Dir (source): Key: CommonAppDataFolder , Object: C:\ProgramData\Sophos\AutoUpdate\Cache\decoded\ntp64\ , LongSubPath: , ShortSubPath: MSI (s) (80:B0) [22:03:32:795]: Dir (source): Key: SophosAppData , Object: C:\ProgramData\Sophos\AutoUpdate\Cache\decoded\ntp64\Sophos\ , LongSubPath: Sophos\ , ShortSubPath: MSI (s) (80:B0) [22:03:32:795]: Dir (source): Key: HeartbeatData , Object: C:\ProgramData\Sophos\AutoUpdate\Cache\decoded\ntp64\Sophos\Heartbeat\ , LongSubPath: Sophos\Heartbeat\ , ShortSubPath: Sophos\awner00b\ MSI (s) (80:B0) [22:03:32:795]: Dir (source): Key: HeartbeatPersist , Object: C:\ProgramData\Sophos\AutoUpdate\Cache\decoded\ntp64\Sophos\Heartbeat\Persist\ , LongSubPath: Sophos\Heartbeat\Persist\ , ShortSubPath: Sophos\awner00b\Persist\ MSI (s) (80:B0) [22:03:32:795]: Dir (source): Key: HeartbeatLogs , Object: C:\ProgramData\Sophos\AutoUpdate\Cache\decoded\ntp64\Sophos\Heartbeat\Logs\ , LongSubPath: Sophos\Heartbeat\Logs\ , ShortSubPath: Sophos\awner00b\Logs\ MSI (s) (80:B0) [22:03:32:795]: Dir (source): Key: HeartbeatConfig , Object: C:\ProgramData\Sophos\AutoUpdate\Cache\decoded\ntp64\Sophos\Heartbeat\Config\ , LongSubPath: Sophos\Heartbeat\Config\ , ShortSubPath: Sophos\awner00b\Config\ MSI (s) (80:B0) [22:03:32:795]: Dir (source): Key: ProductData , Object: C:\ProgramData\Sophos\AutoUpdate\Cache\decoded\ntp64\Sophos\Sophos Network Threat Protection\ , LongSubPath: Sophos\Sophos Network Threat Protection\ , ShortSubPath: Sophos\hv6uh-kp\ MSI (s) (80:B0) [22:03:32:795]: Dir (source): Key: SnortData , Object: C:\ProgramData\Sophos\AutoUpdate\Cache\decoded\ntp64\Sophos\Sophos Network Threat Protection\IPS\ , LongSubPath: Sophos\Sophos Network Threat Protection\IPS\ , ShortSubPath: Sophos\hv6uh-kp\IPS\ MSI (s) (80:B0) [22:03:32:795]: Dir (source): Key: Logs , Object: C:\ProgramData\Sophos\AutoUpdate\Cache\decoded\ntp64\Sophos\Sophos Network Threat Protection\Logs\ , LongSubPath: Sophos\Sophos Network Threat Protection\Logs\ , ShortSubPath: Sophos\hv6uh-kp\Logs\ MSI (s) (80:B0) [22:03:32:795]: Dir (source): Key: Config , Object: C:\ProgramData\Sophos\AutoUpdate\Cache\decoded\ntp64\Sophos\Sophos Network Threat Protection\Config\ , LongSubPath: Sophos\Sophos Network Threat Protection\Config\ , ShortSubPath: Sophos\hv6uh-kp\Config\ MSI (s) (80:B0) [22:03:32:795]: Dir (source): Key: Status , Object: C:\ProgramData\Sophos\AutoUpdate\Cache\decoded\ntp64\Sophos\Sophos Network Threat Protection\Config\Status\ , LongSubPath: Sophos\Sophos Network Threat Protection\Config\Status\ , ShortSubPath: Sophos\hv6uh-kp\Config\Status\ MSI (s) (80:B0) [22:03:32:795]: Dir (source): Key: ProgramFiles64Folder , Object: C:\ProgramData\Sophos\AutoUpdate\Cache\decoded\ntp64\ , LongSubPath: , ShortSubPath: MSI (s) (80:B0) [22:03:32:795]: Dir (source): Key: Sophos , Object: C:\ProgramData\Sophos\AutoUpdate\Cache\decoded\ntp64\Sophos\ , LongSubPath: Sophos\ , ShortSubPath: MSI (s) (80:B0) [22:03:32:795]: Dir (source): Key: INSTALLDIR , Object: C:\ProgramData\Sophos\AutoUpdate\Cache\decoded\ntp64\Sophos\Sophos Network Threat Protection\ , LongSubPath: Sophos\Sophos Network Threat Protection\ , ShortSubPath: Sophos\_tph7qnj\ MSI (s) (80:B0) [22:03:32:795]: Dir (source): Key: SnortConfDir , Object: C:\ProgramData\Sophos\AutoUpdate\Cache\decoded\ntp64\Sophos\Sophos Network Threat Protection\IPS Configuration\ , LongSubPath: Sophos\Sophos Network Threat Protection\IPS Configuration\ , ShortSubPath: Sophos\_tph7qnj\wkmxshcj\ MSI (s) (80:B0) [22:03:32:795]: Dir (source): Key: SnortPreProcDir , Object: C:\ProgramData\Sophos\AutoUpdate\Cache\decoded\ntp64\Sophos\Sophos Network Threat Protection\IPS Dynamic Preprocessors\ , LongSubPath: Sophos\Sophos Network Threat Protection\IPS Dynamic Preprocessors\ , ShortSubPath: Sophos\_tph7qnj\v7k7q2nc\ MSI (s) (80:B0) [22:03:32:795]: Dir (source): Key: SnortDynModulesDir , Object: C:\ProgramData\Sophos\AutoUpdate\Cache\decoded\ntp64\Sophos\Sophos Network Threat Protection\IPS Dynamic Modules\ , LongSubPath: Sophos\Sophos Network Threat Protection\IPS Dynamic Modules\ , ShortSubPath: Sophos\_tph7qnj\i2rhhwl8\ MSI (s) (80:B0) [22:03:32:795]: Dir (source): Key: plugins , Object: C:\ProgramData\Sophos\AutoUpdate\Cache\decoded\ntp64\Sophos\Sophos Network Threat Protection\plugins\ , LongSubPath: Sophos\Sophos Network Threat Protection\plugins\ , ShortSubPath: Sophos\_tph7qnj\plugins\ MSI (s) (80:B0) [22:03:32:795]: Dir (source): Key: SophosNTPLWFDir , Object: C:\ProgramData\Sophos\AutoUpdate\Cache\decoded\ntp64\Sophos\Sophos Network Threat Protection\SophosNTPLWF\ , LongSubPath: Sophos\Sophos Network Threat Protection\SophosNTPLWF\ , ShortSubPath: Sophos\_tph7qnj\inu1lsqb\ MSI (s) (80:B0) [22:03:32:795]: Note: 1: 2205 2: 3: ActionText MSI (s) (80:B0) [22:03:32:795]: Note: 1: 2205 2: 3: ActionText MSI (s) (80:B0) [22:03:32:795]: Note: 1: 2205 2: 3: ActionText MSI (s) (80:B0) [22:03:32:811]: Doing action: ProcessComponents MSI (s) (80:B0) [22:03:32:811]: Note: 1: 2205 2: 3: ActionText Action ended 22:03:32: CheckMaxNumFilters. Return value 1. Action start 22:03:32: ProcessComponents. MSI (s) (80:B0) [22:03:32:811]: Doing action: UnpublishFeatures MSI (s) (80:B0) [22:03:32:811]: Note: 1: 2205 2: 3: ActionText Action ended 22:03:32: ProcessComponents. Return value 1. Action start 22:03:32: UnpublishFeatures. MSI (s) (80:B0) [22:03:32:811]: Doing action: SchedSecureObjectsRollback_x64 MSI (s) (80:B0) [22:03:32:811]: Note: 1: 2205 2: 3: ActionText Action ended 22:03:32: UnpublishFeatures. Return value 1. MSI (s) (80:B0) [22:03:32:811]: Creating MSIHANDLE (1) of type 790542 for thread 7600 MSI (s) (80:A0) [22:03:32:811]: Invoking remote custom action. DLL: C:\windows\Installer\MSI72D0.tmp, Entrypoint: SchedSecureObjectsRollback MSI (s) (80:F4) [22:03:32:811]: Generating random cookie. MSI (s) (80:F4) [22:03:32:811]: Created Custom Action Server with PID 5960 (0x1748). MSI (s) (80:F4) [22:03:32:935]: Running as a service. MSI (s) (80:F4) [22:03:32:935]: Hello, I'm your 64bit Elevated Non-remapped custom action server. MSI (s) (80:F4) [22:03:33:013]: Creating MSIHANDLE (2) of type 790541 for thread 7412 MSI (s) (80:F4) [22:03:33:013]: Creating MSIHANDLE (3) of type 790531 for thread 7412 Action start 22:03:32: SchedSecureObjectsRollback_x64. MSI (s) (80:F4) [22:03:33:013]: Closing MSIHANDLE (3) of type 790531 for thread 7412 MSI (s) (80:F4) [22:03:33:013]: Creating MSIHANDLE (4) of type 790540 for thread 7412 MSI (s) (80:F4) [22:03:33:013]: Creating MSIHANDLE (5) of type 790531 for thread 7412 MSI (s) (80:F4) [22:03:33:013]: Creating MSIHANDLE (6) of type 790531 for thread 7412 MSI (s) (80:F4) [22:03:33:013]: Closing MSIHANDLE (6) of type 790531 for thread 7412 MSI (s) (80:F4) [22:03:33:013]: Creating MSIHANDLE (7) of type 790540 for thread 7412 MSI (s) (80:F4) [22:03:33:013]: Creating MSIHANDLE (8) of type 790531 for thread 7412 MSI (s) (80:F4) [22:03:33:013]: Creating MSIHANDLE (9) of type 790531 for thread 7412 MSI (s) (80:F4) [22:03:33:013]: Creating MSIHANDLE (10) of type 790531 for thread 7412 MSI (s) (80:F4) [22:03:33:013]: Closing MSIHANDLE (10) of type 790531 for thread 7412 MSI (s) (80:F4) [22:03:33:013]: Closing MSIHANDLE (8) of type 790531 for thread 7412 MSI (s) (80:F4) [22:03:33:013]: Closing MSIHANDLE (9) of type 790531 for thread 7412 MSI (s) (80:F4) [22:03:33:013]: Closing MSIHANDLE (7) of type 790540 for thread 7412 MSI (s) (80:F4) [22:03:33:013]: Creating MSIHANDLE (11) of type 790531 for thread 7412 SchedSecureObjectsRollback: Entering SchedSecureObjectsRollback in C:\windows\Installer\MSI72D0.tmp, version 3.11.2318.0 MSI (s) (80:F4) [22:03:33:013]: Closing MSIHANDLE (11) of type 790531 for thread 7412 MSI (s) (80:F4) [22:03:33:013]: Closing MSIHANDLE (5) of type 790531 for thread 7412 MSI (s) (80:F4) [22:03:33:013]: Creating MSIHANDLE (12) of type 790531 for thread 7412 MSI (s) (80:F4) [22:03:33:013]: Creating MSIHANDLE (13) of type 790531 for thread 7412 MSI (s) (80:F4) [22:03:33:013]: Closing MSIHANDLE (13) of type 790531 for thread 7412 MSI (s) (80:F4) [22:03:33:013]: Creating MSIHANDLE (14) of type 790540 for thread 7412 MSI (s) (80:F4) [22:03:33:013]: Creating MSIHANDLE (15) of type 790531 for thread 7412 MSI (s) (80:F4) [22:03:33:013]: Creating MSIHANDLE (16) of type 790531 for thread 7412 MSI (s) (80:F4) [22:03:33:013]: Creating MSIHANDLE (17) of type 790531 for thread 7412 MSI (s) (80:F4) [22:03:33:013]: Closing MSIHANDLE (17) of type 790531 for thread 7412 MSI (s) (80:F4) [22:03:33:013]: Closing MSIHANDLE (15) of type 790531 for thread 7412 MSI (s) (80:F4) [22:03:33:013]: Closing MSIHANDLE (16) of type 790531 for thread 7412 MSI (s) (80:F4) [22:03:33:013]: Closing MSIHANDLE (14) of type 790540 for thread 7412 MSI (s) (80:F4) [22:03:33:029]: Creating MSIHANDLE (18) of type 790531 for thread 7412 SchedSecureObjectsRollback: Failed to store ACL rollback information with error 0x80070424 - continuing MSI (s) (80:F4) [22:03:33:029]: Closing MSIHANDLE (18) of type 790531 for thread 7412 MSI (s) (80:F4) [22:03:33:029]: Closing MSIHANDLE (12) of type 790531 for thread 7412 MSI (s) (80:F4) [22:03:33:029]: Creating MSIHANDLE (19) of type 790531 for thread 7412 MSI (s) (80:F4) [22:03:33:029]: Creating MSIHANDLE (20) of type 790531 for thread 7412 MSI (s) (80:F4) [22:03:33:029]: Closing MSIHANDLE (20) of type 790531 for thread 7412 MSI (s) (80:F4) [22:03:33:029]: Creating MSIHANDLE (21) of type 790540 for thread 7412 MSI (s) (80:F4) [22:03:33:029]: Creating MSIHANDLE (22) of type 790531 for thread 7412 MSI (s) (80:F4) [22:03:33:029]: Creating MSIHANDLE (23) of type 790531 for thread 7412 MSI (s) (80:F4) [22:03:33:029]: Creating MSIHANDLE (24) of type 790531 for thread 7412 MSI (s) (80:F4) [22:03:33:029]: Closing MSIHANDLE (24) of type 790531 for thread 7412 MSI (s) (80:F4) [22:03:33:029]: Closing MSIHANDLE (22) of type 790531 for thread 7412 MSI (s) (80:F4) [22:03:33:029]: Closing MSIHANDLE (23) of type 790531 for thread 7412 MSI (s) (80:F4) [22:03:33:029]: Closing MSIHANDLE (21) of type 790540 for thread 7412 MSI (s) (80:F4) [22:03:33:029]: Creating MSIHANDLE (25) of type 790531 for thread 7412 SchedSecureObjectsRollback: Failed to store ACL rollback information with error 0x80070424 - continuing MSI (s) (80:F4) [22:03:33:029]: Closing MSIHANDLE (25) of type 790531 for thread 7412 MSI (s) (80:F4) [22:03:33:029]: Closing MSIHANDLE (19) of type 790531 for thread 7412 MSI (s) (80:F4) [22:03:33:029]: Creating MSIHANDLE (26) of type 790531 for thread 7412 MSI (s) (80:F4) [22:03:33:029]: Creating MSIHANDLE (27) of type 790531 for thread 7412 MSI (s) (80:F4) [22:03:33:029]: Closing MSIHANDLE (27) of type 790531 for thread 7412 MSI (s) (80:F4) [22:03:33:029]: Creating MSIHANDLE (28) of type 790540 for thread 7412 MSI (s) (80:F4) [22:03:33:029]: Creating MSIHANDLE (29) of type 790531 for thread 7412 MSI (s) (80:F4) [22:03:33:029]: Creating MSIHANDLE (30) of type 790531 for thread 7412 MSI (s) (80:F4) [22:03:33:029]: Creating MSIHANDLE (31) of type 790531 for thread 7412 MSI (s) (80:F4) [22:03:33:029]: Closing MSIHANDLE (31) of type 790531 for thread 7412 MSI (s) (80:F4) [22:03:33:029]: Closing MSIHANDLE (29) of type 790531 for thread 7412 MSI (s) (80:F4) [22:03:33:029]: Closing MSIHANDLE (30) of type 790531 for thread 7412 MSI (s) (80:F4) [22:03:33:029]: Closing MSIHANDLE (28) of type 790540 for thread 7412 MSI (s) (80:F4) [22:03:33:029]: Creating MSIHANDLE (32) of type 790531 for thread 7412 SchedSecureObjectsRollback: Failed to store ACL rollback information with error 0x80070424 - continuing MSI (s) (80:F4) [22:03:33:029]: Closing MSIHANDLE (32) of type 790531 for thread 7412 MSI (s) (80:F4) [22:03:33:029]: Closing MSIHANDLE (26) of type 790531 for thread 7412 MSI (s) (80:F4) [22:03:33:029]: Closing MSIHANDLE (2) of type 790541 for thread 7412 MSI (s) (80:F4) [22:03:33:029]: Closing MSIHANDLE (4) of type 790540 for thread 7412 MSI (s) (80:A0) [22:03:33:029]: Closing MSIHANDLE (1) of type 790542 for thread 7600 SchedSecureObjectsRollback: Failed to store ACL rollback information with error 0x80070424 - continuing MSI (s) (80:B0) [22:03:33:029]: Doing action: SetUnregisterHbtManagementAdapterRollback MSI (s) (80:B0) [22:03:33:029]: Note: 1: 2205 2: 3: ActionText Action ended 22:03:33: SchedSecureObjectsRollback_x64. Return value 1. MSI (s) (80:B0) [22:03:33:029]: PROPERTY CHANGE: Adding UnregisterHbtManagementAdapterRollback property. Its value is 'C:\Program Files\Sophos\Sophos Network Threat Protection\HbtAdapter.dll'. Action start 22:03:33: SetUnregisterHbtManagementAdapterRollback. MSI (s) (80:B0) [22:03:33:029]: Skipping action: UnregisterHbtManagementAdapterRollback (condition is false) MSI (s) (80:B0) [22:03:33:029]: Skipping action: UnregisterHbtManagementAdapter (condition is false) MSI (s) (80:B0) [22:03:33:029]: Doing action: SetUnregisterManagementAdapterRollback MSI (s) (80:B0) [22:03:33:029]: Note: 1: 2205 2: 3: ActionText Action ended 22:03:33: SetUnregisterHbtManagementAdapterRollback. Return value 1. MSI (s) (80:B0) [22:03:33:029]: PROPERTY CHANGE: Adding UnregisterManagementAdapterRollback property. Its value is 'C:\Program Files\Sophos\Sophos Network Threat Protection\NTPAdapter.dll'. Action start 22:03:33: SetUnregisterManagementAdapterRollback. MSI (s) (80:B0) [22:03:33:029]: Skipping action: UnregisterManagementAdapterRollback (condition is false) MSI (s) (80:B0) [22:03:33:029]: Skipping action: UnregisterManagementAdapter (condition is false) MSI (s) (80:B0) [22:03:33:029]: Doing action: StopServices MSI (s) (80:B0) [22:03:33:029]: Note: 1: 2205 2: 3: ActionText Action ended 22:03:33: SetUnregisterManagementAdapterRollback. Return value 1. Action start 22:03:33: StopServices. MSI (s) (80:B0) [22:03:33:029]: Skipping action: UninstallSophosNTPLWF.Property (condition is false) MSI (s) (80:B0) [22:03:33:029]: Skipping action: UninstallSophosNTPLWF (condition is false) MSI (s) (80:B0) [22:03:33:029]: Skipping action: RollbackRemoveTrustedPublisher.Property (condition is false) MSI (s) (80:B0) [22:03:33:029]: Skipping action: RollbackRemoveTrustedPublisher (condition is false) MSI (s) (80:B0) [22:03:33:029]: Skipping action: RollbackUninstallSophosNTPLWF.Property (condition is false) MSI (s) (80:B0) [22:03:33:029]: Skipping action: RollbackUninstallSophosNTPLWF (condition is false) MSI (s) (80:B0) [22:03:33:029]: Skipping action: RollbackAddTrustedPublisher.Property (condition is false) MSI (s) (80:B0) [22:03:33:029]: Skipping action: RollbackAddTrustedPublisher (condition is false) MSI (s) (80:B0) [22:03:33:029]: Skipping action: CleanUpSsspUserAccount.SetProperty (condition is false) MSI (s) (80:B0) [22:03:33:029]: Skipping action: CleanUpSsspUserAccountRollback.SetProperty (condition is false) MSI (s) (80:B0) [22:03:33:029]: Skipping action: CleanUpSsspUserAccountRollback (condition is false) MSI (s) (80:B0) [22:03:33:029]: Skipping action: CleanUpSsspUserAccount (condition is false) MSI (s) (80:B0) [22:03:33:029]: Skipping action: RemoveSIPSSubmitterUserAccount.SetProperty (condition is false) MSI (s) (80:B0) [22:03:33:029]: Skipping action: RemoveSIPSSubmitterUserAccountRollback.SetProperty (condition is false) MSI (s) (80:B0) [22:03:33:029]: Skipping action: RemoveSIPSSubmitterUserAccountRollback (condition is false) MSI (s) (80:B0) [22:03:33:029]: Skipping action: RemoveSIPSSubmitterUserAccount (condition is false) MSI (s) (80:B0) [22:03:33:029]: Doing action: SetUnregisterSntpEventManifest MSI (s) (80:B0) [22:03:33:029]: Note: 1: 2205 2: 3: ActionText Action ended 22:03:33: StopServices. Return value 1. MSI (s) (80:B0) [22:03:33:029]: PROPERTY CHANGE: Adding UnregisterSntpEventManifest property. Its value is '"wevtutil.exe" um "C:\Program Files\Sophos\Sophos Network Threat Protection\Sntp.man"'. Action start 22:03:33: SetUnregisterSntpEventManifest. MSI (s) (80:B0) [22:03:33:029]: Doing action: SetUnregisterSntpEventManifestRollback MSI (s) (80:B0) [22:03:33:029]: Note: 1: 2205 2: 3: ActionText Action ended 22:03:33: SetUnregisterSntpEventManifest. Return value 1. MSI (s) (80:B0) [22:03:33:029]: PROPERTY CHANGE: Adding UnregisterSntpEventManifestRollback property. Its value is '"wevtutil.exe" im "C:\Program Files\Sophos\Sophos Network Threat Protection\Sntp.man"'. Action start 22:03:33: SetUnregisterSntpEventManifestRollback. MSI (s) (80:B0) [22:03:33:029]: Doing action: UnregisterSntpEventManifestRollback MSI (s) (80:B0) [22:03:33:029]: Note: 1: 2205 2: 3: ActionText Action ended 22:03:33: SetUnregisterSntpEventManifestRollback. Return value 1. Action start 22:03:33: UnregisterSntpEventManifestRollback. MSI (s) (80:B0) [22:03:33:029]: Doing action: UnregisterSntpEventManifest MSI (s) (80:B0) [22:03:33:029]: Note: 1: 2205 2: 3: ActionText Action ended 22:03:33: UnregisterSntpEventManifestRollback. Return value 1. Action start 22:03:33: UnregisterSntpEventManifest. MSI (s) (80:B0) [22:03:33:029]: Doing action: DeleteServices MSI (s) (80:B0) [22:03:33:029]: Note: 1: 2205 2: 3: ActionText Action ended 22:03:33: UnregisterSntpEventManifest. Return value 1. Action start 22:03:33: DeleteServices. MSI (s) (80:B0) [22:03:33:029]: Doing action: RemoveRegistryValues MSI (s) (80:B0) [22:03:33:029]: Note: 1: 2205 2: 3: ActionText Action ended 22:03:33: DeleteServices. Return value 1. Action start 22:03:33: RemoveRegistryValues. MSI (s) (80:B0) [22:03:33:029]: Skipping action: RemoveLogFiles.Property (condition is false) MSI (s) (80:B0) [22:03:33:029]: Skipping action: RemoveLogFiles (condition is false) MSI (s) (80:B0) [22:03:33:029]: Skipping action: RemovePolicyFile.Property (condition is false) MSI (s) (80:B0) [22:03:33:029]: Skipping action: RemovePolicyFile (condition is false) MSI (s) (80:B0) [22:03:33:029]: Skipping action: RemoveStatusFile.Property (condition is false) MSI (s) (80:B0) [22:03:33:029]: Skipping action: RemoveStatusFile (condition is false) MSI (s) (80:B0) [22:03:33:029]: Skipping action: RemoveReloadTrigger.Property (condition is false) MSI (s) (80:B0) [22:03:33:029]: Skipping action: RemoveReloadTrigger (condition is false) MSI (s) (80:B0) [22:03:33:029]: Skipping action: RemoveIpsFiles.Property (condition is false) MSI (s) (80:B0) [22:03:33:029]: Skipping action: RemoveIpsFiles (condition is false) MSI (s) (80:B0) [22:03:33:029]: Doing action: RemoveFiles MSI (s) (80:B0) [22:03:33:029]: Note: 1: 2205 2: 3: ActionText Action ended 22:03:33: RemoveRegistryValues. Return value 1. Action start 22:03:33: RemoveFiles. MSI (s) (80:B0) [22:03:33:029]: Doing action: RemoveFolders MSI (s) (80:B0) [22:03:33:029]: Note: 1: 2205 2: 3: ActionText Action ended 22:03:33: RemoveFiles. Return value 1. Action start 22:03:33: RemoveFolders. MSI (s) (80:B0) [22:03:33:029]: Doing action: CreateFolders MSI (s) (80:B0) [22:03:33:029]: Note: 1: 2205 2: 3: ActionText Action ended 22:03:33: RemoveFolders. Return value 1. Action start 22:03:33: CreateFolders. MSI (s) (80:B0) [22:03:33:045]: Skipping action: FixupProductDataFiles.Property (condition is false) MSI (s) (80:B0) [22:03:33:045]: Skipping action: FixupProductDataFiles (condition is false) MSI (s) (80:B0) [22:03:33:045]: Skipping action: FixupHeartbeatDataFiles.Property (condition is false) MSI (s) (80:B0) [22:03:33:045]: Skipping action: FixupHeartbeatDataFiles (condition is false) MSI (s) (80:B0) [22:03:33:045]: Doing action: InstallFiles MSI (s) (80:B0) [22:03:33:045]: Note: 1: 2205 2: 3: ActionText Action ended 22:03:33: CreateFolders. Return value 1. MSI (s) (80:B0) [22:03:33:045]: The file represented by File table key 'Sntp.sys' has no eligible binary patches MSI (s) (80:B0) [22:03:33:045]: The file represented by File table key 'SophosNTPLWF.sys' has no eligible binary patches MSI (s) (80:B0) [22:03:33:045]: The file represented by File table key 'navl.dll' has no eligible binary patches MSI (s) (80:B0) [22:03:33:045]: The file represented by File table key 'integrity.dat' has no eligible binary patches MSI (s) (80:B0) [22:03:33:045]: The file represented by File table key 'SophosNtpServiceExeWin8Plus' has no eligible binary patches MSI (s) (80:B0) [22:03:33:045]: The file represented by File table key 'SophosNtpServiceExeWin7Only' has no eligible binary patches MSI (s) (80:B0) [22:03:33:045]: The file represented by File table key 'NTPAdapter.dll' has no eligible binary patches MSI (s) (80:B0) [22:03:33:045]: The file represented by File table key 'Heartbeat.dll' has no eligible binary patches MSI (s) (80:B0) [22:03:33:045]: The file represented by File table key 'Heartbeat.xml' has no eligible binary patches MSI (s) (80:B0) [22:03:33:045]: The file represented by File table key 'Notice.txt' has no eligible binary patches MSI (s) (80:B0) [22:03:33:045]: The file represented by File table key 'HealthApi.dll' has no eligible binary patches MSI (s) (80:B0) [22:03:33:045]: The file represented by File table key 'HbtAdapter.dll' has no eligible binary patches MSI (s) (80:B0) [22:03:33:045]: The file represented by File table key 'BPAIF.dll' has no eligible binary patches MSI (s) (80:B0) [22:03:33:045]: The file represented by File table key 'SophosNtpTelemetry.exe' has no eligible binary patches MSI (s) (80:B0) [22:03:33:045]: The file represented by File table key 'scf.dat' has no eligible binary patches MSI (s) (80:B0) [22:03:33:045]: The file represented by File table key 'sof.dat' has no eligible binary patches MSI (s) (80:B0) [22:03:33:045]: The file represented by File table key 'Sntp.inf' has no eligible binary patches MSI (s) (80:B0) [22:03:33:045]: The file represented by File table key 'Sntp.cat' has no eligible binary patches MSI (s) (80:B0) [22:03:33:045]: The file represented by File table key 'Sntp.man' has no eligible binary patches MSI (s) (80:B0) [22:03:33:045]: The file represented by File table key 'SophosNTPLWF.inf' has no eligible binary patches MSI (s) (80:B0) [22:03:33:045]: The file represented by File table key 'SophosNTPLWF.cat' has no eligible binary patches MSI (s) (80:B0) [22:03:33:045]: The file represented by File table key 'F_CENTRAL_msvcr120_x86.194841A2_D0F2_3B96_9F71_05BA91BEA0FA' has no eligible binary patches MSI (s) (80:B0) [22:03:33:045]: The file represented by File table key 'F_CENTRAL_msvcp120_x86.194841A2_D0F2_3B96_9F71_05BA91BEA0FA' has no eligible binary patches MSI (s) (80:B0) [22:03:33:045]: The file represented by File table key 'F_CENTRAL_vccorlib120_x86.194841A2_D0F2_3B96_9F71_05BA91BEA0FA' has no eligible binary patches MSI (s) (80:B0) [22:03:33:045]: The file represented by File table key 'F_CENTRAL_msvcr120_x64.05F0B5F5_44A8_3793_976B_A4F17AECF92C' has no eligible binary patches MSI (s) (80:B0) [22:03:33:045]: The file represented by File table key 'F_CENTRAL_msvcp120_x64.05F0B5F5_44A8_3793_976B_A4F17AECF92C' has no eligible binary patches MSI (s) (80:B0) [22:03:33:045]: The file represented by File table key 'F_CENTRAL_vccorlib120_x64.05F0B5F5_44A8_3793_976B_A4F17AECF92C' has no eligible binary patches Action start 22:03:33: InstallFiles. MSI (s) (80:B0) [22:03:33:045]: Note: 1: 2205 2: 3: Patch MSI (s) (80:B0) [22:03:33:045]: Note: 1: 2228 2: 3: Patch 4: SELECT `Patch`.`File_`, `Patch`.`Header`, `Patch`.`Attributes`, `Patch`.`Sequence`, `Patch`.`StreamRef_` FROM `Patch` WHERE `Patch`.`File_` = ? AND `Patch`.`#_MsiActive`=? ORDER BY `Patch`.`Sequence` MSI (s) (80:B0) [22:03:33:045]: Note: 1: 2205 2: 3: MsiSFCBypass MSI (s) (80:B0) [22:03:33:045]: Note: 1: 2228 2: 3: MsiSFCBypass 4: SELECT `File_` FROM `MsiSFCBypass` WHERE `File_` = ? MSI (s) (80:B0) [22:03:33:045]: Note: 1: 2205 2: 3: MsiPatchHeaders MSI (s) (80:B0) [22:03:33:045]: Note: 1: 2228 2: 3: MsiPatchHeaders 4: SELECT `Header` FROM `MsiPatchHeaders` WHERE `StreamRef` = ? MSI (s) (80:B0) [22:03:33:045]: Note: 1: 2205 2: 3: PatchPackage MSI (s) (80:B0) [22:03:33:045]: Note: 1: 2205 2: 3: MsiPatchHeaders MSI (s) (80:B0) [22:03:33:045]: Note: 1: 2205 2: 3: PatchPackage MSI (s) (80:B0) [22:03:33:045]: Note: 1: 2205 2: 3: Patch MSI (s) (80:B0) [22:03:33:045]: Note: 1: 2228 2: 3: Patch 4: SELECT `Patch`.`Sequence`, `Patch`.`PatchSize`, `Patch`.`Attributes`, `Patch`.`Header`, `Patch`.`StreamRef_` FROM `File`,`Patch`,`Component` WHERE `File`=? AND `File`=`File_` AND `Component`=`Component_` ORDER BY `Patch`.`Sequence` MSI (s) (80:B0) [22:03:33:045]: Using cached product context: machine assigned for product: CE6380BC270BD863282B3D74B09F7570 MSI (s) (80:B0) [22:03:33:045]: Using cached product context: machine assigned for product: CE6380BC270BD863282B3D74B09F7570 MSI (s) (80:B0) [22:03:33:045]: Using cached product context: machine assigned for product: CE6380BC270BD863282B3D74B09F7570 MSI (s) (80:B0) [22:03:33:045]: Using cached product context: machine assigned for product: CE6380BC270BD863282B3D74B09F7570 MSI (s) (80:B0) [22:03:33:045]: Using cached product context: machine assigned for product: CE6380BC270BD863282B3D74B09F7570 MSI (s) (80:B0) [22:03:33:045]: Using cached product context: machine assigned for product: CE6380BC270BD863282B3D74B09F7570 MSI (s) (80:B0) [22:03:33:045]: Note: 1: 2205 2: 3: Patch MSI (s) (80:B0) [22:03:33:045]: Note: 1: 2228 2: 3: Patch 4: SELECT `Patch`.`Sequence`, `Patch`.`PatchSize`, `Patch`.`Attributes`, `Patch`.`Header`, `Patch`.`StreamRef_` FROM `File`,`Patch`,`Component` WHERE `File`=? AND `File`=`File_` AND `Component`=`Component_` ORDER BY `Patch`.`Sequence` MSI (s) (80:B0) [22:03:33:045]: Using cached product context: machine assigned for product: 12B8D03ED28D112328CCF0A0D541598E MSI (s) (80:B0) [22:03:33:045]: Using cached product context: machine assigned for product: 12B8D03ED28D112328CCF0A0D541598E MSI (s) (80:B0) [22:03:33:045]: Using cached product context: machine assigned for product: 12B8D03ED28D112328CCF0A0D541598E MSI (s) (80:B0) [22:03:33:045]: Using cached product context: machine assigned for product: 12B8D03ED28D112328CCF0A0D541598E MSI (s) (80:B0) [22:03:33:045]: Using cached product context: machine assigned for product: 12B8D03ED28D112328CCF0A0D541598E MSI (s) (80:B0) [22:03:33:045]: Using cached product context: machine assigned for product: 12B8D03ED28D112328CCF0A0D541598E MSI (s) (80:B0) [22:03:33:045]: Note: 1: 2205 2: 3: Patch MSI (s) (80:B0) [22:03:33:045]: Note: 1: 2228 2: 3: Patch 4: SELECT `Patch`.`Sequence`, `Patch`.`PatchSize`, `Patch`.`Attributes`, `Patch`.`Header`, `Patch`.`StreamRef_` FROM `File`,`Patch`,`Component` WHERE `File`=? AND `File`=`File_` AND `Component`=`Component_` ORDER BY `Patch`.`Sequence` MSI (s) (80:B0) [22:03:33:045]: Note: 1: 2205 2: 3: Patch MSI (s) (80:B0) [22:03:33:045]: Note: 1: 2228 2: 3: Patch 4: SELECT `Patch`.`Sequence`, `Patch`.`PatchSize`, `Patch`.`Attributes`, `Patch`.`Header`, `Patch`.`StreamRef_` FROM `File`,`Patch`,`Component` WHERE `File`=? AND `File`=`File_` AND `Component`=`Component_` ORDER BY `Patch`.`Sequence` MSI (s) (80:B0) [22:03:33:045]: Note: 1: 2205 2: 3: Patch MSI (s) (80:B0) [22:03:33:045]: Note: 1: 2228 2: 3: Patch 4: SELECT `Patch`.`Sequence`, `Patch`.`PatchSize`, `Patch`.`Attributes`, `Patch`.`Header`, `Patch`.`StreamRef_` FROM `File`,`Patch`,`Component` WHERE `File`=? AND `File`=`File_` AND `Component`=`Component_` ORDER BY `Patch`.`Sequence` MSI (s) (80:B0) [22:03:33:045]: Note: 1: 2205 2: 3: Patch MSI (s) (80:B0) [22:03:33:045]: Note: 1: 2228 2: 3: Patch 4: SELECT `Patch`.`Sequence`, `Patch`.`PatchSize`, `Patch`.`Attributes`, `Patch`.`Header`, `Patch`.`StreamRef_` FROM `File`,`Patch`,`Component` WHERE `File`=? AND `File`=`File_` AND `Component`=`Component_` ORDER BY `Patch`.`Sequence` MSI (s) (80:B0) [22:03:33:060]: Skipping action: FixupDIFxAppRegistry (condition is false) MSI (s) (80:B0) [22:03:33:060]: Doing action: MsiProcessDrivers MSI (s) (80:B0) [22:03:33:060]: Note: 1: 2205 2: 3: ActionText Action ended 22:03:33: InstallFiles. Return value 1. MSI (s) (80:B0) [22:03:33:060]: Creating MSIHANDLE (33) of type 790542 for thread 7600 MSI (s) (80:14) [22:03:33:060]: Invoking remote custom action. DLL: C:\windows\Installer\MSI73CB.tmp, Entrypoint: ProcessDriverPackages MSI (s) (80!50) [22:03:33:060]: Creating MSIHANDLE (34) of type 790531 for thread 3408 Action start 22:03:33: MsiProcessDrivers. MSI (s) (80!50) [22:03:33:060]: Closing MSIHANDLE (34) of type 790531 for thread 3408 MSI (s) (80!50) [22:03:33:060]: Creating MSIHANDLE (35) of type 790541 for thread 3408 MSI (s) (80!50) [22:03:33:060]: Creating MSIHANDLE (36) of type 790540 for thread 3408 MSI (s) (80!50) [22:03:33:060]: Creating MSIHANDLE (37) of type 790531 for thread 3408 MSI (s) (80!50) [22:03:33:060]: Creating MSIHANDLE (38) of type 790531 for thread 3408 DIFXAPP: ENTER: ProcessDriverPackages() MSI (s) (80!50) [22:03:33:060]: Closing MSIHANDLE (38) of type 790531 for thread 3408 MSI (s) (80!50) [22:03:33:060]: Creating MSIHANDLE (39) of type 790531 for thread 3408 DIFXAPP: INFO: 'Component' is 'Driver' MSI (s) (80!50) [22:03:33:060]: Closing MSIHANDLE (39) of type 790531 for thread 3408 MSI (s) (80!50) [22:03:33:060]: Creating MSIHANDLE (40) of type 790541 for thread 3408 MSI (s) (80!50) [22:03:33:060]: Creating MSIHANDLE (41) of type 790540 for thread 3408 MSI (s) (80!50) [22:03:33:060]: Creating MSIHANDLE (42) of type 790531 for thread 3408 MSI (s) (80!50) [22:03:33:060]: Closing MSIHANDLE (42) of type 790531 for thread 3408 MSI (s) (80!50) [22:03:33:060]: Closing MSIHANDLE (41) of type 790540 for thread 3408 MSI (s) (80!50) [22:03:33:060]: Closing MSIHANDLE (40) of type 790541 for thread 3408 MSI (s) (80!50) [22:03:33:060]: Creating MSIHANDLE (43) of type 790531 for thread 3408 DIFXAPP: INFO: Component state 0x2 -> 0x3 MSI (s) (80!50) [22:03:33:060]: Closing MSIHANDLE (43) of type 790531 for thread 3408 MSI (s) (80!50) [22:03:33:060]: Creating MSIHANDLE (44) of type 790531 for thread 3408 DIFXAPP: INFO: 'ComponentId' is {76F354A6-97D5-4872-9781-2F2642A4F18A} MSI (s) (80!50) [22:03:33:060]: Closing MSIHANDLE (44) of type 790531 for thread 3408 MSI (s) (80!50) [22:03:33:060]: Creating MSIHANDLE (45) of type 790531 for thread 3408 MSI (s) (80!50) [22:03:33:060]: Creating MSIHANDLE (46) of type 790531 for thread 3408 DIFXAPP: INFO: 'Flags' is 21 MSI (s) (80!50) [22:03:33:060]: Closing MSIHANDLE (46) of type 790531 for thread 3408 MSI (s) (80!50) [22:03:33:060]: Creating MSIHANDLE (47) of type 790531 for thread 3408 DIFXAPP: INFO: component path is C:\Program Files\Sophos\Sophos Network Threat Protection\ MSI (s) (80!50) [22:03:33:060]: Closing MSIHANDLE (47) of type 790531 for thread 3408 MSI (s) (80!50) [22:03:33:060]: Creating MSIHANDLE (48) of type 790531 for thread 3408 DIFXAPP: INFO: user SID of user performing the install is 'S-1-5-18'. MSI (s) (80!50) [22:03:33:060]: Closing MSIHANDLE (48) of type 790531 for thread 3408 MSI (s) (80!50) [22:03:33:060]: PROPERTY CHANGE: Adding MsiRollbackInstall property. Its value is '2.12{76F354A6-97D5-4872-9781-2F2642A4F18A}212Sophos Network Threat ProtectionSophos Limited'. MSI (s) (80!50) [22:03:33:060]: Doing action: MsiRollbackInstall MSI (s) (80!50) [22:03:33:060]: Note: 1: 2205 2: 3: ActionText DIFXAPP: INFO: creating HKEY_USERS\S-1-5-18\Software\Microsoft\Windows\CurrentVersion\DIFxApp\Components\{76F354A6-97D5-4872-9781-2F2642A4F18A} (User's SID: 'S-1-5-18') ... Action start 22:03:33: MsiRollbackInstall. MSI (s) (80!50) [22:03:33:060]: PROPERTY CHANGE: Adding MsiInstallDrivers property. Its value is '2.12{76F354A6-97D5-4872-9781-2F2642A4F18A}C:\Program Files\Sophos\Sophos Network Threat Protection\212Sophos Network Threat ProtectionSophos Limited'. MSI (s) (80!50) [22:03:33:060]: Doing action: MsiInstallDrivers MSI (s) (80!50) [22:03:33:060]: Note: 1: 2205 2: 3: ActionText Action ended 22:03:33: MsiRollbackInstall. Return value 1. Action start 22:03:33: MsiInstallDrivers. MSI (s) (80!50) [22:03:33:076]: Closing MSIHANDLE (45) of type 790531 for thread 3408 MSI (s) (80!50) [22:03:33:076]: Closing MSIHANDLE (37) of type 790531 for thread 3408 MSI (s) (80!50) [22:03:33:076]: Closing MSIHANDLE (36) of type 790540 for thread 3408 MSI (s) (80!50) [22:03:33:076]: Closing MSIHANDLE (35) of type 790541 for thread 3408 MSI (s) (80!50) [22:03:33:076]: Creating MSIHANDLE (49) of type 790531 for thread 3408 Action ended 22:03:33: MsiInstallDrivers. Return value 1. MSI (s) (80!50) [22:03:33:076]: Closing MSIHANDLE (49) of type 790531 for thread 3408 MSI (s) (80:14) [22:03:33:076]: Closing MSIHANDLE (33) of type 790542 for thread 7600 DIFXAPP: RETURN: ProcessDriverPackages() 0 (0x0) MSI (s) (80:B0) [22:03:33:076]: Doing action: SetRegisterSntpEventManifestRollback MSI (s) (80:B0) [22:03:33:076]: Note: 1: 2205 2: 3: ActionText Action ended 22:03:33: MsiProcessDrivers. Return value 1. MSI (s) (80:B0) [22:03:33:076]: PROPERTY CHANGE: Adding RegisterSntpEventManifestRollback property. Its value is '"wevtutil.exe" um "C:\Program Files\Sophos\Sophos Network Threat Protection\Sntp.man"'. Action start 22:03:33: SetRegisterSntpEventManifestRollback. MSI (s) (80:B0) [22:03:33:076]: Doing action: RegisterSntpEventManifestRollback MSI (s) (80:B0) [22:03:33:076]: Note: 1: 2205 2: 3: ActionText Action ended 22:03:33: SetRegisterSntpEventManifestRollback. Return value 1. Action start 22:03:33: RegisterSntpEventManifestRollback. MSI (s) (80:B0) [22:03:33:076]: Doing action: SetRegisterSntpEventManifest MSI (s) (80:B0) [22:03:33:076]: Note: 1: 2205 2: 3: ActionText Action ended 22:03:33: RegisterSntpEventManifestRollback. Return value 1. MSI (s) (80:B0) [22:03:33:076]: PROPERTY CHANGE: Adding RegisterSntpEventManifest property. Its value is '"wevtutil.exe" im "C:\Program Files\Sophos\Sophos Network Threat Protection\Sntp.man"'. Action start 22:03:33: SetRegisterSntpEventManifest. MSI (s) (80:B0) [22:03:33:076]: Doing action: RegisterSntpEventManifest MSI (s) (80:B0) [22:03:33:076]: Note: 1: 2205 2: 3: ActionText Action ended 22:03:33: SetRegisterSntpEventManifest. Return value 1. Action start 22:03:33: RegisterSntpEventManifest. MSI (s) (80:B0) [22:03:33:076]: Doing action: WriteRegistryValues MSI (s) (80:B0) [22:03:33:076]: Note: 1: 2205 2: 3: ActionText Action ended 22:03:33: RegisterSntpEventManifest. Return value 1. Action start 22:03:33: WriteRegistryValues. MSI (s) (80:B0) [22:03:33:076]: Doing action: InstallServices MSI (s) (80:B0) [22:03:33:076]: Note: 1: 2205 2: 3: ActionText Action ended 22:03:33: WriteRegistryValues. Return value 1. Action start 22:03:33: InstallServices. MSI (s) (80:B0) [22:03:33:076]: Doing action: AddSIPSSubmitterUserAccount.SetProperty MSI (s) (80:B0) [22:03:33:076]: Note: 1: 2205 2: 3: ActionText Action ended 22:03:33: InstallServices. Return value 1. MSI (s) (80:B0) [22:03:33:091]: PROPERTY CHANGE: Adding AddSIPSSubmitterUserAccount property. Its value is 'NT SERVICE\SntpService'. Action start 22:03:33: AddSIPSSubmitterUserAccount.SetProperty. MSI (s) (80:B0) [22:03:33:091]: Doing action: AddSIPSSubmitterUserAccountRollback.SetProperty MSI (s) (80:B0) [22:03:33:091]: Note: 1: 2205 2: 3: ActionText Action ended 22:03:33: AddSIPSSubmitterUserAccount.SetProperty. Return value 1. MSI (s) (80:B0) [22:03:33:091]: PROPERTY CHANGE: Adding AddSIPSSubmitterUserAccountRollback property. Its value is 'NT SERVICE\SntpService'. Action start 22:03:33: AddSIPSSubmitterUserAccountRollback.SetProperty. MSI (s) (80:B0) [22:03:33:091]: Doing action: AddSIPSSubmitterUserAccountRollback MSI (s) (80:B0) [22:03:33:091]: Note: 1: 2205 2: 3: ActionText Action ended 22:03:33: AddSIPSSubmitterUserAccountRollback.SetProperty. Return value 1. Action start 22:03:33: AddSIPSSubmitterUserAccountRollback. MSI (s) (80:B0) [22:03:33:091]: Doing action: AddSIPSSubmitterUserAccount MSI (s) (80:B0) [22:03:33:091]: Note: 1: 2205 2: 3: ActionText Action ended 22:03:33: AddSIPSSubmitterUserAccountRollback. Return value 1. Action start 22:03:33: AddSIPSSubmitterUserAccount. MSI (s) (80:B0) [22:03:33:091]: Doing action: SchedSecureObjects_x64 MSI (s) (80:B0) [22:03:33:091]: Note: 1: 2205 2: 3: ActionText Action ended 22:03:33: AddSIPSSubmitterUserAccount. Return value 1. MSI (s) (80:B0) [22:03:33:091]: Creating MSIHANDLE (50) of type 790542 for thread 7600 MSI (s) (80:38) [22:03:33:091]: Invoking remote custom action. DLL: C:\windows\Installer\MSI73EB.tmp, Entrypoint: SchedSecureObjects MSI (s) (80!C4) [22:03:33:091]: Creating MSIHANDLE (51) of type 790541 for thread 7364 MSI (s) (80!C4) [22:03:33:091]: Creating MSIHANDLE (52) of type 790531 for thread 7364 Action start 22:03:33: SchedSecureObjects_x64. MSI (s) (80!C4) [22:03:33:091]: Closing MSIHANDLE (52) of type 790531 for thread 7364 MSI (s) (80!C4) [22:03:33:091]: Creating MSIHANDLE (53) of type 790531 for thread 7364 MSI (s) (80!C4) [22:03:33:091]: Closing MSIHANDLE (53) of type 790531 for thread 7364 MSI (s) (80!C4) [22:03:33:091]: Creating MSIHANDLE (54) of type 790540 for thread 7364 MSI (s) (80!C4) [22:03:33:091]: Creating MSIHANDLE (55) of type 790531 for thread 7364 MSI (s) (80!C4) [22:03:33:091]: Creating MSIHANDLE (56) of type 790531 for thread 7364 MSI (s) (80!C4) [22:03:33:091]: Closing MSIHANDLE (56) of type 790531 for thread 7364 MSI (s) (80!C4) [22:03:33:091]: Creating MSIHANDLE (57) of type 790540 for thread 7364 MSI (s) (80!C4) [22:03:33:091]: Creating MSIHANDLE (58) of type 790531 for thread 7364 MSI (s) (80!C4) [22:03:33:091]: Creating MSIHANDLE (59) of type 790531 for thread 7364 MSI (s) (80!C4) [22:03:33:091]: Creating MSIHANDLE (60) of type 790531 for thread 7364 MSI (s) (80!C4) [22:03:33:091]: Closing MSIHANDLE (60) of type 790531 for thread 7364 MSI (s) (80!C4) [22:03:33:091]: Closing MSIHANDLE (58) of type 790531 for thread 7364 MSI (s) (80!C4) [22:03:33:091]: Closing MSIHANDLE (59) of type 790531 for thread 7364 MSI (s) (80!C4) [22:03:33:091]: Closing MSIHANDLE (57) of type 790540 for thread 7364 MSI (s) (80!C4) [22:03:33:091]: Closing MSIHANDLE (55) of type 790531 for thread 7364 MSI (s) (80!C4) [22:03:33:091]: Creating MSIHANDLE (61) of type 790531 for thread 7364 MSI (s) (80!C4) [22:03:33:091]: Creating MSIHANDLE (62) of type 790531 for thread 7364 MSI (s) (80!C4) [22:03:33:091]: Closing MSIHANDLE (62) of type 790531 for thread 7364 MSI (s) (80!C4) [22:03:33:091]: Creating MSIHANDLE (63) of type 790540 for thread 7364 MSI (s) (80!C4) [22:03:33:091]: Creating MSIHANDLE (64) of type 790531 for thread 7364 MSI (s) (80!C4) [22:03:33:091]: Creating MSIHANDLE (65) of type 790531 for thread 7364 MSI (s) (80!C4) [22:03:33:091]: Creating MSIHANDLE (66) of type 790531 for thread 7364 MSI (s) (80!C4) [22:03:33:091]: Closing MSIHANDLE (66) of type 790531 for thread 7364 MSI (s) (80!C4) [22:03:33:091]: Closing MSIHANDLE (64) of type 790531 for thread 7364 MSI (s) (80!C4) [22:03:33:091]: Closing MSIHANDLE (65) of type 790531 for thread 7364 MSI (s) (80!C4) [22:03:33:091]: Closing MSIHANDLE (63) of type 790540 for thread 7364 MSI (s) (80!C4) [22:03:33:091]: Closing MSIHANDLE (61) of type 790531 for thread 7364 MSI (s) (80!C4) [22:03:33:091]: Creating MSIHANDLE (67) of type 790531 for thread 7364 MSI (s) (80!C4) [22:03:33:091]: Creating MSIHANDLE (68) of type 790531 for thread 7364 MSI (s) (80!C4) [22:03:33:091]: Closing MSIHANDLE (68) of type 790531 for thread 7364 MSI (s) (80!C4) [22:03:33:091]: Creating MSIHANDLE (69) of type 790540 for thread 7364 MSI (s) (80!C4) [22:03:33:091]: Creating MSIHANDLE (70) of type 790531 for thread 7364 MSI (s) (80!C4) [22:03:33:091]: Creating MSIHANDLE (71) of type 790531 for thread 7364 MSI (s) (80!C4) [22:03:33:091]: Creating MSIHANDLE (72) of type 790531 for thread 7364 MSI (s) (80!C4) [22:03:33:091]: Closing MSIHANDLE (72) of type 790531 for thread 7364 MSI (s) (80!C4) [22:03:33:091]: Closing MSIHANDLE (70) of type 790531 for thread 7364 MSI (s) (80!C4) [22:03:33:091]: Closing MSIHANDLE (71) of type 790531 for thread 7364 MSI (s) (80!C4) [22:03:33:091]: Closing MSIHANDLE (69) of type 790540 for thread 7364 MSI (s) (80!C4) [22:03:33:091]: Creating MSIHANDLE (73) of type 790531 for thread 7364 MSI (s) (80!C4) [22:03:33:091]: Closing MSIHANDLE (73) of type 790531 for thread 7364 MSI (s) (80!C4) [22:03:33:091]: Closing MSIHANDLE (67) of type 790531 for thread 7364 MSI (s) (80!C4) [22:03:33:091]: Creating MSIHANDLE (74) of type 790531 for thread 7364 MSI (s) (80!C4) [22:03:33:091]: Creating MSIHANDLE (75) of type 790531 for thread 7364 MSI (s) (80!C4) [22:03:33:091]: Closing MSIHANDLE (75) of type 790531 for thread 7364 MSI (s) (80!C4) [22:03:33:091]: Creating MSIHANDLE (76) of type 790540 for thread 7364 MSI (s) (80!C4) [22:03:33:091]: Creating MSIHANDLE (77) of type 790531 for thread 7364 MSI (s) (80!C4) [22:03:33:091]: Creating MSIHANDLE (78) of type 790531 for thread 7364 MSI (s) (80!C4) [22:03:33:091]: Creating MSIHANDLE (79) of type 790531 for thread 7364 MSI (s) (80!C4) [22:03:33:091]: Closing MSIHANDLE (79) of type 790531 for thread 7364 MSI (s) (80!C4) [22:03:33:091]: Closing MSIHANDLE (77) of type 790531 for thread 7364 MSI (s) (80!C4) [22:03:33:091]: Closing MSIHANDLE (78) of type 790531 for thread 7364 MSI (s) (80!C4) [22:03:33:091]: Closing MSIHANDLE (76) of type 790540 for thread 7364 MSI (s) (80!C4) [22:03:33:091]: Creating MSIHANDLE (80) of type 790531 for thread 7364 MSI (s) (80!C4) [22:03:33:091]: Closing MSIHANDLE (80) of type 790531 for thread 7364 MSI (s) (80!C4) [22:03:33:091]: Closing MSIHANDLE (74) of type 790531 for thread 7364 MSI (s) (80!C4) [22:03:33:091]: PROPERTY CHANGE: Adding ExecSecureObjects_64 property. Its value is '**********'. MSI (s) (80!C4) [22:03:33:091]: Creating MSIHANDLE (81) of type 790531 for thread 7364 SchedSecureObjects: Entering SchedSecureObjects in C:\windows\Installer\MSI73EB.tmp, version 3.11.2318.0 MSI (s) (80!C4) [22:03:33:091]: Closing MSIHANDLE (81) of type 790531 for thread 7364 MSI (s) (80!C4) [22:03:33:091]: Doing action: ExecSecureObjects_64 MSI (s) (80!C4) [22:03:33:091]: Note: 1: 2205 2: 3: ActionText Action start 22:03:33: ExecSecureObjects_64. MSI (s) (80!C4) [22:03:33:107]: Closing MSIHANDLE (51) of type 790541 for thread 7364 MSI (s) (80!C4) [22:03:33:107]: Closing MSIHANDLE (54) of type 790540 for thread 7364 MSI (s) (80:38) [22:03:33:107]: Closing MSIHANDLE (50) of type 790542 for thread 7600 Action ended 22:03:33: ExecSecureObjects_64. Return value 1. MSI (s) (80:B0) [22:03:33:107]: Doing action: SchedServiceConfig MSI (s) (80:B0) [22:03:33:107]: Note: 1: 2205 2: 3: ActionText Action ended 22:03:33: SchedSecureObjects_x64. Return value 1. MSI (s) (80:B0) [22:03:33:107]: Creating MSIHANDLE (82) of type 790542 for thread 7600 MSI (s) (80:D4) [22:03:33:107]: Invoking remote custom action. DLL: C:\windows\Installer\MSI73FB.tmp, Entrypoint: SchedServiceConfig MSI (s) (80:F4) [22:03:33:107]: Generating random cookie. MSI (s) (80:F4) [22:03:33:107]: Created Custom Action Server with PID 5072 (0x13D0). MSI (s) (80:F4) [22:03:33:497]: Running as a service. MSI (s) (80:F4) [22:03:33:497]: Hello, I'm your 32bit Elevated Non-remapped custom action server. MSI (s) (80!20) [22:03:33:528]: Creating MSIHANDLE (83) of type 790541 for thread 4896 MSI (s) (80!20) [22:03:33:528]: Creating MSIHANDLE (84) of type 790531 for thread 4896 Action start 22:03:33: SchedServiceConfig. MSI (s) (80!20) [22:03:33:528]: Closing MSIHANDLE (84) of type 790531 for thread 4896 MSI (s) (80!20) [22:03:33:528]: Creating MSIHANDLE (85) of type 790540 for thread 4896 MSI (s) (80!20) [22:03:33:528]: Creating MSIHANDLE (86) of type 790531 for thread 4896 MSI (s) (80!20) [22:03:33:528]: Creating MSIHANDLE (87) of type 790531 for thread 4896 MSI (s) (80!20) [22:03:33:528]: Closing MSIHANDLE (87) of type 790531 for thread 4896 MSI (s) (80!20) [22:03:33:528]: Closing MSIHANDLE (86) of type 790531 for thread 4896 MSI (s) (80!20) [22:03:33:528]: PROPERTY CHANGE: Adding RollbackServiceConfig property. Its value is 'SchedServiceConfig'. MSI (s) (80!20) [22:03:33:528]: Creating MSIHANDLE (88) of type 790531 for thread 4896 SchedServiceConfig: Entering SchedServiceConfig in C:\windows\Installer\MSI73FB.tmp, version 3.11.2318.0 MSI (s) (80!20) [22:03:33:528]: Closing MSIHANDLE (88) of type 790531 for thread 4896 MSI (s) (80!20) [22:03:33:528]: Doing action: RollbackServiceConfig MSI (s) (80!20) [22:03:33:528]: Note: 1: 2205 2: 3: ActionText Action start 22:03:33: RollbackServiceConfig. MSI (s) (80!20) [22:03:33:528]: PROPERTY CHANGE: Adding ExecServiceConfig property. Its value is 'SchedServiceConfig€SntpService€0€restart€restart€none€1€120€€'. MSI (s) (80!20) [22:03:33:528]: Creating MSIHANDLE (89) of type 790531 for thread 4896 Action ended 22:03:33: RollbackServiceConfig. Return value 1. MSI (s) (80!20) [22:03:33:528]: Closing MSIHANDLE (89) of type 790531 for thread 4896 MSI (s) (80!20) [22:03:33:528]: Doing action: ExecServiceConfig MSI (s) (80!20) [22:03:33:528]: Note: 1: 2205 2: 3: ActionText Action start 22:03:33: ExecServiceConfig. MSI (s) (80!20) [22:03:33:528]: Closing MSIHANDLE (83) of type 790541 for thread 4896 MSI (s) (80!20) [22:03:33:528]: Closing MSIHANDLE (85) of type 790540 for thread 4896 MSI (s) (80:D4) [22:03:33:528]: Closing MSIHANDLE (82) of type 790542 for thread 7600 Action ended 22:03:33: ExecServiceConfig. Return value 1. MSI (s) (80:B0) [22:03:33:528]: Doing action: SetupSspUserAccount.SetProperty MSI (s) (80:B0) [22:03:33:528]: Note: 1: 2205 2: 3: ActionText Action ended 22:03:33: SchedServiceConfig. Return value 1. MSI (s) (80:B0) [22:03:33:528]: PROPERTY CHANGE: Adding SetupSspUserAccount property. Its value is 'NT SERVICE\sntpservice'. Action start 22:03:33: SetupSspUserAccount.SetProperty. MSI (s) (80:B0) [22:03:33:528]: Doing action: SetupSspUserAccountRollback.SetProperty MSI (s) (80:B0) [22:03:33:528]: Note: 1: 2205 2: 3: ActionText Action ended 22:03:33: SetupSspUserAccount.SetProperty. Return value 1. MSI (s) (80:B0) [22:03:33:528]: PROPERTY CHANGE: Adding SetupSspUserAccountRollback property. Its value is 'NT SERVICE\sntpservice'. Action start 22:03:33: SetupSspUserAccountRollback.SetProperty. MSI (s) (80:B0) [22:03:33:528]: Doing action: SetupSspUserAccountRollback MSI (s) (80:B0) [22:03:33:528]: Note: 1: 2205 2: 3: ActionText Action ended 22:03:33: SetupSspUserAccountRollback.SetProperty. Return value 1. Action start 22:03:33: SetupSspUserAccountRollback. MSI (s) (80:B0) [22:03:33:528]: Doing action: SetupSspUserAccount MSI (s) (80:B0) [22:03:33:528]: Note: 1: 2205 2: 3: ActionText Action ended 22:03:33: SetupSspUserAccountRollback. Return value 1. Action start 22:03:33: SetupSspUserAccount. MSI (s) (80:B0) [22:03:33:528]: Doing action: MsiConfigureServices MSI (s) (80:B0) [22:03:33:528]: Note: 1: 2205 2: 3: ActionText Action ended 22:03:33: SetupSspUserAccount. Return value 1. Action start 22:03:33: MsiConfigureServices. MSI (s) (80:B0) [22:03:33:544]: Note: 1: 2205 2: 3: MsiServiceConfigFailureActions MSI (s) (80:B0) [22:03:33:544]: Note: 1: 2228 2: 3: MsiServiceConfigFailureActions 4: SELECT `Name`, `Event`, `ResetPeriod`, `RebootMessage`,`Command`, `Actions`, `DelayActions`, `Action` FROM `MsiServiceConfigFailureActions`, `Component` WHERE `Component_` = `Component` AND (`Action` = 0 OR `Action` = 1 OR `Action` = 3) MSI (s) (80:B0) [22:03:33:544]: Doing action: AddTrustedPublisher.Property MSI (s) (80:B0) [22:03:33:544]: Note: 1: 2205 2: 3: ActionText Action ended 22:03:33: MsiConfigureServices. Return value 1. MSI (s) (80:B0) [22:03:33:544]: PROPERTY CHANGE: Adding AddTrustedPublisher property. Its value is 'C:\Program Files\Sophos\Sophos Network Threat Protection\SophosNTPLWF\SophosNTPLWF.cat'. Action start 22:03:33: AddTrustedPublisher.Property. MSI (s) (80:B0) [22:03:33:544]: Doing action: AddTrustedPublisherRollback.Property MSI (s) (80:B0) [22:03:33:544]: Note: 1: 2205 2: 3: ActionText Action ended 22:03:33: AddTrustedPublisher.Property. Return value 1. MSI (s) (80:B0) [22:03:33:544]: PROPERTY CHANGE: Adding AddTrustedPublisherRollback property. Its value is 'C:\Program Files\Sophos\Sophos Network Threat Protection\SophosNTPLWF\SophosNTPLWF.cat'. Action start 22:03:33: AddTrustedPublisherRollback.Property. MSI (s) (80:B0) [22:03:33:544]: Doing action: AddTrustedPublisherRollback MSI (s) (80:B0) [22:03:33:544]: Note: 1: 2205 2: 3: ActionText Action ended 22:03:33: AddTrustedPublisherRollback.Property. Return value 1. Action start 22:03:33: AddTrustedPublisherRollback. MSI (s) (80:B0) [22:03:33:544]: Doing action: AddTrustedPublisher MSI (s) (80:B0) [22:03:33:544]: Note: 1: 2205 2: 3: ActionText Action ended 22:03:33: AddTrustedPublisherRollback. Return value 1. Action start 22:03:33: AddTrustedPublisher. MSI (s) (80:B0) [22:03:33:559]: Doing action: InstallSophosNTPLWF.Property MSI (s) (80:B0) [22:03:33:559]: Note: 1: 2205 2: 3: ActionText Action ended 22:03:33: AddTrustedPublisher. Return value 1. MSI (s) (80:B0) [22:03:33:559]: PROPERTY CHANGE: Adding InstallSophosNTPLWF property. Its value is '"C:\windows\system32\\netcfg.exe" /l "C:\Program Files\Sophos\Sophos Network Threat Protection\SophosNTPLWF\SophosNTPLWF.inf" /c s /i SOPHOS_SOPHOSNTPLWF'. Action start 22:03:33: InstallSophosNTPLWF.Property. MSI (s) (80:B0) [22:03:33:559]: Doing action: RollbackInstallSophosNTPLWF.Property MSI (s) (80:B0) [22:03:33:559]: Note: 1: 2205 2: 3: ActionText Action ended 22:03:33: InstallSophosNTPLWF.Property. Return value 1. MSI (s) (80:B0) [22:03:33:559]: PROPERTY CHANGE: Adding RollbackInstallSophosNTPLWF property. Its value is '"C:\windows\system32\\netcfg.exe" /u SOPHOS_SOPHOSNTPLWF'. Action start 22:03:33: RollbackInstallSophosNTPLWF.Property. MSI (s) (80:B0) [22:03:33:559]: Doing action: RollbackInstallSophosNTPLWF MSI (s) (80:B0) [22:03:33:559]: Note: 1: 2205 2: 3: ActionText Action ended 22:03:33: RollbackInstallSophosNTPLWF.Property. Return value 1. Action start 22:03:33: RollbackInstallSophosNTPLWF. MSI (s) (80:B0) [22:03:33:559]: Doing action: InstallSophosNTPLWF MSI (s) (80:B0) [22:03:33:559]: Note: 1: 2205 2: 3: ActionText Action ended 22:03:33: RollbackInstallSophosNTPLWF. Return value 1. Action start 22:03:33: InstallSophosNTPLWF. MSI (s) (80:B0) [22:03:33:559]: Doing action: RemoveTrustedPublisher.Property MSI (s) (80:B0) [22:03:33:559]: Note: 1: 2205 2: 3: ActionText Action ended 22:03:33: InstallSophosNTPLWF. Return value 1. MSI (s) (80:B0) [22:03:33:559]: PROPERTY CHANGE: Adding RemoveTrustedPublisher property. Its value is 'C:\Program Files\Sophos\Sophos Network Threat Protection\SophosNTPLWF\SophosNTPLWF.cat'. Action start 22:03:33: RemoveTrustedPublisher.Property. MSI (s) (80:B0) [22:03:33:559]: Doing action: RemoveTrustedPublisher MSI (s) (80:B0) [22:03:33:559]: Note: 1: 2205 2: 3: ActionText Action ended 22:03:33: RemoveTrustedPublisher.Property. Return value 1. Action start 22:03:33: RemoveTrustedPublisher. MSI (s) (80:B0) [22:03:33:559]: Doing action: StartServices MSI (s) (80:B0) [22:03:33:559]: Note: 1: 2205 2: 3: ActionText Action ended 22:03:33: RemoveTrustedPublisher. Return value 1. Action start 22:03:33: StartServices. MSI (s) (80:B0) [22:03:33:575]: Doing action: RegisterHbtManagementAdapterRollback MSI (s) (80:B0) [22:03:33:575]: Note: 1: 2205 2: 3: ActionText Action ended 22:03:33: StartServices. Return value 1. Action start 22:03:33: RegisterHbtManagementAdapterRollback. MSI (s) (80:B0) [22:03:33:575]: Doing action: SetRegisterHbtManagementAdapter MSI (s) (80:B0) [22:03:33:575]: Note: 1: 2205 2: 3: ActionText Action ended 22:03:33: RegisterHbtManagementAdapterRollback. Return value 1. MSI (s) (80:B0) [22:03:33:575]: PROPERTY CHANGE: Adding RegisterHbtManagementAdapter property. Its value is 'C:\Program Files\Sophos\Sophos Network Threat Protection\HbtAdapter.dll'. Action start 22:03:33: SetRegisterHbtManagementAdapter. MSI (s) (80:B0) [22:03:33:575]: Doing action: RegisterHbtManagementAdapter MSI (s) (80:B0) [22:03:33:575]: Note: 1: 2205 2: 3: ActionText Action ended 22:03:33: SetRegisterHbtManagementAdapter. Return value 1. Action start 22:03:33: RegisterHbtManagementAdapter. MSI (s) (80:B0) [22:03:33:591]: Doing action: RegisterManagementAdapterRollback MSI (s) (80:B0) [22:03:33:591]: Note: 1: 2205 2: 3: ActionText Action ended 22:03:33: RegisterHbtManagementAdapter. Return value 1. Action start 22:03:33: RegisterManagementAdapterRollback. MSI (s) (80:B0) [22:03:33:591]: Doing action: SetRegisterManagementAdapter MSI (s) (80:B0) [22:03:33:591]: Note: 1: 2205 2: 3: ActionText Action ended 22:03:33: RegisterManagementAdapterRollback. Return value 1. MSI (s) (80:B0) [22:03:33:591]: PROPERTY CHANGE: Adding RegisterManagementAdapter property. Its value is 'C:\Program Files\Sophos\Sophos Network Threat Protection\NTPAdapter.dll'. Action start 22:03:33: SetRegisterManagementAdapter. MSI (s) (80:B0) [22:03:33:591]: Doing action: RegisterManagementAdapter MSI (s) (80:B0) [22:03:33:591]: Note: 1: 2205 2: 3: ActionText Action ended 22:03:33: SetRegisterManagementAdapter. Return value 1. Action start 22:03:33: RegisterManagementAdapter. MSI (s) (80:B0) [22:03:33:606]: Doing action: RegisterUser MSI (s) (80:B0) [22:03:33:606]: Note: 1: 2205 2: 3: ActionText Action ended 22:03:33: RegisterManagementAdapter. Return value 1. Action start 22:03:33: RegisterUser. MSI (s) (80:B0) [22:03:33:606]: Doing action: RegisterProduct MSI (s) (80:B0) [22:03:33:606]: Note: 1: 2205 2: 3: ActionText Action ended 22:03:33: RegisterUser. Return value 1. Action start 22:03:33: RegisterProduct. MSI (s) (80:B0) [22:03:33:606]: PROPERTY CHANGE: Adding ProductToBeRegistered property. Its value is '1'. MSI (s) (80:B0) [22:03:33:606]: Doing action: PublishFeatures MSI (s) (80:B0) [22:03:33:606]: Note: 1: 2205 2: 3: ActionText Action ended 22:03:33: RegisterProduct. Return value 1. Action start 22:03:33: PublishFeatures. MSI (s) (80:B0) [22:03:33:606]: Doing action: PublishProduct MSI (s) (80:B0) [22:03:33:606]: Note: 1: 2205 2: 3: ActionText Action ended 22:03:33: PublishFeatures. Return value 1. Action start 22:03:33: PublishProduct. MSI (s) (80:B0) [22:03:33:606]: Skipping action: WixFailWhenDeferred (condition is false) MSI (s) (80:B0) [22:03:33:606]: Doing action: InstallFinalize MSI (s) (80:B0) [22:03:33:606]: Note: 1: 2205 2: 3: ActionText Action ended 22:03:33: PublishProduct. Return value 1. MSI (s) (80:B0) [22:03:33:606]: Running Script: C:\windows\Installer\MSI72BF.tmp MSI (s) (80:B0) [22:03:33:606]: PROPERTY CHANGE: Adding UpdateStarted property. Its value is '1'. MSI (s) (80:B0) [22:03:33:606]: Machine policy value 'DisableRollback' is 0 MSI (s) (80:B0) [22:03:33:606]: Note: 1: 2318 2: MSI (s) (80:B0) [22:03:33:606]: Note: 1: 1402 2: HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Installer\Rollback\Scripts 3: 2 MSI (s) (80:B0) [22:03:33:606]: Executing op: Header(Signature=1397708873,Version=500,Timestamp=1358278769,LangId=1033,Platform=589824,ScriptType=1,ScriptMajorVersion=21,ScriptMinorVersion=4,ScriptAttributes=1) Action start 22:03:33: InstallFinalize. MSI (s) (80:B0) [22:03:33:622]: Executing op: ProductInfo(ProductKey={4B1F9009-CD85-43C0-BCBD-D491908D5A52},ProductName=Sophos Network Threat Protection,PackageName=Sophos Network Threat Protection.msi,Language=1033,Version=17369413,Assignment=1,ObsoleteArg=0,ProductIcon=shield.ico,,PackageCode={33601027-BB79-4C6F-B891-2D4A958AED7F},,,InstanceType=0,LUASetting=0,RemoteURTInstalls=0,ProductDeploymentFlags=3) MSI (s) (80:B0) [22:03:33:622]: Executing op: DialogInfo(Type=0,Argument=1033) MSI (s) (80:B0) [22:03:33:622]: Executing op: DialogInfo(Type=1,Argument=Sophos Network Threat Protection) MSI (s) (80:B0) [22:03:33:622]: Executing op: RollbackInfo(,RollbackAction=Rollback,RollbackDescription=Rolling back action:,RollbackTemplate=[1],CleanupAction=RollbackCleanup,CleanupDescription=Removing backup files,CleanupTemplate=File: [1]) MSI (s) (80:B0) [22:03:33:622]: Executing op: SetBaseline(Baseline=0,) MSI (s) (80:B0) [22:03:33:622]: Executing op: SetBaseline(Baseline=1,) MSI (s) (80:B0) [22:03:33:622]: Executing op: ActionStart(Name=CheckMaxNumFilters,,) MSI (s) (80:B0) [22:03:33:622]: Executing op: CustomActionSchedule(Action=CheckMaxNumFilters,ActionType=1025,Source=BinaryData,Target=CheckMaxNumFilters,) MSI (s) (80:B0) [22:03:33:622]: Creating MSIHANDLE (90) of type 790536 for thread 7600 MSI (s) (80:6C) [22:03:33:622]: Invoking remote custom action. DLL: C:\windows\Installer\MSI7600.tmp, Entrypoint: CheckMaxNumFilters MSI (s) (80!60) [22:03:33:653]: Creating MSIHANDLE (91) of type 790531 for thread 6752 MSI (s) (80!60) [22:03:33:653]: Closing MSIHANDLE (91) of type 790531 for thread 6752 MSI (s) (80!60) [22:03:33:653]: Creating MSIHANDLE (92) of type 790531 for thread 6752 CheckMaxNumFilters: Entering CheckMaxNumFilters in C:\windows\Installer\MSI7600.tmp, version 1.9.2373.0 MSI (s) (80!60) [22:03:33:653]: Closing MSIHANDLE (92) of type 790531 for thread 6752 MSI (s) (80!60) [22:03:33:653]: Creating MSIHANDLE (93) of type 790531 for thread 6752 CheckMaxNumFilters: CheckMaxNumFilters called MSI (s) (80!60) [22:03:33:653]: Closing MSIHANDLE (93) of type 790531 for thread 6752 MSI (s) (80!60) [22:03:33:653]: Creating MSIHANDLE (94) of type 790531 for thread 6752 CheckMaxNumFilters: MaxNumFilters is 8 MSI (s) (80!60) [22:03:33:653]: Closing MSIHANDLE (94) of type 790531 for thread 6752 MSI (s) (80!60) [22:03:33:653]: Creating MSIHANDLE (95) of type 790531 for thread 6752 CheckMaxNumFilters: checking subkey: 1 MSI (s) (80!60) [22:03:33:653]: Closing MSIHANDLE (95) of type 790531 for thread 6752 MSI (s) (80!60) [22:03:33:653]: Creating MSIHANDLE (96) of type 790531 for thread 6752 CheckMaxNumFilters: subkey name: {0EFE03B2-EA87-44C1-B825-9BBEA54F37B4} MSI (s) (80!60) [22:03:33:653]: Closing MSIHANDLE (96) of type 790531 for thread 6752 MSI (s) (80!60) [22:03:33:653]: Creating MSIHANDLE (97) of type 790531 for thread 6752 CheckMaxNumFilters: checking subkey: 2 MSI (s) (80!60) [22:03:33:653]: Closing MSIHANDLE (97) of type 790531 for thread 6752 MSI (s) (80!60) [22:03:33:653]: Creating MSIHANDLE (98) of type 790531 for thread 6752 CheckMaxNumFilters: subkey name: {56494156-6C00-4B77-90D7-A4A435088232} MSI (s) (80!60) [22:03:33:653]: Closing MSIHANDLE (98) of type 790531 for thread 6752 MSI (s) (80!60) [22:03:33:653]: Creating MSIHANDLE (99) of type 790531 for thread 6752 CheckMaxNumFilters: checking subkey: 3 MSI (s) (80!60) [22:03:33:653]: Closing MSIHANDLE (99) of type 790531 for thread 6752 MSI (s) (80!60) [22:03:33:653]: Creating MSIHANDLE (100) of type 790531 for thread 6752 CheckMaxNumFilters: subkey name: {6B7E8FF8-E9A2-46EB-A4EA-42CCA2D43C96} MSI (s) (80!60) [22:03:33:653]: Closing MSIHANDLE (100) of type 790531 for thread 6752 MSI (s) (80!60) [22:03:33:653]: Creating MSIHANDLE (101) of type 790531 for thread 6752 CheckMaxNumFilters: checking subkey: 4 MSI (s) (80!60) [22:03:33:653]: Closing MSIHANDLE (101) of type 790531 for thread 6752 MSI (s) (80!60) [22:03:33:653]: Creating MSIHANDLE (102) of type 790531 for thread 6752 CheckMaxNumFilters: subkey name: {B5F4D659-7DAA-4565-8E41-BE220ED60542} MSI (s) (80!60) [22:03:33:653]: Closing MSIHANDLE (102) of type 790531 for thread 6752 MSI (s) (80!60) [22:03:33:653]: Creating MSIHANDLE (103) of type 790531 for thread 6752 CheckMaxNumFilters: filter found in subkey path: SYSTEM\CurrentControlSet\Control\Network\{4d36e974-e325-11ce-bfc1-08002be10318}\{B5F4D659-7DAA-4565-8E41-BE220ED60542}\Ndi MSI (s) (80!60) [22:03:33:653]: Closing MSIHANDLE (103) of type 790531 for thread 6752 MSI (s) (80!60) [22:03:33:653]: Creating MSIHANDLE (104) of type 790531 for thread 6752 CheckMaxNumFilters: checking subkey: 5 MSI (s) (80!60) [22:03:33:653]: Closing MSIHANDLE (104) of type 790531 for thread 6752 MSI (s) (80!60) [22:03:33:653]: Creating MSIHANDLE (105) of type 790531 for thread 6752 CheckMaxNumFilters: subkey name: {B70D6460-3635-4D42-B866-B8AB1A24454C} MSI (s) (80!60) [22:03:33:653]: Closing MSIHANDLE (105) of type 790531 for thread 6752 MSI (s) (80!60) [22:03:33:653]: Creating MSIHANDLE (106) of type 790531 for thread 6752 CheckMaxNumFilters: filter found in subkey path: SYSTEM\CurrentControlSet\Control\Network\{4d36e974-e325-11ce-bfc1-08002be10318}\{B70D6460-3635-4D42-B866-B8AB1A24454C}\Ndi MSI (s) (80!60) [22:03:33:653]: Closing MSIHANDLE (106) of type 790531 for thread 6752 MSI (s) (80!60) [22:03:33:653]: Creating MSIHANDLE (107) of type 790531 for thread 6752 CheckMaxNumFilters: checking subkey: 6 MSI (s) (80!60) [22:03:33:653]: Closing MSIHANDLE (107) of type 790531 for thread 6752 MSI (s) (80!60) [22:03:33:653]: Creating MSIHANDLE (108) of type 790531 for thread 6752 CheckMaxNumFilters: subkey name: {C9548B78-5743-4E64-9BA1-CD4D974A329F} MSI (s) (80!60) [22:03:33:653]: Closing MSIHANDLE (108) of type 790531 for thread 6752 MSI (s) (80!60) [22:03:33:653]: Creating MSIHANDLE (109) of type 790531 for thread 6752 CheckMaxNumFilters: checking subkey: 7 MSI (s) (80!60) [22:03:33:653]: Closing MSIHANDLE (109) of type 790531 for thread 6752 MSI (s) (80!60) [22:03:33:653]: Creating MSIHANDLE (110) of type 790531 for thread 6752 CheckMaxNumFilters: subkey name: {E475CF9A-60CD-4439-A75F-0079CE0E18A1} MSI (s) (80!60) [22:03:33:653]: Closing MSIHANDLE (110) of type 790531 for thread 6752 MSI (s) (80!60) [22:03:33:653]: Creating MSIHANDLE (111) of type 790531 for thread 6752 CheckMaxNumFilters: filter found in subkey path: SYSTEM\CurrentControlSet\Control\Network\{4d36e974-e325-11ce-bfc1-08002be10318}\{E475CF9A-60CD-4439-A75F-0079CE0E18A1}\Ndi MSI (s) (80!60) [22:03:33:653]: Closing MSIHANDLE (111) of type 790531 for thread 6752 MSI (s) (80!60) [22:03:33:653]: Creating MSIHANDLE (112) of type 790531 for thread 6752 CheckMaxNumFilters: checking subkey: 8 MSI (s) (80!60) [22:03:33:653]: Closing MSIHANDLE (112) of type 790531 for thread 6752 MSI (s) (80!60) [22:03:33:653]: Creating MSIHANDLE (113) of type 790531 for thread 6752 CheckMaxNumFilters: subkey name: {EA24CD6C-D17A-4348-9190-09F0D5BE83DD} MSI (s) (80!60) [22:03:33:653]: Closing MSIHANDLE (113) of type 790531 for thread 6752 MSI (s) (80!60) [22:03:33:653]: Creating MSIHANDLE (114) of type 790531 for thread 6752 CheckMaxNumFilters: filter found in subkey path: SYSTEM\CurrentControlSet\Control\Network\{4d36e974-e325-11ce-bfc1-08002be10318}\{EA24CD6C-D17A-4348-9190-09F0D5BE83DD}\Ndi MSI (s) (80!60) [22:03:33:653]: Closing MSIHANDLE (114) of type 790531 for thread 6752 MSI (s) (80!60) [22:03:33:653]: Creating MSIHANDLE (115) of type 790531 for thread 6752 CheckMaxNumFilters: checking subkey: 9 MSI (s) (80!60) [22:03:33:653]: Closing MSIHANDLE (115) of type 790531 for thread 6752 MSI (s) (80!60) [22:03:33:653]: Creating MSIHANDLE (116) of type 790531 for thread 6752 CheckMaxNumFilters: subkey name: {F5658C39-CD0D-45B5-A342-E2C037714CE4} MSI (s) (80!60) [22:03:33:653]: Closing MSIHANDLE (116) of type 790531 for thread 6752 MSI (s) (80:6C) [22:03:33:653]: Closing MSIHANDLE (90) of type 790536 for thread 7600 MSI (s) (80:B0) [22:03:33:669]: Executing op: ActionStart(Name=ProcessComponents,Description=Updating component registration,) CheckMaxNumFilters: filters found 4 MSI (s) (80:B0) [22:03:33:669]: Executing op: ProgressTotal(Total=38,Type=1,ByteEquivalent=24000) MSI (s) (80:B0) [22:03:33:669]: Executing op: ComponentRegister(ComponentId={07B90057-705F-44F2-8465-C2A4C77784E7},KeyPath=C:\Program Files\Sophos\Sophos Network Threat Protection\,State=3,,Disk=1,SharedDllRefCount=0,BinaryType=1) MSI (s) (80:B0) [22:03:33:669]: Executing op: ComponentRegister(ComponentId={E1E87C49-DD4A-4C77-8D42-3ACD20DBC536},KeyPath=C:\ProgramData\Sophos\Sophos Network Threat Protection\,State=3,,Disk=1,SharedDllRefCount=0,BinaryType=1) MSI (s) (80:B0) [22:03:33:669]: Executing op: ComponentRegister(ComponentId={4D81D62C-8373-45B8-ABF2-0C0D6ED2DE34},KeyPath=C:\ProgramData\Sophos\Sophos Network Threat Protection\Config\,State=3,,Disk=1,SharedDllRefCount=0,BinaryType=1) MSI (s) (80:B0) [22:03:33:669]: Executing op: ComponentRegister(ComponentId={74F91047-4C42-457F-B531-A83EF6EC85E2},KeyPath=C:\ProgramData\Sophos\Sophos Network Threat Protection\Config\Status\,State=3,,Disk=1,SharedDllRefCount=0,BinaryType=1) MSI (s) (80:B0) [22:03:33:669]: Executing op: ComponentRegister(ComponentId={F1B8B8D7-46D7-4CA9-B109-35931536EA8A},KeyPath=C:\ProgramData\Sophos\Sophos Network Threat Protection\Logs\,State=3,,Disk=1,SharedDllRefCount=0,BinaryType=1) MSI (s) (80:B0) [22:03:33:669]: Executing op: ComponentRegister(ComponentId={270CF92A-C3C0-4385-B596-337555FE9560},KeyPath=C:\ProgramData\Sophos\Sophos Network Threat Protection\IPS\,State=3,,Disk=1,SharedDllRefCount=0,BinaryType=1) MSI (s) (80:B0) [22:03:33:669]: Executing op: ComponentRegister(ComponentId={8D83ACDA-6DCE-41F3-B5C1-7C01BD45026C},KeyPath=C:\ProgramData\Sophos\Heartbeat\,State=3,,Disk=1,SharedDllRefCount=0,BinaryType=1) MSI (s) (80:B0) [22:03:33:669]: Executing op: ComponentRegister(ComponentId={14456086-9032-4E19-9F29-9F1F9DD21F4E},KeyPath=C:\ProgramData\Sophos\Heartbeat\Config\,State=3,,Disk=1,SharedDllRefCount=0,BinaryType=1) MSI (s) (80:B0) [22:03:33:669]: Executing op: ComponentRegister(ComponentId={9DAD77F9-1B7B-4731-8A40-3EC32A42ACC7},KeyPath=C:\ProgramData\Sophos\Heartbeat\Logs\,State=3,,Disk=1,SharedDllRefCount=0,BinaryType=1) MSI (s) (80:B0) [22:03:33:669]: Executing op: ComponentRegister(ComponentId={43CBB64E-B6FD-496B-8B4D-9D8842C8E5B2},KeyPath=C:\ProgramData\Sophos\Heartbeat\Persist\,State=3,,Disk=1,SharedDllRefCount=0,BinaryType=1) MSI (s) (80:B0) [22:03:33:669]: Executing op: ComponentRegister(ComponentId={76F354A6-97D5-4872-9781-2F2642A4F18A},KeyPath=C:\Program Files\Sophos\Sophos Network Threat Protection\Sntp.sys,State=3,,Disk=1,SharedDllRefCount=0,BinaryType=1) MSI (s) (80:B0) [22:03:33:669]: Executing op: ComponentRegister(ComponentId={FC337C28-D909-4BF7-826A-F06F35C592F8},KeyPath=C:\Program Files\Sophos\Sophos Network Threat Protection\SophosNTPLWF\SophosNTPLWF.sys,State=3,,Disk=1,SharedDllRefCount=0,BinaryType=1) MSI (s) (80:B0) [22:03:33:669]: Executing op: ComponentRegister(ComponentId={355DC0F9-A6B5-4FCA-8121-00847E59A436},KeyPath=C:\Program Files\Sophos\Sophos Network Threat Protection\navl.dll,State=3,,Disk=1,SharedDllRefCount=1,BinaryType=1) MSI (s) (80:B0) [22:03:33:684]: Executing op: ComponentRegister(ComponentId={173F7C99-1A05-4365-B40A-D4EE897D94DE},KeyPath=C:\Program Files\Sophos\Sophos Network Threat Protection\integrity.dat,State=3,,Disk=1,SharedDllRefCount=0,BinaryType=1) MSI (s) (80:B0) [22:03:33:684]: Executing op: ComponentRegister(ComponentId={38879DEA-36FA-41BE-ACF3-B084CB40689B},KeyPath=C:\Program Files\Sophos\Sophos Network Threat Protection\,State=3,,Disk=1,SharedDllRefCount=0,BinaryType=1) MSI (s) (80:B0) [22:03:33:684]: Executing op: ComponentRegister(ComponentId={8E48EE2F-1444-46BF-BCD4-B5F66A4AFF10},,State=-7,,Disk=1,SharedDllRefCount=0,BinaryType=1) MSI (s) (80:B0) [22:03:33:684]: Executing op: ComponentRegister(ComponentId={B7D2E43B-E8A6-4483-9BF7-5195F70225EF},KeyPath=C:\Program Files\Sophos\Sophos Network Threat Protection\SophosNtpService.exe,State=3,,Disk=1,SharedDllRefCount=0,BinaryType=1) MSI (s) (80:B0) [22:03:33:684]: Executing op: ComponentRegister(ComponentId={DF927ABB-6A5F-44F2-A430-137AAC79AA71},KeyPath=22:\SYSTEM\CurrentControlSet\Control\SafeBoot\Network\SntpService\,State=3,,Disk=1,SharedDllRefCount=0,BinaryType=1) MSI (s) (80:B0) [22:03:33:684]: Executing op: ComponentRegister(ComponentId={4E691ABE-115D-4721-9F9A-3547D17077C5},KeyPath=C:\Program Files\Sophos\Sophos Network Threat Protection\NTPAdapter.dll,State=3,,Disk=1,SharedDllRefCount=0,BinaryType=1) MSI (s) (80:B0) [22:03:33:684]: Executing op: ComponentRegister(ComponentId={668853A5-00CE-412E-B21F-0721B6A8A0A9},KeyPath=C:\Program Files\Sophos\Sophos Network Threat Protection\Heartbeat.dll,State=3,,Disk=1,SharedDllRefCount=0,BinaryType=1) MSI (s) (80:B0) [22:03:33:684]: Executing op: ComponentRegister(ComponentId={53CBCC30-891C-4EDC-9106-456F524A7547},KeyPath=C:\,State=3,,Disk=1,SharedDllRefCount=0,BinaryType=0) MSI (s) (80:B0) [22:03:33:684]: Executing op: ComponentRegister(ComponentId={B77F9317-494B-4351-897B-D7676F0A553D},KeyPath=C:\,State=3,,Disk=1,SharedDllRefCount=0,BinaryType=1) MSI (s) (80:B0) [22:03:33:684]: Executing op: ComponentRegister(ComponentId={4385E7B8-9B0B-4766-ACD7-EDA6DE4B1AE1},KeyPath=C:\ProgramData\Sophos\Heartbeat\Config\Heartbeat.xml,State=3,,Disk=1,SharedDllRefCount=0,BinaryType=1) MSI (s) (80:B0) [22:03:33:684]: Executing op: ComponentRegister(ComponentId={4385E7B8-9B0B-4766-ACD7-EDA6DE4B1AE1},KeyPath=C:\ProgramData\Sophos\Heartbeat\Config\Heartbeat.xml,State=3,ProductKey={00000000-0000-0000-0000-000000000000},Disk=1,SharedDllRefCount=0,BinaryType=1) MSI (s) (80:B0) [22:03:33:684]: Executing op: ComponentRegister(ComponentId={D27928F9-1751-4CE1-817A-C94C9DDFA521},KeyPath=C:\Program Files\Sophos\Sophos Network Threat Protection\Notice.txt,State=3,,Disk=1,SharedDllRefCount=0,BinaryType=1) MSI (s) (80:B0) [22:03:33:700]: Executing op: ComponentRegister(ComponentId={1FCDB37D-595F-4837-919B-EC3B0753CEA3},KeyPath=C:\Program Files\Sophos\Sophos Network Threat Protection\HealthApi.dll,State=3,,Disk=1,SharedDllRefCount=0,BinaryType=1) MSI (s) (80:B0) [22:03:33:700]: Executing op: ComponentRegister(ComponentId={BE16C094-CC09-4502-8856-ED495E915D2D},KeyPath=C:\Program Files\Sophos\Sophos Network Threat Protection\HbtAdapter.dll,State=3,,Disk=1,SharedDllRefCount=0,BinaryType=1) MSI (s) (80:B0) [22:03:33:700]: Executing op: ComponentRegister(ComponentId={B9C8E32A-5EB9-4B7F-91AF-9FD883FB729C},KeyPath=C:\Program Files\Sophos\Sophos Network Threat Protection\BPAIF.dll,State=3,,Disk=1,SharedDllRefCount=1,BinaryType=1) MSI (s) (80:B0) [22:03:33:700]: Executing op: ComponentRegister(ComponentId={6EFE6551-BEDB-470F-9B98-4DD9D50BD010},KeyPath=C:\Program Files\Sophos\Sophos Network Threat Protection\SophosNtpTelemetry.exe,State=3,,Disk=1,SharedDllRefCount=0,BinaryType=1) MSI (s) (80:B0) [22:03:33:700]: Executing op: ComponentRegister(ComponentId={5FDACC4C-306D-434E-8DF0-F356318B9B39},KeyPath=02:\Software\Sophos\Telemetry\Plugins\NTP\Path,State=3,,Disk=1,SharedDllRefCount=0,BinaryType=0) MSI (s) (80:B0) [22:03:33:700]: Executing op: ComponentRegister(ComponentId={1B63A9FF-509B-4CD9-BA54-256A7D62B724},KeyPath=C:\,State=3,,Disk=1,SharedDllRefCount=0,BinaryType=0) MSI (s) (80:B0) [22:03:33:700]: Executing op: ComponentRegister(ComponentId={7C58F223-7247-466F-BFB7-7AFCF335E96D},KeyPath=C:\Program Files\Sophos\Sophos Network Threat Protection\scf.dat,State=3,,Disk=1,SharedDllRefCount=0,BinaryType=1) MSI (s) (80:B0) [22:03:33:700]: Executing op: ComponentRegister(ComponentId={73F7BF07-5A6C-45CF-B42D-786698434BCA},KeyPath=C:\Program Files\Sophos\Sophos Network Threat Protection\sof.dat,State=3,,Disk=1,SharedDllRefCount=0,BinaryType=1) MSI (s) (80:B0) [22:03:33:700]: Executing op: ComponentRegister(ComponentId={0835C947-D6D2-4E52-AF14-0231D04E88EA},KeyPath=C:\windows\SysWOW64\msvcr120.dll,State=3,,Disk=1,SharedDllRefCount=1,BinaryType=0) MSI (s) (80:B0) [22:03:33:700]: WIN64DUALFOLDERS: 'C:\windows\system32\' will substitute 20 characters in 'C:\windows\SysWOW64\msvcr120.dll' folder path. (mask argument = 1, the folder pair's iSwapAttrib member = 1). MSI (s) (80:B0) [22:03:33:700]: WIN64DUALFOLDERS: 'C:\windows\system32\' will substitute 20 characters in 'C:\windows\SysWOW64\msvcr120.dll' folder path. (mask argument = 1, the folder pair's iSwapAttrib member = 1). MSI (s) (80:B0) [22:03:33:700]: Executing op: ComponentRegister(ComponentId={74260D9F-D644-423B-B2D4-0291EA4BA8BE},KeyPath=C:\windows\SysWOW64\msvcp120.dll,State=3,,Disk=1,SharedDllRefCount=1,BinaryType=0) MSI (s) (80:B0) [22:03:33:700]: WIN64DUALFOLDERS: 'C:\windows\system32\' will substitute 20 characters in 'C:\windows\SysWOW64\msvcp120.dll' folder path. (mask argument = 1, the folder pair's iSwapAttrib member = 1). MSI (s) (80:B0) [22:03:33:700]: WIN64DUALFOLDERS: 'C:\windows\system32\' will substitute 20 characters in 'C:\windows\SysWOW64\msvcp120.dll' folder path. (mask argument = 1, the folder pair's iSwapAttrib member = 1). MSI (s) (80:B0) [22:03:33:700]: Executing op: ComponentRegister(ComponentId={63B83B20-1AB9-4F49-B0B2-4489724CA96C},KeyPath=C:\windows\SysWOW64\vccorlib120.dll,State=3,,Disk=1,SharedDllRefCount=1,BinaryType=0) MSI (s) (80:B0) [22:03:33:700]: WIN64DUALFOLDERS: 'C:\windows\system32\' will substitute 20 characters in 'C:\windows\SysWOW64\vccorlib120.dll' folder path. (mask argument = 1, the folder pair's iSwapAttrib member = 1). MSI (s) (80:B0) [22:03:33:700]: WIN64DUALFOLDERS: 'C:\windows\system32\' will substitute 20 characters in 'C:\windows\SysWOW64\vccorlib120.dll' folder path. (mask argument = 1, the folder pair's iSwapAttrib member = 1). MSI (s) (80:B0) [22:03:33:700]: Executing op: ComponentRegister(ComponentId={E5B92048-5859-4AF1-AEAD-B97EBF00B087},KeyPath=C:\windows\system32\msvcr120.dll,State=3,,Disk=1,SharedDllRefCount=1,BinaryType=1) MSI (s) (80:B0) [22:03:33:700]: Executing op: ComponentRegister(ComponentId={570C624B-D57C-4CD1-9013-1B80C800093B},KeyPath=C:\windows\system32\msvcp120.dll,State=3,,Disk=1,SharedDllRefCount=1,BinaryType=1) MSI (s) (80:B0) [22:03:33:715]: Executing op: ComponentRegister(ComponentId={14E8634F-8AEA-4CD1-AC48-BEBFDA18523A},KeyPath=C:\windows\system32\vccorlib120.dll,State=3,,Disk=1,SharedDllRefCount=1,BinaryType=1) MSI (s) (80:B0) [22:03:33:715]: Executing op: ProgressTotal(Total=1,Type=1,ByteEquivalent=13200) MSI (s) (80:B0) [22:03:33:715]: Executing op: RegOpenKey(Root=-2147483646,Key=SOFTWARE\Microsoft\Windows\CurrentVersion\SharedDLLs,,BinaryType=0,,) MSI (s) (80:B0) [22:03:33:715]: Executing op: ProgressTick() MSI (s) (80:B0) [22:03:33:715]: Executing op: ProgressTotal(Total=1,Type=1,ByteEquivalent=13200) MSI (s) (80:B0) [22:03:33:715]: Executing op: RegOpenKey(Root=-2147483646,Key=SOFTWARE\Microsoft\Windows\CurrentVersion\SharedDLLs,,BinaryType=0,,) MSI (s) (80:B0) [22:03:33:715]: Executing op: ProgressTick() MSI (s) (80:B0) [22:03:33:715]: Executing op: ProgressTotal(Total=1,Type=1,ByteEquivalent=13200) MSI (s) (80:B0) [22:03:33:715]: Executing op: RegOpenKey(Root=-2147483646,Key=SOFTWARE\Microsoft\Windows\CurrentVersion\SharedDLLs,,BinaryType=0,,) MSI (s) (80:B0) [22:03:33:715]: Executing op: ProgressTick() MSI (s) (80:B0) [22:03:33:715]: Executing op: ProgressTotal(Total=1,Type=1,ByteEquivalent=13200) MSI (s) (80:B0) [22:03:33:715]: Executing op: RegOpenKey(Root=-2147483646,Key=SOFTWARE\Microsoft\Windows\CurrentVersion\SharedDLLs,,BinaryType=1,,) MSI (s) (80:B0) [22:03:33:715]: Executing op: ProgressTick() MSI (s) (80:B0) [22:03:33:715]: Executing op: ProgressTotal(Total=1,Type=1,ByteEquivalent=13200) MSI (s) (80:B0) [22:03:33:715]: Executing op: RegOpenKey(Root=-2147483646,Key=SOFTWARE\Microsoft\Windows\CurrentVersion\SharedDLLs,,BinaryType=1,,) MSI (s) (80:B0) [22:03:33:715]: Executing op: ProgressTick() MSI (s) (80:B0) [22:03:33:715]: Executing op: ProgressTotal(Total=1,Type=1,ByteEquivalent=13200) MSI (s) (80:B0) [22:03:33:715]: Executing op: RegOpenKey(Root=-2147483646,Key=SOFTWARE\Microsoft\Windows\CurrentVersion\SharedDLLs,,BinaryType=1,,) MSI (s) (80:B0) [22:03:33:715]: Executing op: ProgressTick() MSI (s) (80:B0) [22:03:33:715]: Executing op: ActionStart(Name=StopServices,Description=Stopping services,Template=Service: [1]) MSI (s) (80:B0) [22:03:33:715]: Executing op: ProgressTotal(Total=1,Type=1,ByteEquivalent=1300000) MSI (s) (80:B0) [22:03:33:715]: Executing op: ServiceControl(,Name=SntpService,Action=2,Wait=1,) MSI (s) (80:B0) [22:03:33:715]: Executing op: ActionStart(Name=UnregisterSntpEventManifestRollback,,) MSI (s) (80:B0) [22:03:33:715]: Executing op: CustomActionSchedule(Action=UnregisterSntpEventManifestRollback,ActionType=3393,Source=BinaryData,Target=WixQuietExec,CustomActionData="wevtutil.exe" im "C:\Program Files\Sophos\Sophos Network Threat Protection\Sntp.man") MSI (s) (80:B0) [22:03:33:715]: Executing op: ActionStart(Name=UnregisterSntpEventManifest,,) MSI (s) (80:B0) [22:03:33:715]: Executing op: CustomActionSchedule(Action=UnregisterSntpEventManifest,ActionType=3137,Source=BinaryData,Target=WixQuietExec,CustomActionData="wevtutil.exe" um "C:\Program Files\Sophos\Sophos Network Threat Protection\Sntp.man") MSI (s) (80:B0) [22:03:33:715]: Creating MSIHANDLE (117) of type 790536 for thread 7600 MSI (s) (80:60) [22:03:33:715]: Invoking remote custom action. DLL: C:\windows\Installer\MSI765F.tmp, Entrypoint: WixQuietExec MSI (s) (80!E4) [22:03:33:715]: Creating MSIHANDLE (118) of type 790531 for thread 2532 MSI (s) (80!E4) [22:03:33:715]: Closing MSIHANDLE (118) of type 790531 for thread 2532 MSI (s) (80!E4) [22:03:33:715]: Creating MSIHANDLE (119) of type 790531 for thread 2532 WixQuietExec: Entering WixQuietExec in C:\windows\Installer\MSI765F.tmp, version 3.11.2318.0 MSI (s) (80!E4) [22:03:33:715]: Closing MSIHANDLE (119) of type 790531 for thread 2532 MSI (s) (80!E4) [22:03:33:918]: Creating MSIHANDLE (120) of type 790531 for thread 2532 WixQuietExec: "wevtutil.exe" um "C:\Program Files\Sophos\Sophos Network Threat Protection\Sntp.man" MSI (s) (80!E4) [22:03:33:918]: Closing MSIHANDLE (120) of type 790531 for thread 2532 MSI (s) (80!E4) [22:03:33:918]: Creating MSIHANDLE (121) of type 790531 for thread 2532 WixQuietExec: C:\Program Files\Sophos\Sophos Network Threat Protection\Sntp.man(0): Error 0x800c0005: At column=0, The system cannot locate the resource specified. MSI (s) (80!E4) [22:03:33:918]: Closing MSIHANDLE (121) of type 790531 for thread 2532 MSI (s) (80!E4) [22:03:33:918]: Creating MSIHANDLE (122) of type 790531 for thread 2532 WixQuietExec: MSI (s) (80!E4) [22:03:33:918]: Closing MSIHANDLE (122) of type 790531 for thread 2532 MSI (s) (80:60) [22:03:33:934]: Closing MSIHANDLE (117) of type 790536 for thread 7600 MSI (s) (80:B0) [22:03:33:934]: Executing op: ActionStart(Name=RemoveRegistryValues,Description=Removing system registry values,Template=Key: [1], Name: [2]) WixQuietExec: Failed to load xml document C:\Program Files\Sophos\Sophos Network Threat Protection\Sntp.man. Incorrect function. MSI (s) (80:B0) [22:03:33:934]: Executing op: ProgressTotal(Total=3,Type=1,ByteEquivalent=13200) MSI (s) (80:B0) [22:03:33:934]: Executing op: RegOpenKey(Root=-2147483646,Key=Software\Sophos\AutoUpdate\Products\NTP64,,BinaryType=0,,) MSI (s) (80:B0) [22:03:33:934]: Executing op: RegRemoveKey() MSI (s) (80:B0) [22:03:33:934]: Note: 1: 1402 2: HKEY_LOCAL_MACHINE32\Software\Sophos\AutoUpdate\Products\NTP64 3: 2 MSI (s) (80:B0) [22:03:33:934]: Executing op: RegOpenKey(,Key=TypeLib\{6886D7DB-850A-4C92-A2F7-CBD741F825E5},,BinaryType=1,,) MSI (s) (80:B0) [22:03:33:934]: Executing op: RegRemoveKey() MSI (s) (80:B0) [22:03:33:934]: Note: 1: 1402 2: HKEY_LOCAL_MACHINE\Software\Classes\TypeLib\{6886D7DB-850A-4C92-A2F7-CBD741F825E5} 3: 2 MSI (s) (80:B0) [22:03:33:934]: Executing op: RegOpenKey(,Key=AppID\{C092D533-8791-42F8-8EBE-DB116F79B4B7},,BinaryType=1,,) MSI (s) (80:B0) [22:03:33:934]: Executing op: RegRemoveKey() MSI (s) (80:B0) [22:03:33:934]: Note: 1: 1402 2: HKEY_LOCAL_MACHINE\Software\Classes\AppID\{C092D533-8791-42F8-8EBE-DB116F79B4B7} 3: 2 MSI (s) (80:B0) [22:03:33:934]: Executing op: ActionStart(Name=CreateFolders,Description=Creating folders,Template=Folder: [1]) MSI (s) (80:B0) [22:03:33:934]: Executing op: FolderCreate(Folder=C:\Program Files\Sophos\Sophos Network Threat Protection\,Foreign=0,,SDDLText=O:BAG:SYD:PAI(A;OICI;FA;;;BA)(A;OICI;FA;;;SY)(A;OICI;FRFX;;;LS)(A;OICI;FRFX;;;BU)) MSI (s) (80:B0) [22:03:33:934]: Executing op: FolderCreate(Folder=C:\Program Files\Sophos\Sophos Network Threat Protection\,Foreign=0,,SDDLText=O:BAG:SYD:PAI(A;OICI;FA;;;BA)(A;OICI;FA;;;SY)(A;OICI;FRFX;;;LS)(A;OICI;FRFX;;;BU)) MSI (s) (80:B0) [22:03:33:934]: Executing op: FolderCreate(Folder=C:\ProgramData\Sophos\Sophos Network Threat Protection\,Foreign=0,,SDDLText=O:BAG:SYD:PAI(A;OICI;FA;;;BA)(A;OICI;FA;;;SY)(A;OICI;FA;;;LS)(A;OICI;FRFX;;;BU)) MSI (s) (80:B0) [22:03:33:934]: Executing op: FolderCreate(Folder=C:\ProgramData\Sophos\Sophos Network Threat Protection\Config\,Foreign=0,,SDDLText=O:BAG:SYD:AI(A;OICIID;FA;;;BA)(A;OICIID;FA;;;SY)(A;OICIID;FA;;;LS)(A;OICIID;FRFX;;;BU)) MSI (s) (80:B0) [22:03:33:934]: Executing op: FolderCreate(Folder=C:\ProgramData\Sophos\Sophos Network Threat Protection\Config\Status\,Foreign=0,,SDDLText=O:BAG:SYD:AI(A;OICIID;FA;;;BA)(A;OICIID;FA;;;SY)(A;OICIID;FA;;;LS)(A;OICIID;FRFX;;;BU)) MSI (s) (80:B0) [22:03:33:934]: Executing op: FolderCreate(Folder=C:\ProgramData\Sophos\Sophos Network Threat Protection\Logs\,Foreign=0,,SDDLText=O:BAG:SYD:AI(A;OICIID;FA;;;BA)(A;OICIID;FA;;;SY)(A;OICIID;FA;;;LS)(A;OICIID;FRFX;;;BU)) MSI (s) (80:B0) [22:03:33:934]: Executing op: FolderCreate(Folder=C:\ProgramData\Sophos\Sophos Network Threat Protection\IPS\,Foreign=0,,SDDLText=O:BAG:SYD:AI(A;OICIID;FA;;;BA)(A;OICIID;FA;;;SY)(A;OICIID;FA;;;LS)(A;OICIID;FRFX;;;BU)) MSI (s) (80:B0) [22:03:33:934]: Executing op: FolderCreate(Folder=C:\ProgramData\Sophos\Heartbeat\,Foreign=0,,SDDLText=O:BAG:SYD:PAI(A;OICI;FA;;;BA)(A;OICI;FA;;;SY)(A;OICI;FA;;;LS)(A;OICI;FRFX;;;BU)) MSI (s) (80:B0) [22:03:33:934]: Executing op: FolderCreate(Folder=C:\ProgramData\Sophos\Heartbeat\Config\,Foreign=0,,SDDLText=O:BAG:SYD:AI(A;OICIID;FA;;;BA)(A;OICIID;FA;;;SY)(A;OICIID;FA;;;LS)(A;OICIID;FRFX;;;BU)) MSI (s) (80:B0) [22:03:33:934]: Executing op: FolderCreate(Folder=C:\ProgramData\Sophos\Heartbeat\Logs\,Foreign=0,,SDDLText=O:BAG:SYD:AI(A;OICIID;FA;;;BA)(A;OICIID;FA;;;SY)(A;OICIID;FA;;;LS)(A;OICIID;FRFX;;;BU)) MSI (s) (80:B0) [22:03:33:949]: Executing op: FolderCreate(Folder=C:\ProgramData\Sophos\Heartbeat\Persist\,Foreign=0,,SDDLText=O:BAG:SYD:PAI(A;OICI;FA;;;BA)(A;OICI;FA;;;SY)(A;OICI;FA;;;LS)) MSI (s) (80:B0) [22:03:33:949]: Executing op: FolderCreate(Folder=C:\,Foreign=0,,) MSI (s) (80:B0) [22:03:33:949]: Executing op: ActionStart(Name=InstallFiles,Description=Copying new files,Template=File: [1], Directory: [9], Size: [6]) MSI (s) (80:B0) [22:03:33:949]: Executing op: ProgressTotal(Total=27451049,Type=0,ByteEquivalent=1) MSI (s) (80:B0) [22:03:33:949]: Executing op: SetTargetFolder(Folder=C:\Program Files\Sophos\Sophos Network Threat Protection\) MSI (s) (80:B0) [22:03:33:949]: Executing op: SetSourceFolder(Folder=1\Sophos\_tph7qnj\|Sophos\Sophos Network Threat Protection\) MSI (s) (80:B0) [22:03:33:949]: Executing op: ChangeMedia(,MediaPrompt=Please insert the disk: ,,BytesPerTick=65536,CopierType=0,,,,,,IsFirstPhysicalMedia=1) MSI (s) (80:B0) [22:03:33:949]: Executing op: FileCopySDDL(SourceName=BPAIF.dll,SourceCabKey=BPAIF.dll,DestName=BPAIF.dll,Attributes=512,FileSize=312728,PerTick=65536,,VerifyMedia=1,,,,,CheckCRC=0,Version=4.2.0.1671,Language=2057,InstallMode=58982400,,,,,,,) MSI (s) (80:B0) [22:03:33:949]: File: C:\Program Files\Sophos\Sophos Network Threat Protection\BPAIF.dll; To be installed; Won't patch; No existing file MSI (s) (80:B0) [22:03:33:949]: Source for file 'BPAIF.dll' is uncompressed, at 'C:\ProgramData\Sophos\AutoUpdate\Cache\decoded\ntp64\Sophos\Sophos Network Threat Protection\'. MSI (s) (80:B0) [22:03:33:949]: Note: 1: 2318 2: C:\Program Files\Sophos\Sophos Network Threat Protection\BPAIF.dll MSI (s) (80:B0) [22:03:33:949]: Note: 1: 2318 2: C:\Program Files\Sophos\Sophos Network Threat Protection\BPAIF.dll MSI (s) (80:B0) [22:03:33:949]: Executing op: SetTargetFolder(Folder=C:\windows\system32\) MSI (s) (80:B0) [22:03:33:949]: Executing op: SetSourceFolder(Folder=1\Sys64\|System64\) MSI (s) (80:B0) [22:03:33:949]: Executing op: RegisterSharedComponentProvider(,,File=F_CENTRAL_msvcr120_x64.05F0B5F5_44A8_3793_976B_A4F17AECF92C,Component={E5B92048-5859-4AF1-AEAD-B97EBF00B087},ComponentVersion=12.0.21005.1,ProductCode={4B1F9009-CD85-43C0-BCBD-D491908D5A52},ProductVersion=1.9.2373,PatchSize=0,PatchAttributes=0,PatchSequence=0,SharedComponent=0,IsFullFile=0) MSI (s) (80:B0) [22:03:33:965]: Executing op: FileCopySDDL(SourceName=msvcr120.dll,SourceCabKey=F_CENTRAL_msvcr120_x64.05F0B5F5_44A8_3793_976B_A4F17AECF92C,DestName=msvcr120.dll,Attributes=512,FileSize=963232,PerTick=65536,,VerifyMedia=1,,,,,CheckCRC=0,Version=12.0.21005.1,Language=1033,InstallMode=58982400,,,,,,,) MSI (s) (80:B0) [22:03:33:965]: File: C:\windows\system32\msvcr120.dll; Won't Overwrite; Won't patch; Existing file is of an equal version MSI (s) (80:B0) [22:03:33:965]: Executing op: SetTargetFolder(Folder=C:\Program Files\Sophos\Sophos Network Threat Protection\) MSI (s) (80:B0) [22:03:33:965]: Executing op: SetSourceFolder(Folder=1\Sophos\_tph7qnj\|Sophos\Sophos Network Threat Protection\) MSI (s) (80:B0) [22:03:33:965]: Executing op: FileCopySDDL(SourceName=64_wvfsz.dll|HbtAdapter.dll,SourceCabKey=HbtAdapter.dll,DestName=HbtAdapter.dll,Attributes=512,FileSize=2618776,PerTick=65536,,VerifyMedia=1,,,,,CheckCRC=0,Version=1.9.2373.0,Language=1033,InstallMode=58982400,,,,,,,) MSI (s) (80:B0) [22:03:33:965]: File: C:\Program Files\Sophos\Sophos Network Threat Protection\HbtAdapter.dll; To be installed; Won't patch; No existing file MSI (s) (80:B0) [22:03:33:965]: Source for file 'HbtAdapter.dll' is uncompressed, at 'C:\ProgramData\Sophos\AutoUpdate\Cache\decoded\ntp64\Sophos\Sophos Network Threat Protection\'. MSI (s) (80:B0) [22:03:33:965]: Note: 1: 2318 2: C:\Program Files\Sophos\Sophos Network Threat Protection\HbtAdapter.dll MSI (s) (80:B0) [22:03:33:965]: Note: 1: 2318 2: C:\Program Files\Sophos\Sophos Network Threat Protection\HbtAdapter.dll MSI (s) (80:B0) [22:03:33:965]: Executing op: FileCopySDDL(SourceName=ksvumoco.dll|HealthApi.dll,SourceCabKey=HealthApi.dll,DestName=HealthApi.dll,Attributes=512,FileSize=323088,PerTick=65536,,VerifyMedia=1,,,,,CheckCRC=0,Version=2.1.0.243,Language=2057,InstallMode=58982400,,,,,,,) MSI (s) (80:B0) [22:03:33:965]: File: C:\Program Files\Sophos\Sophos Network Threat Protection\HealthApi.dll; To be installed; Won't patch; No existing file MSI (s) (80:B0) [22:03:33:965]: Source for file 'HealthApi.dll' is uncompressed, at 'C:\ProgramData\Sophos\AutoUpdate\Cache\decoded\ntp64\Sophos\Sophos Network Threat Protection\'. MSI (s) (80:B0) [22:03:33:965]: Note: 1: 2318 2: C:\Program Files\Sophos\Sophos Network Threat Protection\HealthApi.dll MSI (s) (80:B0) [22:03:33:996]: Note: 1: 2318 2: C:\Program Files\Sophos\Sophos Network Threat Protection\HealthApi.dll MSI (s) (80:B0) [22:03:33:996]: Executing op: FileCopySDDL(SourceName=ubkryzhk.dll|Heartbeat.dll,SourceCabKey=Heartbeat.dll,DestName=Heartbeat.dll,Attributes=512,FileSize=5983760,PerTick=65536,,VerifyMedia=1,,,,,CheckCRC=0,Version=1.9.2373.0,Language=1033,InstallMode=58982400,,,,,,,) MSI (s) (80:B0) [22:03:33:996]: File: C:\Program Files\Sophos\Sophos Network Threat Protection\Heartbeat.dll; To be installed; Won't patch; No existing file MSI (s) (80:B0) [22:03:33:996]: Source for file 'Heartbeat.dll' is uncompressed, at 'C:\ProgramData\Sophos\AutoUpdate\Cache\decoded\ntp64\Sophos\Sophos Network Threat Protection\'. MSI (s) (80:B0) [22:03:33:996]: Note: 1: 2318 2: C:\Program Files\Sophos\Sophos Network Threat Protection\Heartbeat.dll MSI (s) (80:B0) [22:03:33:996]: Note: 1: 2318 2: C:\Program Files\Sophos\Sophos Network Threat Protection\Heartbeat.dll MSI (s) (80:B0) [22:03:34:012]: Executing op: SetTargetFolder(Folder=C:\ProgramData\Sophos\Heartbeat\Config\) MSI (s) (80:B0) [22:03:34:012]: Executing op: SetSourceFolder(Folder=1\Sophos\awner00b\Config\|Sophos\Heartbeat\Config\) MSI (s) (80:B0) [22:03:34:012]: Executing op: FileCopySDDL(SourceName=bs0pqswh.xml|Heartbeat.xml,SourceCabKey=Heartbeat.xml,DestName=Heartbeat.xml,Attributes=512,FileSize=92,PerTick=65536,,VerifyMedia=1,,,,,CheckCRC=0,,,InstallMode=58982400,HashOptions=0,HashPart1=106805701,HashPart2=1218977383,HashPart3=277465761,HashPart4=1021040072,,) MSI (s) (80:B0) [22:03:34:012]: File: C:\ProgramData\Sophos\Heartbeat\Config\Heartbeat.xml; To be installed; Won't patch; No existing file MSI (s) (80:B0) [22:03:34:012]: Source for file 'Heartbeat.xml' is uncompressed, at 'C:\ProgramData\Sophos\AutoUpdate\Cache\decoded\ntp64\Sophos\Heartbeat\Config\'. MSI (s) (80:B0) [22:03:34:012]: Note: 1: 2318 2: C:\ProgramData\Sophos\Heartbeat\Config\Heartbeat.xml MSI (s) (80:B0) [22:03:34:012]: Note: 1: 2318 2: C:\ProgramData\Sophos\Heartbeat\Config\Heartbeat.xml MSI (s) (80:B0) [22:03:34:012]: Executing op: SetTargetFolder(Folder=C:\Program Files\Sophos\Sophos Network Threat Protection\) MSI (s) (80:B0) [22:03:34:012]: Executing op: SetSourceFolder(Folder=1\Sophos\_tph7qnj\|Sophos\Sophos Network Threat Protection\) MSI (s) (80:B0) [22:03:34:012]: Executing op: FileCopySDDL(SourceName=eeazhlml.dat|integrity.dat,SourceCabKey=integrity.dat,DestName=integrity.dat,Attributes=512,FileSize=4086,PerTick=65536,,VerifyMedia=1,,,,,CheckCRC=0,,,InstallMode=58982400,HashOptions=0,HashPart1=707957222,HashPart2=-1556165108,HashPart3=1591840952,HashPart4=-1528098134,,) MSI (s) (80:B0) [22:03:34:012]: File: C:\Program Files\Sophos\Sophos Network Threat Protection\integrity.dat; To be installed; Won't patch; No existing file MSI (s) (80:B0) [22:03:34:012]: Source for file 'integrity.dat' is uncompressed, at 'C:\ProgramData\Sophos\AutoUpdate\Cache\decoded\ntp64\Sophos\Sophos Network Threat Protection\'. MSI (s) (80:B0) [22:03:34:027]: Note: 1: 2318 2: C:\Program Files\Sophos\Sophos Network Threat Protection\integrity.dat MSI (s) (80:B0) [22:03:34:027]: Note: 1: 2318 2: C:\Program Files\Sophos\Sophos Network Threat Protection\integrity.dat MSI (s) (80:B0) [22:03:34:027]: Executing op: FileCopySDDL(SourceName=navl.dll,SourceCabKey=navl.dll,DestName=navl.dll,Attributes=512,FileSize=10352944,PerTick=65536,,VerifyMedia=1,,,,,CheckCRC=0,Version=4.6.0.41,Language=1033,InstallMode=58982400,,,,,,,) MSI (s) (80:B0) [22:03:34:027]: File: C:\Program Files\Sophos\Sophos Network Threat Protection\navl.dll; To be installed; Won't patch; No existing file MSI (s) (80:B0) [22:03:34:027]: Source for file 'navl.dll' is uncompressed, at 'C:\ProgramData\Sophos\AutoUpdate\Cache\decoded\ntp64\Sophos\Sophos Network Threat Protection\'. MSI (s) (80:B0) [22:03:34:027]: Note: 1: 2318 2: C:\Program Files\Sophos\Sophos Network Threat Protection\navl.dll MSI (s) (80:B0) [22:03:34:027]: Note: 1: 2318 2: C:\Program Files\Sophos\Sophos Network Threat Protection\navl.dll MSI (s) (80:B0) [22:03:34:027]: Executing op: FileCopySDDL(SourceName=Notice.txt,SourceCabKey=Notice.txt,DestName=Notice.txt,Attributes=512,FileSize=32245,PerTick=65536,,VerifyMedia=1,,,,,CheckCRC=0,,,InstallMode=58982400,HashOptions=0,HashPart1=372983438,HashPart2=-1898244927,HashPart3=664281329,HashPart4=-444221519,,) MSI (s) (80:B0) [22:03:34:027]: File: C:\Program Files\Sophos\Sophos Network Threat Protection\Notice.txt; To be installed; Won't patch; No existing file MSI (s) (80:B0) [22:03:34:027]: Source for file 'Notice.txt' is uncompressed, at 'C:\ProgramData\Sophos\AutoUpdate\Cache\decoded\ntp64\Sophos\Sophos Network Threat Protection\'. MSI (s) (80:B0) [22:03:34:043]: Note: 1: 2318 2: C:\Program Files\Sophos\Sophos Network Threat Protection\Notice.txt MSI (s) (80:B0) [22:03:34:043]: Note: 1: 2318 2: C:\Program Files\Sophos\Sophos Network Threat Protection\Notice.txt MSI (s) (80:B0) [22:03:34:043]: Executing op: FileCopySDDL(SourceName=4tttawjz.dll|NTPAdapter.dll,SourceCabKey=NTPAdapter.dll,DestName=NTPAdapter.dll,Attributes=512,FileSize=1086792,PerTick=65536,,VerifyMedia=1,,,,,CheckCRC=0,Version=1.9.2373.0,Language=1033,InstallMode=58982400,,,,,,,) MSI (s) (80:B0) [22:03:34:043]: File: C:\Program Files\Sophos\Sophos Network Threat Protection\NTPAdapter.dll; To be installed; Won't patch; No existing file MSI (s) (80:B0) [22:03:34:043]: Source for file 'NTPAdapter.dll' is uncompressed, at 'C:\ProgramData\Sophos\AutoUpdate\Cache\decoded\ntp64\Sophos\Sophos Network Threat Protection\'. MSI (s) (80:B0) [22:03:34:043]: Note: 1: 2318 2: C:\Program Files\Sophos\Sophos Network Threat Protection\NTPAdapter.dll MSI (s) (80:B0) [22:03:34:043]: Note: 1: 2318 2: C:\Program Files\Sophos\Sophos Network Threat Protection\NTPAdapter.dll MSI (s) (80:B0) [22:03:34:043]: Executing op: FileCopySDDL(SourceName=scf.dat,SourceCabKey=scf.dat,DestName=scf.dat,Attributes=512,FileSize=2884,PerTick=65536,,VerifyMedia=1,,,,,CheckCRC=0,,,InstallMode=58982400,HashOptions=0,HashPart1=1314127409,HashPart2=1709852366,HashPart3=909540351,HashPart4=1188509432,,) MSI (s) (80:B0) [22:03:34:043]: File: C:\Program Files\Sophos\Sophos Network Threat Protection\scf.dat; To be installed; Won't patch; No existing file MSI (s) (80:B0) [22:03:34:043]: Source for file 'scf.dat' is uncompressed, at 'C:\ProgramData\Sophos\AutoUpdate\Cache\decoded\ntp64\Sophos\Sophos Network Threat Protection\'. MSI (s) (80:B0) [22:03:34:043]: Note: 1: 2318 2: C:\Program Files\Sophos\Sophos Network Threat Protection\scf.dat MSI (s) (80:B0) [22:03:34:043]: Note: 1: 2318 2: C:\Program Files\Sophos\Sophos Network Threat Protection\scf.dat MSI (s) (80:B0) [22:03:34:043]: Executing op: FileCopySDDL(SourceName=Sntp.cat,SourceCabKey=Sntp.cat,DestName=Sntp.cat,Attributes=512,FileSize=10957,PerTick=65536,,VerifyMedia=1,,,,,CheckCRC=0,,,InstallMode=58982400,HashOptions=0,HashPart1=692635286,HashPart2=316562150,HashPart3=974498685,HashPart4=-783525280,,) MSI (s) (80:B0) [22:03:34:043]: File: C:\Program Files\Sophos\Sophos Network Threat Protection\Sntp.cat; To be installed; Won't patch; No existing file MSI (s) (80:B0) [22:03:34:043]: Source for file 'Sntp.cat' is uncompressed, at 'C:\ProgramData\Sophos\AutoUpdate\Cache\decoded\ntp64\Sophos\Sophos Network Threat Protection\'. MSI (s) (80:B0) [22:03:34:043]: Note: 1: 2318 2: C:\Program Files\Sophos\Sophos Network Threat Protection\Sntp.cat MSI (s) (80:B0) [22:03:34:043]: Note: 1: 2318 2: C:\Program Files\Sophos\Sophos Network Threat Protection\Sntp.cat MSI (s) (80:B0) [22:03:34:043]: Executing op: FileCopySDDL(SourceName=Sntp.inf,SourceCabKey=Sntp.inf,DestName=Sntp.inf,Attributes=512,FileSize=1825,PerTick=65536,,VerifyMedia=1,,,,,CheckCRC=0,,,InstallMode=58982400,HashOptions=0,HashPart1=-2012484076,HashPart2=101982615,HashPart3=-1619459671,HashPart4=-12491018,,) MSI (s) (80:B0) [22:03:34:043]: File: C:\Program Files\Sophos\Sophos Network Threat Protection\Sntp.inf; To be installed; Won't patch; No existing file MSI (s) (80:B0) [22:03:34:043]: Source for file 'Sntp.inf' is uncompressed, at 'C:\ProgramData\Sophos\AutoUpdate\Cache\decoded\ntp64\Sophos\Sophos Network Threat Protection\'. MSI (s) (80:B0) [22:03:34:043]: Note: 1: 2318 2: C:\Program Files\Sophos\Sophos Network Threat Protection\Sntp.inf MSI (s) (80:B0) [22:03:34:043]: Note: 1: 2318 2: C:\Program Files\Sophos\Sophos Network Threat Protection\Sntp.inf MSI (s) (80:B0) [22:03:34:043]: Executing op: FileCopySDDL(SourceName=Sntp.man,SourceCabKey=Sntp.man,DestName=Sntp.man,Attributes=512,FileSize=17080,PerTick=65536,,VerifyMedia=1,,,,,CheckCRC=0,,,InstallMode=58982400,HashOptions=0,HashPart1=-2014872766,HashPart2=1407998095,HashPart3=206822388,HashPart4=-432857725,,) MSI (s) (80:B0) [22:03:34:043]: File: C:\Program Files\Sophos\Sophos Network Threat Protection\Sntp.man; To be installed; Won't patch; No existing file MSI (s) (80:B0) [22:03:34:043]: Source for file 'Sntp.man' is uncompressed, at 'C:\ProgramData\Sophos\AutoUpdate\Cache\decoded\ntp64\Sophos\Sophos Network Threat Protection\'. MSI (s) (80:B0) [22:03:34:059]: Note: 1: 2318 2: C:\Program Files\Sophos\Sophos Network Threat Protection\Sntp.man MSI (s) (80:B0) [22:03:34:059]: Note: 1: 2318 2: C:\Program Files\Sophos\Sophos Network Threat Protection\Sntp.man MSI (s) (80:B0) [22:03:34:059]: Executing op: FileCopySDDL(SourceName=Sntp.sys,SourceCabKey=Sntp.sys,DestName=Sntp.sys,Attributes=512,FileSize=216848,PerTick=65536,,VerifyMedia=1,,,,,CheckCRC=0,Version=1.9.2370.0,Language=1033,InstallMode=58982400,,,,,,,) MSI (s) (80:B0) [22:03:34:059]: File: C:\Program Files\Sophos\Sophos Network Threat Protection\Sntp.sys; To be installed; Won't patch; No existing file MSI (s) (80:B0) [22:03:34:059]: Source for file 'Sntp.sys' is uncompressed, at 'C:\ProgramData\Sophos\AutoUpdate\Cache\decoded\ntp64\Sophos\Sophos Network Threat Protection\'. MSI (s) (80:B0) [22:03:34:059]: Note: 1: 2318 2: C:\Program Files\Sophos\Sophos Network Threat Protection\Sntp.sys MSI (s) (80:B0) [22:03:34:059]: Note: 1: 2318 2: C:\Program Files\Sophos\Sophos Network Threat Protection\Sntp.sys MSI (s) (80:B0) [22:03:34:059]: Executing op: FileCopySDDL(SourceName=sof.dat,SourceCabKey=sof.dat,DestName=sof.dat,Attributes=512,FileSize=2916,PerTick=65536,,VerifyMedia=1,,,,,CheckCRC=0,,,InstallMode=58982400,HashOptions=0,HashPart1=-106547019,HashPart2=1657872819,HashPart3=-364668761,HashPart4=982328060,,) MSI (s) (80:B0) [22:03:34:059]: File: C:\Program Files\Sophos\Sophos Network Threat Protection\sof.dat; To be installed; Won't patch; No existing file MSI (s) (80:B0) [22:03:34:059]: Source for file 'sof.dat' is uncompressed, at 'C:\ProgramData\Sophos\AutoUpdate\Cache\decoded\ntp64\Sophos\Sophos Network Threat Protection\'. MSI (s) (80:B0) [22:03:34:059]: Note: 1: 2318 2: C:\Program Files\Sophos\Sophos Network Threat Protection\sof.dat MSI (s) (80:B0) [22:03:34:059]: Note: 1: 2318 2: C:\Program Files\Sophos\Sophos Network Threat Protection\sof.dat MSI (s) (80:B0) [22:03:34:059]: Executing op: SetTargetFolder(Folder=C:\Program Files\Sophos\Sophos Network Threat Protection\SophosNTPLWF\) MSI (s) (80:B0) [22:03:34:059]: Executing op: SetSourceFolder(Folder=1\Sophos\_tph7qnj\inu1lsqb\|Sophos\Sophos Network Threat Protection\SophosNTPLWF\) MSI (s) (80:B0) [22:03:34:059]: Executing op: FileCopySDDL(SourceName=somd5amg.cat|SophosNTPLWF.cat,SourceCabKey=SophosNTPLWF.cat,DestName=SophosNTPLWF.cat,Attributes=512,FileSize=19543,PerTick=65536,,VerifyMedia=1,,,,,CheckCRC=0,,,InstallMode=58982400,HashOptions=0,HashPart1=-388882937,HashPart2=287404702,HashPart3=1736837757,HashPart4=-296823384,,) MSI (s) (80:B0) [22:03:34:059]: File: C:\Program Files\Sophos\Sophos Network Threat Protection\SophosNTPLWF\SophosNTPLWF.cat; To be installed; Won't patch; No existing file MSI (s) (80:B0) [22:03:34:059]: Source for file 'SophosNTPLWF.cat' is uncompressed, at 'C:\ProgramData\Sophos\AutoUpdate\Cache\decoded\ntp64\Sophos\Sophos Network Threat Protection\SophosNTPLWF\'. MSI (s) (80:B0) [22:03:34:059]: Note: 1: 2318 2: C:\Program Files\Sophos\Sophos Network Threat Protection\SophosNTPLWF\SophosNTPLWF.cat MSI (s) (80:B0) [22:03:34:059]: Note: 1: 2318 2: C:\Program Files\Sophos\Sophos Network Threat Protection\SophosNTPLWF\SophosNTPLWF.cat MSI (s) (80:B0) [22:03:34:059]: Executing op: FileCopySDDL(SourceName=vog_z14i.inf|SophosNTPLWF.inf,SourceCabKey=SophosNTPLWF.inf,DestName=SophosNTPLWF.inf,Attributes=512,FileSize=2661,PerTick=65536,,VerifyMedia=1,,,,,CheckCRC=0,,,InstallMode=58982400,HashOptions=0,HashPart1=-119080910,HashPart2=-929259788,HashPart3=541834692,HashPart4=249545713,,) MSI (s) (80:B0) [22:03:34:059]: File: C:\Program Files\Sophos\Sophos Network Threat Protection\SophosNTPLWF\SophosNTPLWF.inf; To be installed; Won't patch; No existing file MSI (s) (80:B0) [22:03:34:059]: Source for file 'SophosNTPLWF.inf' is uncompressed, at 'C:\ProgramData\Sophos\AutoUpdate\Cache\decoded\ntp64\Sophos\Sophos Network Threat Protection\SophosNTPLWF\'. MSI (s) (80:B0) [22:03:34:059]: Note: 1: 2318 2: C:\Program Files\Sophos\Sophos Network Threat Protection\SophosNTPLWF\SophosNTPLWF.inf MSI (s) (80:B0) [22:03:34:059]: Note: 1: 2318 2: C:\Program Files\Sophos\Sophos Network Threat Protection\SophosNTPLWF\SophosNTPLWF.inf MSI (s) (80:B0) [22:03:34:059]: Executing op: FileCopySDDL(SourceName=jmxbaxl6.sys|SophosNTPLWF.sys,SourceCabKey=SophosNTPLWF.sys,DestName=SophosNTPLWF.sys,Attributes=512,FileSize=163400,PerTick=65536,,VerifyMedia=1,,,,,CheckCRC=0,Version=1.9.2225.0,Language=1033,InstallMode=58982400,,,,,,,) MSI (s) (80:B0) [22:03:34:059]: File: C:\Program Files\Sophos\Sophos Network Threat Protection\SophosNTPLWF\SophosNTPLWF.sys; To be installed; Won't patch; No existing file MSI (s) (80:B0) [22:03:34:059]: Source for file 'SophosNTPLWF.sys' is uncompressed, at 'C:\ProgramData\Sophos\AutoUpdate\Cache\decoded\ntp64\Sophos\Sophos Network Threat Protection\SophosNTPLWF\'. MSI (s) (80:B0) [22:03:34:074]: Note: 1: 2318 2: C:\Program Files\Sophos\Sophos Network Threat Protection\SophosNTPLWF\SophosNTPLWF.sys MSI (s) (80:B0) [22:03:34:074]: Note: 1: 2318 2: C:\Program Files\Sophos\Sophos Network Threat Protection\SophosNTPLWF\SophosNTPLWF.sys MSI (s) (80:B0) [22:03:34:074]: Executing op: SetTargetFolder(Folder=C:\Program Files\Sophos\Sophos Network Threat Protection\) MSI (s) (80:B0) [22:03:34:074]: Executing op: SetSourceFolder(Folder=1\Sophos\_tph7qnj\|Sophos\Sophos Network Threat Protection\) MSI (s) (80:B0) [22:03:34:074]: Executing op: FileCopySDDL(SourceName=8r4bfhgk.exe|SophosNtpService.exe,SourceCabKey=SophosNtpServiceExeWin7Only,DestName=SophosNtpService.exe,Attributes=512,FileSize=4891416,PerTick=65536,,VerifyMedia=1,,,,,CheckCRC=0,Version=1.9.2373.0,Language=1033,InstallMode=58982400,,,,,,,) MSI (s) (80:B0) [22:03:34:074]: File: C:\Program Files\Sophos\Sophos Network Threat Protection\SophosNtpService.exe; To be installed; Won't patch; No existing file MSI (s) (80:B0) [22:03:34:074]: Source for file 'SophosNtpService.exe' is uncompressed, at 'C:\ProgramData\Sophos\AutoUpdate\Cache\decoded\ntp64\Sophos\Sophos Network Threat Protection\'. MSI (s) (80:B0) [22:03:34:074]: Note: 1: 2318 2: C:\Program Files\Sophos\Sophos Network Threat Protection\SophosNtpService.exe MSI (s) (80:B0) [22:03:34:074]: Note: 1: 2318 2: C:\Program Files\Sophos\Sophos Network Threat Protection\SophosNtpService.exe MSI (s) (80:B0) [22:03:34:074]: Executing op: FileCopySDDL(SourceName=5viavhkb.exe|SophosNtpTelemetry.exe,SourceCabKey=SophosNtpTelemetry.exe,DestName=SophosNtpTelemetry.exe,Attributes=512,FileSize=443776,PerTick=65536,,VerifyMedia=1,,,,,CheckCRC=0,Version=1.9.2373.0,Language=1033,InstallMode=58982400,,,,,,,) MSI (s) (80:B0) [22:03:34:074]: File: C:\Program Files\Sophos\Sophos Network Threat Protection\SophosNtpTelemetry.exe; To be installed; Won't patch; No existing file MSI (s) (80:B0) [22:03:34:074]: Source for file 'SophosNtpTelemetry.exe' is uncompressed, at 'C:\ProgramData\Sophos\AutoUpdate\Cache\decoded\ntp64\Sophos\Sophos Network Threat Protection\'. MSI (s) (80:B0) [22:03:34:074]: Note: 1: 2318 2: C:\Program Files\Sophos\Sophos Network Threat Protection\SophosNtpTelemetry.exe MSI (s) (80:B0) [22:03:34:074]: Note: 1: 2318 2: C:\Program Files\Sophos\Sophos Network Threat Protection\SophosNtpTelemetry.exe MSI (s) (80:B0) [22:03:34:074]: Executing op: RegisterSharedComponentProvider(,,File=F_CENTRAL_msvcr120_x86.194841A2_D0F2_3B96_9F71_05BA91BEA0FA,Component={0835C947-D6D2-4E52-AF14-0231D04E88EA},ComponentVersion=12.0.21005.1,ProductCode={4B1F9009-CD85-43C0-BCBD-D491908D5A52},ProductVersion=1.9.2373,PatchSize=0,PatchAttributes=0,PatchSequence=0,SharedComponent=0,IsFullFile=0) MSI (s) (80:B0) [22:03:34:090]: Executing op: RegisterSharedComponentProvider(,,File=F_CENTRAL_msvcp120_x86.194841A2_D0F2_3B96_9F71_05BA91BEA0FA,Component={74260D9F-D644-423B-B2D4-0291EA4BA8BE},ComponentVersion=12.0.21005.1,ProductCode={4B1F9009-CD85-43C0-BCBD-D491908D5A52},ProductVersion=1.9.2373,PatchSize=0,PatchAttributes=0,PatchSequence=0,SharedComponent=0,IsFullFile=0) MSI (s) (80:B0) [22:03:34:105]: Executing op: RegisterSharedComponentProvider(,,File=F_CENTRAL_vccorlib120_x86.194841A2_D0F2_3B96_9F71_05BA91BEA0FA,Component={63B83B20-1AB9-4F49-B0B2-4489724CA96C},ComponentVersion=12.0.21005.1,ProductCode={4B1F9009-CD85-43C0-BCBD-D491908D5A52},ProductVersion=1.9.2373,PatchSize=0,PatchAttributes=0,PatchSequence=0,SharedComponent=0,IsFullFile=0) MSI (s) (80:B0) [22:03:34:105]: Executing op: RegisterSharedComponentProvider(,,File=F_CENTRAL_msvcp120_x64.05F0B5F5_44A8_3793_976B_A4F17AECF92C,Component={570C624B-D57C-4CD1-9013-1B80C800093B},ComponentVersion=12.0.21005.1,ProductCode={4B1F9009-CD85-43C0-BCBD-D491908D5A52},ProductVersion=1.9.2373,PatchSize=0,PatchAttributes=0,PatchSequence=0,SharedComponent=0,IsFullFile=0) MSI (s) (80:B0) [22:03:34:121]: Executing op: RegisterSharedComponentProvider(,,File=F_CENTRAL_vccorlib120_x64.05F0B5F5_44A8_3793_976B_A4F17AECF92C,Component={14E8634F-8AEA-4CD1-AC48-BEBFDA18523A},ComponentVersion=12.0.21005.1,ProductCode={4B1F9009-CD85-43C0-BCBD-D491908D5A52},ProductVersion=1.9.2373,PatchSize=0,PatchAttributes=0,PatchSequence=0,SharedComponent=0,IsFullFile=0) MSI (s) (80:B0) [22:03:34:137]: Executing op: CacheRTMFile(SourceFilePath=C:\ProgramData\Sophos\AutoUpdate\Cache\decoded\ntp64\System64\msvcp120.dll,FileKey=F_CENTRAL_msvcp120_x64.05F0B5F5_44A8_3793_976B_A4F17AECF92C,,ProductCode={4B1F9009-CD85-43C0-BCBD-D491908D5A52},ProductVersion=1.9.2373,Attributes=512,,,,CopierFlags=0,FileSize=660128,,,,,) MSI (s) (80:B0) [22:03:34:137]: Note: 1: 2318 2: C:\windows\Installer\$PatchCache$\Managed\9009F1B458DC0C34CBDB4D1909D8A525\1.9.2373\F_CENTRAL_msvcp120_x64.05F0B5F5_44A8_3793_976B_A4F17AECF92C MSI (s) (80:B0) [22:03:34:137]: Note: 1: 2318 2: C:\windows\Installer\$PatchCache$\Managed\9009F1B458DC0C34CBDB4D1909D8A525\1.9.2373\F_CENTRAL_msvcp120_x64.05F0B5F5_44A8_3793_976B_A4F17AECF92C MSI (s) (80:B0) [22:03:34:137]: Executing op: CacheRTMFile(SourceFilePath=C:\ProgramData\Sophos\AutoUpdate\Cache\decoded\ntp64\System\msvcp120.dll,FileKey=F_CENTRAL_msvcp120_x86.194841A2_D0F2_3B96_9F71_05BA91BEA0FA,,ProductCode={4B1F9009-CD85-43C0-BCBD-D491908D5A52},ProductVersion=1.9.2373,Attributes=512,,,,CopierFlags=0,FileSize=455328,,,,,) MSI (s) (80:B0) [22:03:34:137]: Note: 1: 2318 2: C:\windows\Installer\$PatchCache$\Managed\9009F1B458DC0C34CBDB4D1909D8A525\1.9.2373\F_CENTRAL_msvcp120_x86.194841A2_D0F2_3B96_9F71_05BA91BEA0FA MSI (s) (80:B0) [22:03:34:137]: Note: 1: 2318 2: C:\windows\Installer\$PatchCache$\Managed\9009F1B458DC0C34CBDB4D1909D8A525\1.9.2373\F_CENTRAL_msvcp120_x86.194841A2_D0F2_3B96_9F71_05BA91BEA0FA MSI (s) (80:B0) [22:03:34:137]: Executing op: CacheRTMFile(SourceFilePath=C:\ProgramData\Sophos\AutoUpdate\Cache\decoded\ntp64\System\msvcr120.dll,FileKey=F_CENTRAL_msvcr120_x86.194841A2_D0F2_3B96_9F71_05BA91BEA0FA,,ProductCode={4B1F9009-CD85-43C0-BCBD-D491908D5A52},ProductVersion=1.9.2373,Attributes=512,,,,CopierFlags=0,FileSize=970912,,,,,) MSI (s) (80:B0) [22:03:34:137]: Note: 1: 2318 2: C:\windows\Installer\$PatchCache$\Managed\9009F1B458DC0C34CBDB4D1909D8A525\1.9.2373\F_CENTRAL_msvcr120_x86.194841A2_D0F2_3B96_9F71_05BA91BEA0FA MSI (s) (80:B0) [22:03:34:137]: Note: 1: 2318 2: C:\windows\Installer\$PatchCache$\Managed\9009F1B458DC0C34CBDB4D1909D8A525\1.9.2373\F_CENTRAL_msvcr120_x86.194841A2_D0F2_3B96_9F71_05BA91BEA0FA MSI (s) (80:B0) [22:03:34:152]: Executing op: CacheRTMFile(SourceFilePath=C:\ProgramData\Sophos\AutoUpdate\Cache\decoded\ntp64\System64\vccorlib120.dll,FileKey=F_CENTRAL_vccorlib120_x64.05F0B5F5_44A8_3793_976B_A4F17AECF92C,,ProductCode={4B1F9009-CD85-43C0-BCBD-D491908D5A52},ProductVersion=1.9.2373,Attributes=512,,,,CopierFlags=0,FileSize=356528,,,,,) MSI (s) (80:B0) [22:03:34:152]: Note: 1: 2318 2: C:\windows\Installer\$PatchCache$\Managed\9009F1B458DC0C34CBDB4D1909D8A525\1.9.2373\F_CENTRAL_vccorlib120_x64.05F0B5F5_44A8_3793_976B_A4F17AECF92C MSI (s) (80:B0) [22:03:34:152]: Note: 1: 2318 2: C:\windows\Installer\$PatchCache$\Managed\9009F1B458DC0C34CBDB4D1909D8A525\1.9.2373\F_CENTRAL_vccorlib120_x64.05F0B5F5_44A8_3793_976B_A4F17AECF92C MSI (s) (80:B0) [22:03:34:152]: Executing op: CacheRTMFile(SourceFilePath=C:\ProgramData\Sophos\AutoUpdate\Cache\decoded\ntp64\System\vccorlib120.dll,FileKey=F_CENTRAL_vccorlib120_x86.194841A2_D0F2_3B96_9F71_05BA91BEA0FA,,ProductCode={4B1F9009-CD85-43C0-BCBD-D491908D5A52},ProductVersion=1.9.2373,Attributes=512,,,,CopierFlags=0,FileSize=247984,,,,,) MSI (s) (80:B0) [22:03:34:152]: Note: 1: 2318 2: C:\windows\Installer\$PatchCache$\Managed\9009F1B458DC0C34CBDB4D1909D8A525\1.9.2373\F_CENTRAL_vccorlib120_x86.194841A2_D0F2_3B96_9F71_05BA91BEA0FA MSI (s) (80:B0) [22:03:34:152]: Note: 1: 2318 2: C:\windows\Installer\$PatchCache$\Managed\9009F1B458DC0C34CBDB4D1909D8A525\1.9.2373\F_CENTRAL_vccorlib120_x86.194841A2_D0F2_3B96_9F71_05BA91BEA0FA MSI (s) (80:B0) [22:03:34:152]: Executing op: CacheSizeFlush(,) MSI (s) (80:B0) [22:03:34:152]: Executing op: ActionStart(Name=MsiRollbackInstall,,) MSI (s) (80:B0) [22:03:34:152]: Executing op: CustomActionSchedule(Action=MsiRollbackInstall,ActionType=3329,Source=BinaryData,Target=RollbackInstall,CustomActionData=2.12{76F354A6-97D5-4872-9781-2F2642A4F18A}212Sophos Network Threat ProtectionSophos Limited) MSI (s) (80:B0) [22:03:34:152]: Executing op: ActionStart(Name=MsiInstallDrivers,,) MSI (s) (80:B0) [22:03:34:152]: Executing op: CustomActionSchedule(Action=MsiInstallDrivers,ActionType=3073,Source=BinaryData,Target=InstallDriverPackages,CustomActionData=2.12{76F354A6-97D5-4872-9781-2F2642A4F18A}C:\Program Files\Sophos\Sophos Network Threat Protection\212Sophos Network Threat ProtectionSophos Limited) MSI (s) (80:B0) [22:03:34:152]: Creating MSIHANDLE (123) of type 790536 for thread 7600 MSI (s) (80:B4) [22:03:34:168]: Invoking remote custom action. DLL: C:\windows\Installer\MSI7815.tmp, Entrypoint: InstallDriverPackages MSI (s) (80!A4) [22:03:34:183]: Creating MSIHANDLE (124) of type 790531 for thread 8100 MSI (s) (80!A4) [22:03:34:183]: Closing MSIHANDLE (124) of type 790531 for thread 8100 MSI (s) (80!A4) [22:03:34:183]: Creating MSIHANDLE (125) of type 790531 for thread 8100 DIFXAPP: ENTER: InstallDriverPackages() MSI (s) (80!A4) [22:03:34:183]: Closing MSIHANDLE (125) of type 790531 for thread 8100 MSI (s) (80!A4) [22:03:34:183]: Creating MSIHANDLE (126) of type 790531 for thread 8100 DIFXAPP: INFO: 'CustomActionData' property 'DIFxApp Version' is '2.1'. MSI (s) (80!A4) [22:03:34:183]: Closing MSIHANDLE (126) of type 790531 for thread 8100 MSI (s) (80!A4) [22:03:34:183]: Creating MSIHANDLE (127) of type 790531 for thread 8100 DIFXAPP: INFO: 'CustomActionData' property 'UI Level' is '2'. MSI (s) (80!A4) [22:03:34:183]: Closing MSIHANDLE (127) of type 790531 for thread 8100 MSI (s) (80!A4) [22:03:34:183]: Creating MSIHANDLE (128) of type 790531 for thread 8100 DIFXAPP: INFO: 'CustomActionData' property 'componentId' is '{76F354A6-97D5-4872-9781-2F2642A4F18A}'. MSI (s) (80!A4) [22:03:34:183]: Closing MSIHANDLE (128) of type 790531 for thread 8100 MSI (s) (80!A4) [22:03:34:183]: Creating MSIHANDLE (129) of type 790531 for thread 8100 DIFXAPP: INFO: 'CustomActionData' property 'componentPath' is 'C:\Program Files\Sophos\Sophos Network Threat Protection\'. MSI (s) (80!A4) [22:03:34:183]: Closing MSIHANDLE (129) of type 790531 for thread 8100 MSI (s) (80!A4) [22:03:34:183]: Creating MSIHANDLE (130) of type 790531 for thread 8100 DIFXAPP: INFO: 'CustomActionData' property 'flags' is 0x15. MSI (s) (80!A4) [22:03:34:183]: Closing MSIHANDLE (130) of type 790531 for thread 8100 MSI (s) (80!A4) [22:03:34:183]: Creating MSIHANDLE (131) of type 790531 for thread 8100 DIFXAPP: INFO: 'CustomActionData' property 'installState' is '2'. MSI (s) (80!A4) [22:03:34:183]: Closing MSIHANDLE (131) of type 790531 for thread 8100 MSI (s) (80!A4) [22:03:34:183]: Creating MSIHANDLE (132) of type 790531 for thread 8100 DIFXAPP: INFO: 'CustomActionData' property 'ProductName' is 'Sophos Network Threat Protection'. MSI (s) (80!A4) [22:03:34:183]: Closing MSIHANDLE (132) of type 790531 for thread 8100 MSI (s) (80!A4) [22:03:34:183]: Creating MSIHANDLE (133) of type 790531 for thread 8100 DIFXAPP: INFO: 'CustomActionData' property 'ManufacturerName' is 'Sophos Limited'. MSI (s) (80!A4) [22:03:34:183]: Closing MSIHANDLE (133) of type 790531 for thread 8100 MSI (s) (80!A4) [22:03:34:183]: Creating MSIHANDLE (134) of type 790531 for thread 8100 DIFXAPP: INFO: user SID of user performing the install is 'S-1-5-18'. MSI (s) (80!A4) [22:03:34:183]: Closing MSIHANDLE (134) of type 790531 for thread 8100 MSI (s) (80!A4) [22:03:34:183]: Creating MSIHANDLE (135) of type 790531 for thread 8100 DIFXAPP: INFO: opening HKEY_USERS\S-1-5-18\Software\Microsoft\Windows\CurrentVersion\DIFxApp\Components\{76F354A6-97D5-4872-9781-2F2642A4F18A} (User's SID: 'S-1-5-18') ... MSI (s) (80!A4) [22:03:34:183]: Closing MSIHANDLE (135) of type 790531 for thread 8100 MSI (s) (80!A4) [22:03:34:199]: Creating MSIHANDLE (136) of type 790531 for thread 8100 DIFXAPP: INFO: ENTER: DriverPackageInstallW MSI (s) (80!A4) [22:03:34:199]: Closing MSIHANDLE (136) of type 790531 for thread 8100 MSI (s) (80!A4) [22:03:34:308]: Creating MSIHANDLE (137) of type 790531 for thread 8100 DIFXAPP: INFO: Sntp.inf: checking signature with catalog 'C:\Program Files\Sophos\Sophos Network Threat Protection\sntp.cat' ... MSI (s) (80!A4) [22:03:34:308]: Closing MSIHANDLE (137) of type 790531 for thread 8100 MSI (s) (80!A4) [22:03:34:308]: Creating MSIHANDLE (138) of type 790531 for thread 8100 DIFXAPP: INFO: Driver package 'Sntp.inf' is Authenticode signed. MSI (s) (80!A4) [22:03:34:308]: Closing MSIHANDLE (138) of type 790531 for thread 8100 MSI (s) (80!A4) [22:03:34:308]: Creating MSIHANDLE (139) of type 790531 for thread 8100 DIFXAPP: INFO: Copied 'Sntp.inf' to driver store... MSI (s) (80!A4) [22:03:34:308]: Closing MSIHANDLE (139) of type 790531 for thread 8100 MSI (s) (80!A4) [22:03:34:324]: Creating MSIHANDLE (140) of type 790531 for thread 8100 DIFXAPP: INFO: Copied 'sntp.cat' to driver store... MSI (s) (80!A4) [22:03:34:324]: Closing MSIHANDLE (140) of type 790531 for thread 8100 MSI (s) (80!A4) [22:03:34:324]: Creating MSIHANDLE (141) of type 790531 for thread 8100 DIFXAPP: INFO: Commiting queue... MSI (s) (80!A4) [22:03:34:324]: Closing MSIHANDLE (141) of type 790531 for thread 8100 MSI (s) (80!A4) [22:03:34:339]: Creating MSIHANDLE (142) of type 790531 for thread 8100 DIFXAPP: INFO: Copied file: 'C:\Program Files\Sophos\Sophos Network Threat Protection\sntp.sys' -> 'C:\windows\system32\DRVSTORE\Sntp_CE0CFD5C0E97DF99ACEB169D8412E720BFAEFBF0\sntp.sys'. MSI (s) (80!A4) [22:03:34:339]: Closing MSIHANDLE (142) of type 790531 for thread 8100 MSI (s) (80!A4) [22:03:34:339]: Creating MSIHANDLE (143) of type 790531 for thread 8100 DIFXAPP: INFO: Installing INF file "C:\windows\system32\DRVSTORE\Sntp_CE0CFD5C0E97DF99ACEB169D8412E720BFAEFBF0\Sntp.inf" of Type 1. MSI (s) (80!A4) [22:03:34:339]: Closing MSIHANDLE (143) of type 790531 for thread 8100 MSI (s) (80!A4) [22:03:35:197]: Creating MSIHANDLE (144) of type 790531 for thread 8100 DIFXAPP: INFO: Installing legacy driver 'C:\windows\system32\DRVSTORE\Sntp_CE0CFD5C0E97DF99ACEB169D8412E720BFAEFBF0\Sntp.inf' MSI (s) (80!A4) [22:03:35:197]: Closing MSIHANDLE (144) of type 790531 for thread 8100 MSI (s) (80!A4) [22:03:35:197]: Creating MSIHANDLE (145) of type 790531 for thread 8100 DIFXAPP: INFO: Service 'sntp' was started MSI (s) (80!A4) [22:03:35:197]: Closing MSIHANDLE (145) of type 790531 for thread 8100 MSI (s) (80!A4) [22:03:35:197]: Creating MSIHANDLE (146) of type 790531 for thread 8100 DIFXAPP: SUCCESS:Installation completed with code 0x0. MSI (s) (80!A4) [22:03:35:197]: Closing MSIHANDLE (146) of type 790531 for thread 8100 MSI (s) (80!A4) [22:03:35:197]: Creating MSIHANDLE (147) of type 790531 for thread 8100 DIFXAPP: INFO: RETURN: DriverPackageInstallW (0x0) MSI (s) (80!A4) [22:03:35:213]: Closing MSIHANDLE (147) of type 790531 for thread 8100 MSI (s) (80!A4) [22:03:35:213]: Creating MSIHANDLE (148) of type 790531 for thread 8100 DIFXAPP: INFO: ENTER: DriverPackageGetPathW MSI (s) (80!A4) [22:03:35:213]: Closing MSIHANDLE (148) of type 790531 for thread 8100 MSI (s) (80!A4) [22:03:35:213]: Creating MSIHANDLE (149) of type 790531 for thread 8100 DIFXAPP: SUCCESS:Found driver store entry. MSI (s) (80!A4) [22:03:35:213]: Closing MSIHANDLE (149) of type 790531 for thread 8100 MSI (s) (80!A4) [22:03:35:213]: Creating MSIHANDLE (150) of type 790531 for thread 8100 DIFXAPP: INFO: RETURN: DriverPackageGetPathW (0x7A) MSI (s) (80!A4) [22:03:35:213]: Closing MSIHANDLE (150) of type 790531 for thread 8100 MSI (s) (80!A4) [22:03:35:213]: Creating MSIHANDLE (151) of type 790531 for thread 8100 DIFXAPP: INFO: ENTER: DriverPackageGetPathW MSI (s) (80!A4) [22:03:35:213]: Closing MSIHANDLE (151) of type 790531 for thread 8100 MSI (s) (80!A4) [22:03:35:213]: Creating MSIHANDLE (152) of type 790531 for thread 8100 DIFXAPP: SUCCESS:Found driver store entry. MSI (s) (80!A4) [22:03:35:213]: Closing MSIHANDLE (152) of type 790531 for thread 8100 MSI (s) (80!A4) [22:03:35:213]: Creating MSIHANDLE (153) of type 790531 for thread 8100 DIFXAPP: INFO: RETURN: DriverPackageGetPathW (0x0) MSI (s) (80!A4) [22:03:35:213]: Closing MSIHANDLE (153) of type 790531 for thread 8100 MSI (s) (80!A4) [22:03:35:213]: Creating MSIHANDLE (154) of type 790531 for thread 8100 DIFXAPP: INFO: driver store entry for 'C:\Program Files\Sophos\Sophos Network Threat Protection\Sntp.inf' is 'C:\windows\system32\DRVSTORE\Sntp_CE0CFD5C0E97DF99ACEB169D8412E720BFAEFBF0\Sntp.inf'. MSI (s) (80!A4) [22:03:35:213]: Closing MSIHANDLE (154) of type 790531 for thread 8100 MSI (s) (80!A4) [22:03:35:213]: Creating MSIHANDLE (155) of type 790531 for thread 8100 DIFXAPP: INFO: The component Id '{76F354A6-97D5-4872-9781-2F2642A4F18A}' is now set to point to driver store: 'C:\windows\system32\DRVSTORE\Sntp_CE0CFD5C0E97DF99ACEB169D8412E720BFAEFBF0\Sntp.inf' MSI (s) (80!A4) [22:03:35:213]: Closing MSIHANDLE (155) of type 790531 for thread 8100 MSI (s) (80!A4) [22:03:35:213]: Creating MSIHANDLE (156) of type 790531 for thread 8100 DIFXAPP: INFO: A reboot is not needed to install the component '{76F354A6-97D5-4872-9781-2F2642A4F18A}'. MSI (s) (80!A4) [22:03:35:213]: Closing MSIHANDLE (156) of type 790531 for thread 8100 MSI (s) (80:B4) [22:03:35:213]: Closing MSIHANDLE (123) of type 790536 for thread 7600 MSI (s) (80:B0) [22:03:35:213]: Executing op: ActionStart(Name=RegisterSntpEventManifestRollback,,) DIFXAPP: RETURN: InstallDriverPackages() 0 (0x0) MSI (s) (80:B0) [22:03:35:213]: Executing op: CustomActionSchedule(Action=RegisterSntpEventManifestRollback,ActionType=3393,Source=BinaryData,Target=WixQuietExec,CustomActionData="wevtutil.exe" um "C:\Program Files\Sophos\Sophos Network Threat Protection\Sntp.man") MSI (s) (80:B0) [22:03:35:213]: Executing op: ActionStart(Name=RegisterSntpEventManifest,,) MSI (s) (80:B0) [22:03:35:213]: Executing op: CustomActionSchedule(Action=RegisterSntpEventManifest,ActionType=3137,Source=BinaryData,Target=WixQuietExec,CustomActionData="wevtutil.exe" im "C:\Program Files\Sophos\Sophos Network Threat Protection\Sntp.man") MSI (s) (80:B0) [22:03:35:229]: Creating MSIHANDLE (157) of type 790536 for thread 7600 MSI (s) (80:D0) [22:03:35:229]: Invoking remote custom action. DLL: C:\windows\Installer\MSI7C3A.tmp, Entrypoint: WixQuietExec MSI (s) (80!C4) [22:03:35:244]: Creating MSIHANDLE (158) of type 790531 for thread 2500 MSI (s) (80!C4) [22:03:35:244]: Closing MSIHANDLE (158) of type 790531 for thread 2500 MSI (s) (80!C4) [22:03:35:244]: Creating MSIHANDLE (159) of type 790531 for thread 2500 WixQuietExec: Entering WixQuietExec in C:\windows\Installer\MSI7C3A.tmp, version 3.11.2318.0 MSI (s) (80!C4) [22:03:35:244]: Closing MSIHANDLE (159) of type 790531 for thread 2500 MSI (s) (80:D0) [22:03:36:102]: Closing MSIHANDLE (157) of type 790536 for thread 7600 MSI (s) (80:B0) [22:03:36:102]: Executing op: ActionStart(Name=WriteRegistryValues,Description=Writing system registry values,Template=Key: [1], Name: [2], Value: [3]) WixQuietExec: "wevtutil.exe" im "C:\Program Files\Sophos\Sophos Network Threat Protection\Sntp.man" MSI (s) (80:B0) [22:03:36:102]: Executing op: ProgressTotal(Total=15,Type=1,ByteEquivalent=13200) MSI (s) (80:B0) [22:03:36:102]: Executing op: RegOpenKey(Root=-2147483646,Key=Software\Sophos\Heartbeat\Status,,BinaryType=0,,SDDLText=O:BAG:SYD:AI(A;OICIID;KA;;;BA)(A;OICIID;KA;;;SY)(A;OICIID;KA;;;LS)(A;OICIID;KRKX;;;BU)) MSI (s) (80:B0) [22:03:36:102]: Executing op: RegCreateKey() MSI (s) (80:B0) [22:03:36:102]: Executing op: RegOpenKey(Root=-2147483646,Key=Software\Sophos\Heartbeat,,BinaryType=0,,SDDLText=O:BAG:SYD:PAI(A;OICI;KA;;;BA)(A;OICI;KA;;;SY)(A;OICI;KA;;;LS)(A;OICI;KRKX;;;BU)) MSI (s) (80:B0) [22:03:36:102]: Executing op: RegCreateKey() MSI (s) (80:B0) [22:03:36:102]: Executing op: RegOpenKey(Root=-2147483646,Key=Software\Sophos\Telemetry\Plugins\NTP,,BinaryType=0,,) MSI (s) (80:B0) [22:03:36:102]: Executing op: RegAddValue(Name=Path,Value=C:\Program Files\Sophos\Sophos Network Threat Protection\SophosNtpTelemetry.exe,) MSI (s) (80:B0) [22:03:36:102]: Executing op: RegAddValue(Name=Cmd,Value=SophosNtpTelemetry.exe,) MSI (s) (80:B0) [22:03:36:102]: Executing op: RegOpenKey(Root=-2147483646,Key=Software\Sophos,,BinaryType=1,,) MSI (s) (80:B0) [22:03:36:102]: Executing op: RegCreateKey() MSI (s) (80:B0) [22:03:36:102]: Executing op: RegOpenKey(Root=-2147483646,Key=Software\Sophos\Sophos Network Threat Protection\Application,,BinaryType=1,,SDDLText=O:BAG:SYD:AI(A;OICIID;KA;;;BA)(A;OICIID;KA;;;SY)(A;OICIID;KA;;;LS)(A;OICIID;KRKX;;;BU)) MSI (s) (80:B0) [22:03:36:102]: Executing op: RegCreateKey() MSI (s) (80:B0) [22:03:36:102]: Executing op: RegAddValue(Name=ProductCode,Value={4B1F9009-CD85-43C0-BCBD-D491908D5A52},) MSI (s) (80:B0) [22:03:36:102]: Executing op: RegAddValue(Name=ProductVersion,Value=1.9.2373.0,) MSI (s) (80:B0) [22:03:36:102]: Executing op: RegAddValue(Name=Path,Value=C:\Program Files\Sophos\Sophos Network Threat Protection\,) MSI (s) (80:B0) [22:03:36:118]: Executing op: RegOpenKey(Root=-2147483646,Key=Software\Sophos\Sophos Network Threat Protection\Telemetry\Heartbeat,,BinaryType=1,,SDDLText=O:BAG:SYD:AI(A;OICIID;KA;;;BA)(A;OICIID;KA;;;SY)(A;OICIID;KA;;;LS)) MSI (s) (80:B0) [22:03:36:118]: Executing op: RegCreateKey() MSI (s) (80:B0) [22:03:36:118]: Executing op: RegOpenKey(Root=-2147483646,Key=Software\Sophos\Sophos Network Threat Protection\Telemetry\MTD,,BinaryType=1,,SDDLText=O:BAG:SYD:AI(A;OICIID;KA;;;BA)(A;OICIID;KA;;;SY)(A;OICIID;KA;;;LS)) MSI (s) (80:B0) [22:03:36:118]: Executing op: RegCreateKey() MSI (s) (80:B0) [22:03:36:118]: Executing op: RegOpenKey(Root=-2147483646,Key=Software\Sophos\Sophos Network Threat Protection\Telemetry,,BinaryType=1,,SDDLText=O:BAG:SYD:PAI(A;OICI;KA;;;BA)(A;OICI;KA;;;SY)(A;OICI;KA;;;LS)) MSI (s) (80:B0) [22:03:36:118]: Executing op: RegCreateKey() MSI (s) (80:B0) [22:03:36:118]: Executing op: RegOpenKey(Root=-2147483646,Key=Software\Sophos\Sophos Network Threat Protection,,BinaryType=1,,SDDLText=O:BAG:SYD:PAI(A;OICI;KA;;;BA)(A;OICI;KA;;;SY)(A;OICI;KA;;;LS)(A;OICI;KRKX;;;BU)) MSI (s) (80:B0) [22:03:36:118]: Executing op: RegCreateKey() MSI (s) (80:B0) [22:03:36:118]: Executing op: RegOpenKey(Root=-2147483646,Key=SYSTEM\CurrentControlSet\Control\SafeBoot\Network\SntpService,,BinaryType=1,,) MSI (s) (80:B0) [22:03:36:118]: Executing op: RegAddValue(,Value=service,) MSI (s) (80:B0) [22:03:36:118]: Executing op: RegOpenKey(Root=-2147483646,Key=Software\Sophos\Heartbeat,,BinaryType=1,,SDDLText=O:BAG:SYD:PAI(A;OICI;KA;;;BA)(A;OICI;KA;;;SY)(A;OICI;KA;;;LS)(A;OICI;KRKX;;;BU)) MSI (s) (80:B0) [22:03:36:118]: Executing op: RegCreateKey() MSI (s) (80:B0) [22:03:36:118]: Executing op: ActionStart(Name=InstallServices,Description=Installing new services,Template=Service: [2]) MSI (s) (80:B0) [22:03:36:118]: Executing op: ProgressTotal(Total=1,Type=1,ByteEquivalent=1300000) MSI (s) (80:B0) [22:03:36:118]: Executing op: ServiceInstall(Name=SntpService,DisplayName=Sophos Network Threat Protection,ImagePath="C:\Program Files\Sophos\Sophos Network Threat Protection\SophosNtpService.exe",ServiceType=16,StartType=2,ErrorControl=32769,,Dependencies=bfe[~]rpcss[~]sntp[~]SophosNtpLWF[~][~][~],,StartName=NT AUTHORITY\LocalService,Password=**********,Description=Protects the computer against network-based threats.,,) MSI (s) (80:B0) [22:03:36:601]: Executing op: ActionStart(Name=AddSIPSSubmitterUserAccountRollback,,) MSI (s) (80:B0) [22:03:36:601]: Executing op: CustomActionSchedule(Action=AddSIPSSubmitterUserAccountRollback,ActionType=1281,Source=BinaryData,Target=RemoveSIPSManagementUser,CustomActionData=NT SERVICE\SntpService) MSI (s) (80:B0) [22:03:36:601]: Executing op: ActionStart(Name=AddSIPSSubmitterUserAccount,,) MSI (s) (80:B0) [22:03:36:601]: Executing op: CustomActionSchedule(Action=AddSIPSSubmitterUserAccount,ActionType=1025,Source=BinaryData,Target=AddSIPSManagementUser,CustomActionData=NT SERVICE\SntpService) MSI (s) (80:B0) [22:03:36:617]: Creating MSIHANDLE (160) of type 790536 for thread 7600 MSI (s) (80:2C) [22:03:36:617]: Invoking remote custom action. DLL: C:\windows\Installer\MSI81A8.tmp, Entrypoint: AddSIPSManagementUser MSI (s) (80!F0) [22:03:36:633]: Creating MSIHANDLE (161) of type 790531 for thread 2544 MSI (s) (80!F0) [22:03:36:633]: Closing MSIHANDLE (161) of type 790531 for thread 2544 MSI (s) (80!F0) [22:03:36:633]: Creating MSIHANDLE (162) of type 790531 for thread 2544 AddSIPSManagementUser Enter (234) MSI (s) (80!F0) [22:03:36:633]: Closing MSIHANDLE (162) of type 790531 for thread 2544 MSI (s) (80:2C) [22:03:36:633]: Closing MSIHANDLE (160) of type 790536 for thread 7600 MSI (s) (80:B0) [22:03:36:633]: Executing op: ActionStart(Name=ExecSecureObjects_64,,) AddSIPSManagementUser Exit (283) MSI (s) (80:B0) [22:03:36:648]: Executing op: CustomActionSchedule(Action=ExecSecureObjects_64,ActionType=11265,Source=BinaryData,Target=**********,CustomActionData=**********) MSI (s) (80:B0) [22:03:36:648]: Creating MSIHANDLE (163) of type 790536 for thread 7600 MSI (s) (80:30) [22:03:36:648]: Invoking remote custom action. DLL: C:\windows\Installer\MSI81D8.tmp, Entrypoint: ExecSecureObjects MSI (s) (80!D0) [22:03:36:648]: Creating MSIHANDLE (164) of type 790531 for thread 7120 MSI (s) (80!D0) [22:03:36:648]: Creating MSIHANDLE (165) of type 790531 for thread 7120 MSI (s) (80!D0) [22:03:36:648]: Closing MSIHANDLE (165) of type 790531 for thread 7120 MSI (s) (80!D0) [22:03:36:648]: Creating MSIHANDLE (166) of type 790531 for thread 7120 ExecSecureObjects: Entering ExecSecureObjects in C:\windows\Installer\MSI81D8.tmp, version 3.11.2318.0 MSI (s) (80!D0) [22:03:36:648]: Closing MSIHANDLE (166) of type 790531 for thread 7120 MSI (s) (80!D0) [22:03:37:132]: Creating MSIHANDLE (167) of type 790531 for thread 7120 ExecSecureObjects: Securing Object: SntpService Type: ServiceInstall User: Everyone MSI (s) (80!D0) [22:03:37:132]: Closing MSIHANDLE (167) of type 790531 for thread 7120 MSI (s) (80!D0) [22:03:37:132]: Creating MSIHANDLE (168) of type 790531 for thread 7120 MSI (s) (80!D0) [22:03:37:132]: Closing MSIHANDLE (168) of type 790531 for thread 7120 MSI (s) (80!D0) [22:03:37:334]: Creating MSIHANDLE (169) of type 790531 for thread 7120 ExecSecureObjects: Securing Object: SntpService Type: ServiceInstall User: Administrators MSI (s) (80!D0) [22:03:37:334]: Closing MSIHANDLE (169) of type 790531 for thread 7120 MSI (s) (80!D0) [22:03:37:334]: Closing MSIHANDLE (164) of type 790531 for thread 7120 MSI (s) (80:30) [22:03:37:334]: Closing MSIHANDLE (163) of type 790536 for thread 7600 MSI (s) (80:B0) [22:03:37:334]: Executing op: ActionStart(Name=RollbackServiceConfig,,) MSI (s) (80:B0) [22:03:37:334]: Executing op: CustomActionSchedule(Action=RollbackServiceConfig,ActionType=3329,Source=BinaryData,Target=RollbackServiceConfig,CustomActionData=SchedServiceConfig) MSI (s) (80:B0) [22:03:37:334]: Executing op: ActionStart(Name=ExecServiceConfig,,) MSI (s) (80:B0) [22:03:37:334]: Executing op: CustomActionSchedule(Action=ExecServiceConfig,ActionType=3073,Source=BinaryData,Target=ExecServiceConfig,CustomActionData=SchedServiceConfig€SntpService€0€restart€restart€none€1€120€€) MSI (s) (80:B0) [22:03:37:350]: Creating MSIHANDLE (170) of type 790536 for thread 7600 MSI (s) (80:A0) [22:03:37:350]: Invoking remote custom action. DLL: C:\windows\Installer\MSI8487.tmp, Entrypoint: ExecServiceConfig MSI (s) (80!84) [22:03:37:366]: Creating MSIHANDLE (171) of type 790531 for thread 1156 MSI (s) (80!84) [22:03:37:366]: Closing MSIHANDLE (171) of type 790531 for thread 1156 MSI (s) (80!84) [22:03:37:366]: Creating MSIHANDLE (172) of type 790531 for thread 1156 ExecServiceConfig: Entering ExecServiceConfig in C:\windows\Installer\MSI8487.tmp, version 3.11.2318.0 MSI (s) (80!84) [22:03:37:366]: Closing MSIHANDLE (172) of type 790531 for thread 1156 MSI (s) (80!84) [22:03:37:631]: Creating MSIHANDLE (173) of type 790531 for thread 1156 ExecServiceConfig: Configuring Service: SntpService MSI (s) (80!84) [22:03:37:631]: Closing MSIHANDLE (173) of type 790531 for thread 1156 MSI (s) (80:A0) [22:03:37:631]: Closing MSIHANDLE (170) of type 790536 for thread 7600 MSI (s) (80:B0) [22:03:37:646]: Executing op: ActionStart(Name=SetupSspUserAccountRollback,,) MSI (s) (80:B0) [22:03:37:646]: Executing op: CustomActionSchedule(Action=SetupSspUserAccountRollback,ActionType=1281,Source=BinaryData,Target=CleanUpSsspUserAccount,CustomActionData=NT SERVICE\sntpservice) MSI (s) (80:B0) [22:03:37:646]: Executing op: ActionStart(Name=SetupSspUserAccount,,) MSI (s) (80:B0) [22:03:37:646]: Executing op: CustomActionSchedule(Action=SetupSspUserAccount,ActionType=1025,Source=BinaryData,Target=SetupSspUserAccount,CustomActionData=NT SERVICE\sntpservice) MSI (s) (80:B0) [22:03:37:646]: Creating MSIHANDLE (174) of type 790536 for thread 7600 MSI (s) (80:EC) [22:03:37:646]: Invoking remote custom action. DLL: C:\windows\Installer\MSI85C0.tmp, Entrypoint: SetupSspUserAccount MSI (s) (80!94) [22:03:37:662]: Creating MSIHANDLE (175) of type 790531 for thread 6804 MSI (s) (80!94) [22:03:37:662]: Closing MSIHANDLE (175) of type 790531 for thread 6804 MSI (s) (80!94) [22:03:37:662]: Creating MSIHANDLE (176) of type 790531 for thread 6804 SetupSspUserAccount: Entering SetupSspUserAccount in C:\Windows\syswow64\MsiExec.exe, version 5.0.7601.24535 MSI (s) (80!94) [22:03:37:662]: Closing MSIHANDLE (176) of type 790531 for thread 6804 MSI (s) (80!94) [22:03:37:662]: Creating MSIHANDLE (177) of type 790531 for thread 6804 SetupSspUserAccount: Initialized. MSI (s) (80!94) [22:03:37:678]: Closing MSIHANDLE (177) of type 790531 for thread 6804 MSI (s) (80!94) [22:03:37:678]: Creating MSIHANDLE (178) of type 790531 for thread 6804 SetupSspUserAccount: OLDUSERGROUP does not exist - not adding permissions MSI (s) (80!94) [22:03:37:678]: Closing MSIHANDLE (178) of type 790531 for thread 6804 MSI (s) (80:EC) [22:03:37:678]: Closing MSIHANDLE (174) of type 790536 for thread 7600 MSI (s) (80:B0) [22:03:37:678]: Executing op: ActionStart(Name=MsiConfigureServices,,) SetupSspUserAccount: Granting permissions to user "NT SERVICE\sntpservice" MSI (s) (80:B0) [22:03:37:678]: Executing op: ProgressTotal(Total=1,Type=1,ByteEquivalent=1300000) MSI (s) (80:B0) [22:03:37:678]: Executing op: ServiceConfigure(,Name=SntpService,Event=5,ConfigType=5,Argument=1) MSI (s) (80:B0) [22:03:37:678]: Changing configuration of service SntpService. MSI (s) (80:B0) [22:03:37:880]: Changed configuration of service SntpService with ConfigType SERVICE_CONFIG_SERVICE_SID_INFO MSI (s) (80:B0) [22:03:37:880]: Done changing configuration of service SntpService MSI (s) (80:B0) [22:03:37:880]: Executing op: ActionStart(Name=AddTrustedPublisherRollback,,) MSI (s) (80:B0) [22:03:37:880]: Executing op: CustomActionSchedule(Action=AddTrustedPublisherRollback,ActionType=1345,Source=BinaryData,Target=RemoveTrustedPublisher,CustomActionData=C:\Program Files\Sophos\Sophos Network Threat Protection\SophosNTPLWF\SophosNTPLWF.cat) MSI (s) (80:B0) [22:03:37:896]: Executing op: ActionStart(Name=AddTrustedPublisher,,) MSI (s) (80:B0) [22:03:37:896]: Executing op: CustomActionSchedule(Action=AddTrustedPublisher,ActionType=1025,Source=BinaryData,Target=AddTrustedPublisher,CustomActionData=C:\Program Files\Sophos\Sophos Network Threat Protection\SophosNTPLWF\SophosNTPLWF.cat) MSI (s) (80:B0) [22:03:37:896]: Creating MSIHANDLE (179) of type 790536 for thread 7600 MSI (s) (80:C4) [22:03:37:896]: Invoking remote custom action. DLL: C:\windows\Installer\MSI86BB.tmp, Entrypoint: AddTrustedPublisher MSI (s) (80!14) [22:03:37:927]: Creating MSIHANDLE (180) of type 790531 for thread 1300 MSI (s) (80!14) [22:03:37:927]: Closing MSIHANDLE (180) of type 790531 for thread 1300 MSI (s) (80!14) [22:03:37:927]: Creating MSIHANDLE (181) of type 790531 for thread 1300 AddTrustedPublisher: Entering AddTrustedPublisher in C:\windows\Installer\MSI86BB.tmp, version 1.9.2373.0 MSI (s) (80!14) [22:03:37:927]: Closing MSIHANDLE (181) of type 790531 for thread 1300 MSI (s) (80:C4) [22:03:37:927]: Closing MSIHANDLE (179) of type 790536 for thread 7600 MSI (s) (80:B0) [22:03:37:927]: Executing op: ActionStart(Name=RollbackInstallSophosNTPLWF,,) AddTrustedPublisher: Catalog file path: C:\Program Files\Sophos\Sophos Network Threat Protection\SophosNTPLWF\SophosNTPLWF.cat MSI (s) (80:B0) [22:03:37:943]: Executing op: CustomActionSchedule(Action=RollbackInstallSophosNTPLWF,ActionType=1345,Source=BinaryData,Target=WixQuietExec64,CustomActionData="C:\windows\system32\\netcfg.exe" /u SOPHOS_SOPHOSNTPLWF) MSI (s) (80:B0) [22:03:37:943]: Executing op: ActionStart(Name=InstallSophosNTPLWF,,) MSI (s) (80:B0) [22:03:37:943]: Executing op: CustomActionSchedule(Action=InstallSophosNTPLWF,ActionType=1025,Source=BinaryData,Target=WixQuietExec64,CustomActionData="C:\windows\system32\\netcfg.exe" /l "C:\Program Files\Sophos\Sophos Network Threat Protection\SophosNTPLWF\SophosNTPLWF.inf" /c s /i SOPHOS_SOPHOSNTPLWF) MSI (s) (80:B0) [22:03:37:943]: Creating MSIHANDLE (182) of type 790536 for thread 7600 MSI (s) (80:BC) [22:03:37:943]: Invoking remote custom action. DLL: C:\windows\Installer\MSI86EA.tmp, Entrypoint: WixQuietExec64 MSI (s) (80!90) [22:03:37:958]: Creating MSIHANDLE (183) of type 790531 for thread 6800 MSI (s) (80!90) [22:03:37:958]: Closing MSIHANDLE (183) of type 790531 for thread 6800 MSI (s) (80!90) [22:03:37:958]: Creating MSIHANDLE (184) of type 790531 for thread 6800 WixQuietExec64: Entering WixQuietExec64 in C:\windows\Installer\MSI86EA.tmp, version 3.11.2318.0 MSI (s) (80!90) [22:03:37:958]: Closing MSIHANDLE (184) of type 790531 for thread 6800 MSI (s) (80!90) [22:07:57:914]: Creating MSIHANDLE (185) of type 790531 for thread 6800 WixQuietExec64: "C:\windows\system32\\netcfg.exe" /l "C:\Program Files\Sophos\Sophos Network Threat Protection\SophosNTPLWF\SophosNTPLWF.inf" /c s /i SOPHOS_SOPHOSNTPLWF MSI (s) (80!90) [22:07:57:914]: Closing MSIHANDLE (185) of type 790531 for thread 6800 MSI (s) (80!90) [22:07:57:914]: Creating MSIHANDLE (186) of type 790531 for thread 6800 WixQuietExec64: Trying to install SOPHOS_SOPHOSNTPLWF ... MSI (s) (80!90) [22:07:57:914]: Closing MSIHANDLE (186) of type 790531 for thread 6800 MSI (s) (80!90) [22:07:57:914]: Creating MSIHANDLE (187) of type 790531 for thread 6800 WixQuietExec64: MSI (s) (80!90) [22:07:57:914]: Closing MSIHANDLE (187) of type 790531 for thread 6800 MSI (s) (80!90) [22:07:57:914]: Creating MSIHANDLE (188) of type 790531 for thread 6800 WixQuietExec64: ..failed. Error code: 0x80070020. MSI (s) (80!90) [22:07:57:914]: Closing MSIHANDLE (188) of type 790531 for thread 6800 MSI (s) (80!90) [22:07:57:914]: Creating MSIHANDLE (189) of type 790531 for thread 6800 WixQuietExec64: MSI (s) (80!90) [22:07:57:914]: Closing MSIHANDLE (189) of type 790531 for thread 6800 MSI (s) (80!90) [22:07:57:914]: Creating MSIHANDLE (190) of type 790531 for thread 6800 WixQuietExec64: Error 0x80070020: Command line returned an error. MSI (s) (80!90) [22:07:57:914]: Closing MSIHANDLE (190) of type 790531 for thread 6800 MSI (s) (80!90) [22:07:57:914]: Creating MSIHANDLE (191) of type 790531 for thread 6800 WixQuietExec64: Error 0x80070020: QuietExec64 Failed MSI (s) (80!90) [22:07:57:914]: Closing MSIHANDLE (191) of type 790531 for thread 6800 WixQuietExec64: Error 0x80070020: Failed in ExecCommon method MSI (s) (80:BC) [22:07:57:914]: Closing MSIHANDLE (182) of type 790536 for thread 7600 CustomAction InstallSophosNTPLWF returned actual error code 1603 (note this may not be 100% accurate if translation happened inside sandbox) MSI (s) (80:B0) [22:07:58:070]: User policy value 'DisableRollback' is 0 MSI (s) (80:B0) [22:07:58:070]: Machine policy value 'DisableRollback' is 0 Action ended 22:07:58: InstallFinalize. Return value 3. MSI (s) (80:B0) [22:07:58:070]: Note: 1: 2318 2: MSI (s) (80:B0) [22:07:58:319]: Executing op: Header(Signature=1397708873,Version=500,Timestamp=1358278769,LangId=1033,Platform=589824,ScriptType=2,ScriptMajorVersion=21,ScriptMinorVersion=4,ScriptAttributes=1) MSI (s) (80:B0) [22:07:58:319]: Executing op: DialogInfo(Type=0,Argument=1033) MSI (s) (80:B0) [22:07:58:319]: Executing op: DialogInfo(Type=1,Argument=Sophos Network Threat Protection) MSI (s) (80:B0) [22:07:58:319]: Executing op: RollbackInfo(,RollbackAction=Rollback,RollbackDescription=Rolling back action:,RollbackTemplate=[1],CleanupAction=RollbackCleanup,CleanupDescription=Removing backup files,CleanupTemplate=File: [1]) MSI (s) (80:B0) [22:07:58:319]: Executing op: ActionStart(Name=InstallSophosNTPLWF,,) MSI (s) (80:B0) [22:07:58:319]: Executing op: ProductInfo(ProductKey={4B1F9009-CD85-43C0-BCBD-D491908D5A52},ProductName=Sophos Network Threat Protection,PackageName=Sophos Network Threat Protection.msi,Language=1033,Version=17369413,Assignment=1,ObsoleteArg=0,ProductIcon=shield.ico,,PackageCode={33601027-BB79-4C6F-B891-2D4A958AED7F},,,InstanceType=0,LUASetting=0,RemoteURTInstalls=0,ProductDeploymentFlags=3) MSI (s) (80:B0) [22:07:58:319]: Executing op: ActionStart(Name=RollbackInstallSophosNTPLWF,,) MSI (s) (80:B0) [22:07:58:319]: Executing op: CustomActionRollback(Action=RollbackInstallSophosNTPLWF,ActionType=1345,Source=BinaryData,Target=WixQuietExec64,CustomActionData="C:\windows\system32\\netcfg.exe" /u SOPHOS_SOPHOSNTPLWF) MSI (s) (80:B0) [22:07:58:319]: Creating MSIHANDLE (192) of type 790536 for thread 7600 MSI (s) (80:84) [22:07:58:319]: Invoking remote custom action. DLL: C:\windows\Installer\MSI8009.tmp, Entrypoint: WixQuietExec64 MSI (s) (80!B4) [22:07:58:335]: Creating MSIHANDLE (193) of type 790531 for thread 8116 MSI (s) (80!B4) [22:07:58:335]: Closing MSIHANDLE (193) of type 790531 for thread 8116 MSI (s) (80!B4) [22:07:58:335]: Creating MSIHANDLE (194) of type 790531 for thread 8116 WixQuietExec64: Entering WixQuietExec64 in C:\windows\Installer\MSI8009.tmp, version 3.11.2318.0 MSI (s) (80!B4) [22:07:58:335]: Closing MSIHANDLE (194) of type 790531 for thread 8116 MSI (s) (80!B4) [22:07:58:522]: Creating MSIHANDLE (195) of type 790531 for thread 8116 WixQuietExec64: "C:\windows\system32\\netcfg.exe" /u SOPHOS_SOPHOSNTPLWF MSI (s) (80!B4) [22:07:58:522]: Closing MSIHANDLE (195) of type 790531 for thread 8116 MSI (s) (80!B4) [22:07:58:522]: Creating MSIHANDLE (196) of type 790531 for thread 8116 WixQuietExec64: Trying to uninstall SOPHOS_SOPHOSNTPLWF ... MSI (s) (80!B4) [22:07:58:522]: Closing MSIHANDLE (196) of type 790531 for thread 8116 MSI (s) (80!B4) [22:07:58:522]: Creating MSIHANDLE (197) of type 790531 for thread 8116 WixQuietExec64: MSI (s) (80!B4) [22:07:58:522]: Closing MSIHANDLE (197) of type 790531 for thread 8116 MSI (s) (80!B4) [22:07:58:522]: Creating MSIHANDLE (198) of type 790531 for thread 8116 WixQuietExec64: ... SOPHOS_SOPHOSNTPLWF is not installed. MSI (s) (80!B4) [22:07:58:522]: Closing MSIHANDLE (198) of type 790531 for thread 8116 MSI (s) (80!B4) [22:07:58:522]: Creating MSIHANDLE (199) of type 790531 for thread 8116 WixQuietExec64: MSI (s) (80!B4) [22:07:58:522]: Closing MSIHANDLE (199) of type 790531 for thread 8116 MSI (s) (80!B4) [22:07:58:522]: Creating MSIHANDLE (200) of type 790531 for thread 8116 WixQuietExec64: ...done. MSI (s) (80!B4) [22:07:58:522]: Closing MSIHANDLE (200) of type 790531 for thread 8116 MSI (s) (80:84) [22:07:58:522]: Closing MSIHANDLE (192) of type 790536 for thread 7600 WixQuietExec64: MSI (s) (80:B0) [22:07:58:522]: Executing op: ActionStart(Name=AddTrustedPublisher,,) MSI (s) (80:B0) [22:07:58:522]: Executing op: ActionStart(Name=AddTrustedPublisherRollback,,) MSI (s) (80:B0) [22:07:58:522]: Executing op: CustomActionRollback(Action=AddTrustedPublisherRollback,ActionType=1345,Source=BinaryData,Target=RemoveTrustedPublisher,CustomActionData=C:\Program Files\Sophos\Sophos Network Threat Protection\SophosNTPLWF\SophosNTPLWF.cat) MSI (s) (80:B0) [22:07:58:522]: Creating MSIHANDLE (201) of type 790536 for thread 7600 MSI (s) (80:54) [22:07:58:522]: Invoking remote custom action. DLL: C:\windows\Installer\MSI80D4.tmp, Entrypoint: RemoveTrustedPublisher MSI (s) (80!F4) [22:07:58:553]: Creating MSIHANDLE (202) of type 790531 for thread 5364 MSI (s) (80!F4) [22:07:58:569]: Closing MSIHANDLE (202) of type 790531 for thread 5364 MSI (s) (80!F4) [22:07:58:569]: Creating MSIHANDLE (203) of type 790531 for thread 5364 RemoveTrustedPublisher: Entering RemoveTrustedPublisher in C:\windows\Installer\MSI80D4.tmp, version 1.9.2373.0 MSI (s) (80!F4) [22:07:58:569]: Closing MSIHANDLE (203) of type 790531 for thread 5364 MSI (s) (80:54) [22:07:58:569]: Closing MSIHANDLE (201) of type 790536 for thread 7600 RemoveTrustedPublisher: Catalog file path: C:\Program Files\Sophos\Sophos Network Threat Protection\SophosNTPLWF\SophosNTPLWF.cat MSI (s) (80:B0) [22:07:58:569]: Executing op: ActionStart(Name=MsiConfigureServices,,) MSI (s) (80:B0) [22:07:58:569]: Executing op: ServiceConfigure(,Name=SntpService,,ConfigType=5,Argument=0) MSI (s) (80:B0) [22:07:58:569]: Changing configuration of service SntpService. MSI (s) (80:B0) [22:07:58:787]: Changed configuration of service SntpService with ConfigType SERVICE_CONFIG_SERVICE_SID_INFO MSI (s) (80:B0) [22:07:58:787]: Done changing configuration of service SntpService MSI (s) (80:B0) [22:07:58:787]: Executing op: ActionStart(Name=SetupSspUserAccount,,) MSI (s) (80:B0) [22:07:58:787]: Executing op: ActionStart(Name=SetupSspUserAccountRollback,,) MSI (s) (80:B0) [22:07:58:803]: Executing op: CustomActionRollback(Action=SetupSspUserAccountRollback,ActionType=1281,Source=BinaryData,Target=CleanUpSsspUserAccount,CustomActionData=NT SERVICE\sntpservice) MSI (s) (80:B0) [22:07:58:803]: Creating MSIHANDLE (204) of type 790536 for thread 7600 MSI (s) (80:C8) [22:07:58:803]: Invoking remote custom action. DLL: C:\windows\Installer\MSI81EE.tmp, Entrypoint: CleanUpSsspUserAccount MSI (s) (80!54) [22:07:58:803]: Creating MSIHANDLE (205) of type 790531 for thread 2900 MSI (s) (80!54) [22:07:58:803]: Closing MSIHANDLE (205) of type 790531 for thread 2900 MSI (s) (80!54) [22:07:58:803]: Creating MSIHANDLE (206) of type 790531 for thread 2900 CleanUpSsspUserAccount: Entering CleanUpSsspUserAccount in C:\Windows\syswow64\MsiExec.exe, version 5.0.7601.24535 MSI (s) (80!54) [22:07:58:818]: Closing MSIHANDLE (206) of type 790531 for thread 2900 MSI (s) (80:C8) [22:07:58:818]: Closing MSIHANDLE (204) of type 790536 for thread 7600 CleanUpSsspUserAccount: Initialized. MSI (s) (80:B0) [22:07:58:818]: Executing op: ActionStart(Name=ExecServiceConfig,,) MSI (s) (80:B0) [22:07:58:818]: Executing op: ActionStart(Name=RollbackServiceConfig,,) MSI (s) (80:B0) [22:07:58:818]: Executing op: CustomActionRollback(Action=RollbackServiceConfig,ActionType=3329,Source=BinaryData,Target=RollbackServiceConfig,CustomActionData=SchedServiceConfig) MSI (s) (80:B0) [22:07:58:818]: Creating MSIHANDLE (207) of type 790536 for thread 7600 MSI (s) (80:C8) [22:07:58:818]: Invoking remote custom action. DLL: C:\windows\Installer\MSI81FF.tmp, Entrypoint: RollbackServiceConfig MSI (s) (80!AC) [22:07:58:834]: Creating MSIHANDLE (208) of type 790531 for thread 2732 MSI (s) (80!AC) [22:07:58:834]: Closing MSIHANDLE (208) of type 790531 for thread 2732 MSI (s) (80!AC) [22:07:58:834]: Creating MSIHANDLE (209) of type 790531 for thread 2732 RollbackServiceConfig: Entering RollbackServiceConfig in C:\windows\Installer\MSI81FF.tmp, version 3.11.2318.0 MSI (s) (80!AC) [22:07:58:834]: Closing MSIHANDLE (209) of type 790531 for thread 2732 MSI (s) (80!AC) [22:07:59:162]: Creating MSIHANDLE (210) of type 790531 for thread 2732 RollbackServiceConfig: Reconfiguring Service: SntpService MSI (s) (80!AC) [22:07:59:177]: Closing MSIHANDLE (210) of type 790531 for thread 2732 MSI (s) (80:C8) [22:07:59:177]: Closing MSIHANDLE (207) of type 790536 for thread 7600 MSI (s) (80:B0) [22:07:59:177]: Executing op: ActionStart(Name=ExecSecureObjects_64,,) MSI (s) (80:B0) [22:07:59:177]: Executing op: ActionStart(Name=AddSIPSSubmitterUserAccount,,) MSI (s) (80:B0) [22:07:59:177]: Executing op: ActionStart(Name=AddSIPSSubmitterUserAccountRollback,,) MSI (s) (80:B0) [22:07:59:177]: Executing op: CustomActionRollback(Action=AddSIPSSubmitterUserAccountRollback,ActionType=1281,Source=BinaryData,Target=RemoveSIPSManagementUser,CustomActionData=NT SERVICE\SntpService) MSI (s) (80:B0) [22:07:59:177]: Creating MSIHANDLE (211) of type 790536 for thread 7600 MSI (s) (80:C4) [22:07:59:177]: Invoking remote custom action. DLL: C:\windows\Installer\MSI8367.tmp, Entrypoint: RemoveSIPSManagementUser MSI (s) (80!58) [22:07:59:193]: Creating MSIHANDLE (212) of type 790531 for thread 7256 MSI (s) (80!58) [22:07:59:193]: Closing MSIHANDLE (212) of type 790531 for thread 7256 MSI (s) (80!58) [22:07:59:193]: Creating MSIHANDLE (213) of type 790531 for thread 7256 RemoveSIPSManagementUser Enter (290) MSI (s) (80!58) [22:07:59:193]: Closing MSIHANDLE (213) of type 790531 for thread 7256 MSI (s) (80:C4) [22:07:59:193]: Closing MSIHANDLE (211) of type 790536 for thread 7600 RemoveSIPSManagementUser Exit (338) MSI (s) (80:B0) [22:07:59:193]: Executing op: ActionStart(Name=InstallServices,Description=Installing new services,Template=Service: [2]) MSI (s) (80:B0) [22:07:59:193]: Executing op: ServiceControl(,Name=SntpService,Action=8,,) MSI (s) (80:B0) [22:07:59:193]: Executing op: ActionStart(Name=WriteRegistryValues,Description=Writing system registry values,Template=Key: [1], Name: [2], Value: [3]) MSI (s) (80:B0) [22:07:59:193]: Executing op: RegOpenKey(Root=-2147483646,Key=Software\Sophos\Heartbeat,,BinaryType=1,,) MSI (s) (80:B0) [22:07:59:193]: Executing op: RegRemoveKey() MSI (s) (80:B0) [22:07:59:193]: Executing op: RegOpenKey(Root=-2147483646,Key=SYSTEM\CurrentControlSet\Control\SafeBoot\Network\SntpService,,BinaryType=1,,) MSI (s) (80:B0) [22:07:59:193]: Executing op: RegRemoveValue(,Value=service,) MSI (s) (80:B0) [22:07:59:193]: Executing op: RegRemoveKey() MSI (s) (80:B0) [22:07:59:193]: Note: 1: 1402 2: HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Network\SntpService 3: 2 MSI (s) (80:B0) [22:07:59:193]: Executing op: RegOpenKey(Root=-2147483646,Key=Software\Sophos\Sophos Network Threat Protection,SecurityDescriptor=BinaryData,BinaryType=1,,) MSI (s) (80:B0) [22:07:59:193]: Executing op: RegCreateKey() MSI (s) (80:B0) [22:07:59:193]: Executing op: RegOpenKey(Root=-2147483646,Key=Software\Sophos\Sophos Network Threat Protection\Telemetry,SecurityDescriptor=BinaryData,BinaryType=1,,) MSI (s) (80:B0) [22:07:59:193]: Executing op: RegCreateKey() MSI (s) (80:B0) [22:07:59:193]: Executing op: RegOpenKey(Root=-2147483646,Key=Software\Sophos\Sophos Network Threat Protection\Telemetry\MTD,,BinaryType=1,,) MSI (s) (80:B0) [22:07:59:193]: Executing op: RegRemoveKey() MSI (s) (80:B0) [22:07:59:193]: Executing op: RegOpenKey(Root=-2147483646,Key=Software\Sophos\Sophos Network Threat Protection\Telemetry\Heartbeat,,BinaryType=1,,) MSI (s) (80:B0) [22:07:59:193]: Executing op: RegRemoveKey() MSI (s) (80:B0) [22:07:59:208]: Executing op: RegOpenKey(Root=-2147483646,Key=Software\Sophos\Sophos Network Threat Protection\Application,,BinaryType=1,,) MSI (s) (80:B0) [22:07:59:208]: Executing op: RegRemoveValue(Name=Path,Value=C:\Program Files\Sophos\Sophos Network Threat Protection\,) MSI (s) (80:B0) [22:07:59:208]: Executing op: RegCreateKey() MSI (s) (80:B0) [22:07:59:208]: Executing op: RegRemoveValue(Name=ProductVersion,Value=1.9.2373.0,) MSI (s) (80:B0) [22:07:59:208]: Executing op: RegCreateKey() MSI (s) (80:B0) [22:07:59:208]: Executing op: RegRemoveValue(Name=ProductCode,Value={4B1F9009-CD85-43C0-BCBD-D491908D5A52},) MSI (s) (80:B0) [22:07:59:208]: Executing op: RegCreateKey() MSI (s) (80:B0) [22:07:59:208]: Executing op: RegRemoveKey() MSI (s) (80:B0) [22:07:59:208]: Executing op: RegOpenKey(Root=-2147483646,Key=Software\Sophos,SecurityDescriptor=BinaryData,BinaryType=1,,) MSI (s) (80:B0) [22:07:59:208]: Executing op: RegCreateKey() MSI (s) (80:B0) [22:07:59:208]: Executing op: RegOpenKey(Root=-2147483646,Key=Software\Sophos\Telemetry\Plugins\NTP,,BinaryType=0,,) MSI (s) (80:B0) [22:07:59:208]: Executing op: RegRemoveValue(Name=Cmd,Value=SophosNtpTelemetry.exe,) MSI (s) (80:B0) [22:07:59:208]: Executing op: RegCreateKey() MSI (s) (80:B0) [22:07:59:208]: Executing op: RegRemoveValue(Name=Path,Value=C:\Program Files\Sophos\Sophos Network Threat Protection\SophosNtpTelemetry.exe,) MSI (s) (80:B0) [22:07:59:208]: Executing op: RegRemoveKey() MSI (s) (80:B0) [22:07:59:208]: Note: 1: 1402 2: HKEY_LOCAL_MACHINE32\Software\Sophos\Telemetry\Plugins\NTP 3: 2 MSI (s) (80:B0) [22:07:59:208]: Executing op: RegOpenKey(Root=-2147483646,Key=Software\Sophos\Heartbeat,SecurityDescriptor=BinaryData,BinaryType=0,,) MSI (s) (80:B0) [22:07:59:208]: Executing op: RegCreateKey() MSI (s) (80:B0) [22:07:59:208]: Executing op: RegOpenKey(Root=-2147483646,Key=Software\Sophos\Heartbeat\Status,,BinaryType=0,,) MSI (s) (80:B0) [22:07:59:208]: Executing op: RegRemoveKey() MSI (s) (80:B0) [22:07:59:208]: Executing op: ActionStart(Name=RegisterSntpEventManifest,,) MSI (s) (80:B0) [22:07:59:208]: Executing op: ActionStart(Name=RegisterSntpEventManifestRollback,,) MSI (s) (80:B0) [22:07:59:208]: Executing op: CustomActionRollback(Action=RegisterSntpEventManifestRollback,ActionType=3393,Source=BinaryData,Target=WixQuietExec,CustomActionData="wevtutil.exe" um "C:\Program Files\Sophos\Sophos Network Threat Protection\Sntp.man") MSI (s) (80:B0) [22:07:59:208]: Creating MSIHANDLE (214) of type 790536 for thread 7600 MSI (s) (80:94) [22:07:59:224]: Invoking remote custom action. DLL: C:\windows\Installer\MSI8387.tmp, Entrypoint: WixQuietExec MSI (s) (80!54) [22:07:59:224]: Creating MSIHANDLE (215) of type 790531 for thread 2132 MSI (s) (80!54) [22:07:59:224]: Closing MSIHANDLE (215) of type 790531 for thread 2132 MSI (s) (80!54) [22:07:59:224]: Creating MSIHANDLE (216) of type 790531 for thread 2132 WixQuietExec: Entering WixQuietExec in C:\windows\Installer\MSI8387.tmp, version 3.11.2318.0 MSI (s) (80!54) [22:07:59:224]: Closing MSIHANDLE (216) of type 790531 for thread 2132 MSI (s) (80:94) [22:07:59:333]: Closing MSIHANDLE (214) of type 790536 for thread 7600 WixQuietExec: "wevtutil.exe" um "C:\Program Files\Sophos\Sophos Network Threat Protection\Sntp.man" MSI (s) (80:B0) [22:07:59:333]: Executing op: ActionStart(Name=MsiInstallDrivers,,) MSI (s) (80:B0) [22:07:59:333]: Executing op: ActionStart(Name=MsiRollbackInstall,,) MSI (s) (80:B0) [22:07:59:333]: Executing op: CustomActionRollback(Action=MsiRollbackInstall,ActionType=3329,Source=BinaryData,Target=RollbackInstall,CustomActionData=2.12{76F354A6-97D5-4872-9781-2F2642A4F18A}212Sophos Network Threat ProtectionSophos Limited) MSI (s) (80:B0) [22:07:59:333]: Creating MSIHANDLE (217) of type 790536 for thread 7600 MSI (s) (80:AC) [22:07:59:333]: Invoking remote custom action. DLL: C:\windows\Installer\MSI8405.tmp, Entrypoint: RollbackInstall MSI (s) (80!E0) [22:07:59:380]: Creating MSIHANDLE (218) of type 790531 for thread 7136 MSI (s) (80!E0) [22:07:59:380]: Closing MSIHANDLE (218) of type 790531 for thread 7136 MSI (s) (80!E0) [22:07:59:380]: Creating MSIHANDLE (219) of type 790531 for thread 7136 DIFXAPP: ENTER: RollbackInstall() MSI (s) (80!E0) [22:07:59:380]: Closing MSIHANDLE (219) of type 790531 for thread 7136 MSI (s) (80!E0) [22:07:59:380]: Creating MSIHANDLE (220) of type 790531 for thread 7136 DIFXAPP: INFO: 'CustomActionData' property 'DIFxApp Version' is '2.1'. MSI (s) (80!E0) [22:07:59:380]: Closing MSIHANDLE (220) of type 790531 for thread 7136 MSI (s) (80!E0) [22:07:59:380]: Creating MSIHANDLE (221) of type 790531 for thread 7136 DIFXAPP: INFO: 'CustomActionData' property 'componentId' is '{76F354A6-97D5-4872-9781-2F2642A4F18A}'. MSI (s) (80!E0) [22:07:59:380]: Closing MSIHANDLE (221) of type 790531 for thread 7136 MSI (s) (80!E0) [22:07:59:380]: Creating MSIHANDLE (222) of type 790531 for thread 7136 DIFXAPP: INFO: 'CustomActionData' property 'flags' is 0x15. MSI (s) (80!E0) [22:07:59:380]: Closing MSIHANDLE (222) of type 790531 for thread 7136 MSI (s) (80!E0) [22:07:59:380]: Creating MSIHANDLE (223) of type 790531 for thread 7136 DIFXAPP: INFO: 'CustomActionData' property 'installState' is '2'. MSI (s) (80!E0) [22:07:59:380]: Closing MSIHANDLE (223) of type 790531 for thread 7136 MSI (s) (80!E0) [22:07:59:380]: Creating MSIHANDLE (224) of type 790531 for thread 7136 DIFXAPP: INFO: 'CustomActionData' property 'ProductName' is 'Sophos Network Threat Protection'. MSI (s) (80!E0) [22:07:59:380]: Closing MSIHANDLE (224) of type 790531 for thread 7136 MSI (s) (80!E0) [22:07:59:380]: Creating MSIHANDLE (225) of type 790531 for thread 7136 DIFXAPP: INFO: 'CustomActionData' property 'ManufacturerName' is 'Sophos Limited'. MSI (s) (80!E0) [22:07:59:380]: Closing MSIHANDLE (225) of type 790531 for thread 7136 MSI (s) (80!E0) [22:07:59:380]: Creating MSIHANDLE (226) of type 790531 for thread 7136 DIFXAPP: INFO: user SID of user performing the install is 'S-1-5-18'. MSI (s) (80!E0) [22:07:59:380]: Closing MSIHANDLE (226) of type 790531 for thread 7136 MSI (s) (80!E0) [22:07:59:380]: Creating MSIHANDLE (227) of type 790531 for thread 7136 DIFXAPP: INFO: ENTER: DriverPackageUninstallW MSI (s) (80!E0) [22:07:59:380]: Closing MSIHANDLE (227) of type 790531 for thread 7136 MSI (s) (80!E0) [22:07:59:380]: Creating MSIHANDLE (228) of type 790531 for thread 7136 DIFXAPP: INFO: Uninstalling driver package C:\windows\system32\DRVSTORE\Sntp_CE0CFD5C0E97DF99ACEB169D8412E720BFAEFBF0\Sntp.inf... MSI (s) (80!E0) [22:07:59:380]: Closing MSIHANDLE (228) of type 790531 for thread 7136 MSI (s) (80!E0) [22:07:59:380]: Creating MSIHANDLE (229) of type 790531 for thread 7136 DIFXAPP: ERROR: Unable to revert to a previous driver store for service 'sntp'. MSI (s) (80!E0) [22:07:59:380]: Closing MSIHANDLE (229) of type 790531 for thread 7136 MSI (s) (80!E0) [22:07:59:380]: Creating MSIHANDLE (230) of type 790531 for thread 7136 DIFXAPP: ERROR: Will attempt to uninstall the driver. MSI (s) (80!E0) [22:07:59:380]: Closing MSIHANDLE (230) of type 790531 for thread 7136 MSI (s) (80!E0) [22:07:59:396]: Creating MSIHANDLE (231) of type 790531 for thread 7136 DIFXAPP: INFO: service 'sntp' was deleted. MSI (s) (80!E0) [22:07:59:396]: Closing MSIHANDLE (231) of type 790531 for thread 7136 MSI (s) (80!E0) [22:07:59:396]: Creating MSIHANDLE (232) of type 790531 for thread 7136 DIFXAPP: INFO: Driver store entry 'C:\windows\system32\DRVSTORE\Sntp_CE0CFD5C0E97DF99ACEB169D8412E720BFAEFBF0\Sntp.inf' removed. MSI (s) (80!E0) [22:07:59:396]: Closing MSIHANDLE (232) of type 790531 for thread 7136 MSI (s) (80!E0) [22:07:59:396]: Creating MSIHANDLE (233) of type 790531 for thread 7136 DIFXAPP: SUCCESS:Uninstall completed. MSI (s) (80!E0) [22:07:59:396]: Closing MSIHANDLE (233) of type 790531 for thread 7136 MSI (s) (80!E0) [22:07:59:396]: Creating MSIHANDLE (234) of type 790531 for thread 7136 DIFXAPP: INFO: RETURN: DriverPackageUninstallW (0x0) MSI (s) (80!E0) [22:07:59:396]: Closing MSIHANDLE (234) of type 790531 for thread 7136 MSI (s) (80!E0) [22:07:59:396]: Creating MSIHANDLE (235) of type 790531 for thread 7136 DIFXAPP: ERROR: Rollback failed with error 0x2 MSI (s) (80!E0) [22:07:59:396]: Closing MSIHANDLE (235) of type 790531 for thread 7136 DIFXAPP: RETURN: RollbackInstall() 2 (0x2) MSI (s) (80:AC) [22:07:59:396]: Closing MSIHANDLE (217) of type 790536 for thread 7600 CustomAction MsiRollbackInstall returned actual error code 1603 but will be translated to success due to continue marking MSI (s) (80:B0) [22:07:59:396]: Executing op: ActionStart(Name=InstallFiles,Description=Copying new files,Template=File: [1], Directory: [9], Size: [6]) MSI (s) (80:B0) [22:07:59:396]: Executing op: SetTargetFolder(Folder=C:\Program Files\Sophos\Sophos Network Threat Protection\) MSI (s) (80:B0) [22:07:59:396]: Executing op: FileRemove(,FileName=C:\windows\Installer\$PatchCache$\Managed\9009F1B458DC0C34CBDB4D1909D8A525\1.9.2373\F_CENTRAL_vccorlib120_x86.194841A2_D0F2_3B96_9F71_05BA91BEA0FA,Elevate=1,) MSI (s) (80:B0) [22:07:59:396]: Executing op: FileRemove(,FileName=C:\windows\Installer\$PatchCache$\Managed\9009F1B458DC0C34CBDB4D1909D8A525\1.9.2373\F_CENTRAL_vccorlib120_x64.05F0B5F5_44A8_3793_976B_A4F17AECF92C,Elevate=1,) MSI (s) (80:B0) [22:07:59:396]: Executing op: FileRemove(,FileName=C:\windows\Installer\$PatchCache$\Managed\9009F1B458DC0C34CBDB4D1909D8A525\1.9.2373\F_CENTRAL_msvcr120_x86.194841A2_D0F2_3B96_9F71_05BA91BEA0FA,Elevate=1,) MSI (s) (80:B0) [22:07:59:396]: Executing op: FileRemove(,FileName=C:\windows\Installer\$PatchCache$\Managed\9009F1B458DC0C34CBDB4D1909D8A525\1.9.2373\F_CENTRAL_msvcp120_x86.194841A2_D0F2_3B96_9F71_05BA91BEA0FA,Elevate=1,) MSI (s) (80:B0) [22:07:59:396]: Executing op: FileRemove(,FileName=C:\windows\Installer\$PatchCache$\Managed\9009F1B458DC0C34CBDB4D1909D8A525\1.9.2373\F_CENTRAL_msvcp120_x64.05F0B5F5_44A8_3793_976B_A4F17AECF92C,Elevate=1,) MSI (s) (80:B0) [22:07:59:396]: Executing op: FolderRemove(Folder=C:\windows\Installer\$PatchCache$\Managed\9009F1B458DC0C34CBDB4D1909D8A525\1.9.2373\,Foreign=1) MSI (s) (80:B0) [22:07:59:411]: Executing op: FolderRemove(Folder=C:\windows\Installer\$PatchCache$\Managed\9009F1B458DC0C34CBDB4D1909D8A525\,Foreign=1) MSI (s) (80:B0) [22:07:59:411]: Executing op: UnregisterSharedComponentProvider(Component={14E8634F-8AEA-4CD1-AC48-BEBFDA18523A},ProductCode={4B1F9009-CD85-43C0-BCBD-D491908D5A52}) MSI (s) (80:B0) [22:07:59:411]: Executing op: UnregisterSharedComponentProvider(Component={570C624B-D57C-4CD1-9013-1B80C800093B},ProductCode={4B1F9009-CD85-43C0-BCBD-D491908D5A52}) MSI (s) (80:B0) [22:07:59:411]: Executing op: UnregisterSharedComponentProvider(Component={63B83B20-1AB9-4F49-B0B2-4489724CA96C},ProductCode={4B1F9009-CD85-43C0-BCBD-D491908D5A52}) MSI (s) (80:B0) [22:07:59:411]: Executing op: UnregisterSharedComponentProvider(Component={74260D9F-D644-423B-B2D4-0291EA4BA8BE},ProductCode={4B1F9009-CD85-43C0-BCBD-D491908D5A52}) MSI (s) (80:B0) [22:07:59:411]: Executing op: UnregisterSharedComponentProvider(Component={0835C947-D6D2-4E52-AF14-0231D04E88EA},ProductCode={4B1F9009-CD85-43C0-BCBD-D491908D5A52}) MSI (s) (80:B0) [22:07:59:427]: Executing op: FileRemove(,FileName=C:\Program Files\Sophos\Sophos Network Threat Protection\SophosNtpTelemetry.exe,,) MSI (s) (80:B0) [22:07:59:474]: Executing op: FileRemove(,FileName=C:\Program Files\Sophos\Sophos Network Threat Protection\SophosNtpService.exe,,) MSI (s) (80:B0) [22:07:59:474]: Executing op: SetTargetFolder(Folder=C:\Program Files\Sophos\Sophos Network Threat Protection\SophosNTPLWF\) MSI (s) (80:B0) [22:07:59:474]: Executing op: FileRemove(,FileName=C:\Program Files\Sophos\Sophos Network Threat Protection\SophosNTPLWF\SophosNTPLWF.sys,,) MSI (s) (80:B0) [22:07:59:489]: Note: 1: 2318 2: MSI (s) (80:B0) [22:07:59:489]: Executing op: FileRemove(,FileName=C:\Program Files\Sophos\Sophos Network Threat Protection\SophosNTPLWF\SophosNTPLWF.inf,,) MSI (s) (80:B0) [22:07:59:489]: Note: 1: 2318 2: MSI (s) (80:B0) [22:07:59:489]: Executing op: FileRemove(,FileName=C:\Program Files\Sophos\Sophos Network Threat Protection\SophosNTPLWF\SophosNTPLWF.cat,,) MSI (s) (80:B0) [22:07:59:489]: Note: 1: 2318 2: MSI (s) (80:B0) [22:07:59:489]: Executing op: SetTargetFolder(Folder=C:\Program Files\Sophos\Sophos Network Threat Protection\) MSI (s) (80:B0) [22:07:59:489]: Executing op: FileRemove(,FileName=C:\Program Files\Sophos\Sophos Network Threat Protection\sof.dat,,) MSI (s) (80:B0) [22:07:59:489]: Executing op: FileRemove(,FileName=C:\Program Files\Sophos\Sophos Network Threat Protection\Sntp.sys,,) MSI (s) (80:B0) [22:07:59:489]: Executing op: FileRemove(,FileName=C:\Program Files\Sophos\Sophos Network Threat Protection\Sntp.man,,) MSI (s) (80:B0) [22:07:59:489]: Executing op: FileRemove(,FileName=C:\Program Files\Sophos\Sophos Network Threat Protection\Sntp.inf,,) MSI (s) (80:B0) [22:07:59:489]: Executing op: FileRemove(,FileName=C:\Program Files\Sophos\Sophos Network Threat Protection\Sntp.cat,,) MSI (s) (80:B0) [22:07:59:489]: Executing op: FileRemove(,FileName=C:\Program Files\Sophos\Sophos Network Threat Protection\scf.dat,,) MSI (s) (80:B0) [22:07:59:505]: Executing op: FileRemove(,FileName=C:\Program Files\Sophos\Sophos Network Threat Protection\NTPAdapter.dll,,) MSI (s) (80:B0) [22:07:59:536]: Executing op: FileRemove(,FileName=C:\Program Files\Sophos\Sophos Network Threat Protection\Notice.txt,,) MSI (s) (80:B0) [22:07:59:536]: Executing op: FileRemove(,FileName=C:\Program Files\Sophos\Sophos Network Threat Protection\navl.dll,,) MSI (s) (80:B0) [22:07:59:552]: Executing op: FileRemove(,FileName=C:\Program Files\Sophos\Sophos Network Threat Protection\integrity.dat,,) MSI (s) (80:B0) [22:07:59:552]: Executing op: SetTargetFolder(Folder=C:\ProgramData\Sophos\Heartbeat\Config\) MSI (s) (80:B0) [22:07:59:567]: Executing op: FileRemove(,FileName=C:\ProgramData\Sophos\Heartbeat\Config\Heartbeat.xml,,) MSI (s) (80:B0) [22:07:59:567]: Executing op: SetTargetFolder(Folder=C:\Program Files\Sophos\Sophos Network Threat Protection\) MSI (s) (80:B0) [22:07:59:567]: Executing op: FileRemove(,FileName=C:\Program Files\Sophos\Sophos Network Threat Protection\Heartbeat.dll,,) MSI (s) (80:B0) [22:07:59:583]: Executing op: FileRemove(,FileName=C:\Program Files\Sophos\Sophos Network Threat Protection\HealthApi.dll,,) MSI (s) (80:B0) [22:07:59:598]: Executing op: FileRemove(,FileName=C:\Program Files\Sophos\Sophos Network Threat Protection\HbtAdapter.dll,,) MSI (s) (80:B0) [22:07:59:630]: Executing op: SetTargetFolder(Folder=C:\windows\system32\) MSI (s) (80:B0) [22:07:59:630]: Executing op: UnregisterSharedComponentProvider(Component={E5B92048-5859-4AF1-AEAD-B97EBF00B087},ProductCode={4B1F9009-CD85-43C0-BCBD-D491908D5A52}) MSI (s) (80:B0) [22:07:59:630]: Executing op: SetTargetFolder(Folder=C:\Program Files\Sophos\Sophos Network Threat Protection\) MSI (s) (80:B0) [22:07:59:630]: Executing op: FileRemove(,FileName=C:\Program Files\Sophos\Sophos Network Threat Protection\BPAIF.dll,,) MSI (s) (80:B0) [22:07:59:645]: Executing op: ActionStart(Name=CreateFolders,Description=Creating folders,Template=Folder: [1]) MSI (s) (80:B0) [22:07:59:645]: Executing op: FolderCreate(Folder=C:\,Foreign=0,SecurityDescriptor=BinaryData,) MSI (s) (80:B0) [22:07:59:661]: Executing op: FolderRemove(Folder=C:\ProgramData\Sophos\Heartbeat\Persist\,Foreign=0) MSI (s) (80:B0) [22:07:59:661]: Note: 1: 2318 2: MSI (s) (80:B0) [22:07:59:661]: Note: 1: 2318 2: MSI (s) (80:B0) [22:07:59:661]: Executing op: FolderRemove(Folder=C:\ProgramData\Sophos\Heartbeat\Logs\,Foreign=0) MSI (s) (80:B0) [22:07:59:661]: Note: 1: 2318 2: MSI (s) (80:B0) [22:07:59:661]: Note: 1: 2318 2: MSI (s) (80:B0) [22:07:59:661]: Executing op: FolderRemove(Folder=C:\ProgramData\Sophos\Heartbeat\Config\,Foreign=0) MSI (s) (80:B0) [22:07:59:661]: Note: 1: 2318 2: MSI (s) (80:B0) [22:07:59:661]: Note: 1: 2318 2: MSI (s) (80:B0) [22:07:59:661]: Executing op: FolderRemove(Folder=C:\ProgramData\Sophos\Heartbeat\,Foreign=0) MSI (s) (80:B0) [22:07:59:661]: Executing op: FolderRemove(Folder=C:\ProgramData\Sophos\Sophos Network Threat Protection\IPS\,Foreign=0) MSI (s) (80:B0) [22:07:59:661]: Note: 1: 2318 2: MSI (s) (80:B0) [22:07:59:661]: Note: 1: 2318 2: MSI (s) (80:B0) [22:07:59:661]: Executing op: FolderRemove(Folder=C:\ProgramData\Sophos\Sophos Network Threat Protection\Logs\,Foreign=0) MSI (s) (80:B0) [22:07:59:661]: Note: 1: 2318 2: MSI (s) (80:B0) [22:07:59:661]: Note: 1: 2318 2: MSI (s) (80:B0) [22:07:59:661]: Executing op: FolderRemove(Folder=C:\ProgramData\Sophos\Sophos Network Threat Protection\Config\Status\,Foreign=0) MSI (s) (80:B0) [22:07:59:661]: Note: 1: 2318 2: MSI (s) (80:B0) [22:07:59:676]: Note: 1: 2318 2: MSI (s) (80:B0) [22:07:59:676]: Note: 1: 2318 2: MSI (s) (80:B0) [22:07:59:676]: Executing op: FolderRemove(Folder=C:\ProgramData\Sophos\Sophos Network Threat Protection\Config\,Foreign=0) MSI (s) (80:B0) [22:07:59:676]: Executing op: FolderRemove(Folder=C:\ProgramData\Sophos\Sophos Network Threat Protection\,Foreign=0) MSI (s) (80:B0) [22:07:59:676]: Executing op: FolderCreate(Folder=C:\Program Files\Sophos\Sophos Network Threat Protection\,Foreign=0,SecurityDescriptor=BinaryData,) MSI (s) (80:B0) [22:07:59:676]: Executing op: FolderRemove(Folder=C:\Program Files\Sophos\Sophos Network Threat Protection\,Foreign=0) MSI (s) (80:B0) [22:07:59:676]: Note: 1: 2318 2: MSI (s) (80:B0) [22:07:59:676]: Executing op: ActionStart(Name=RemoveRegistryValues,Description=Removing system registry values,Template=Key: [1], Name: [2]) MSI (s) (80:B0) [22:07:59:676]: Executing op: RegOpenKey(,Key=AppID\{C092D533-8791-42F8-8EBE-DB116F79B4B7},,BinaryType=1,,) MSI (s) (80:B0) [22:07:59:676]: Executing op: RegRemoveKey() MSI (s) (80:B0) [22:07:59:676]: Note: 1: 1402 2: HKEY_LOCAL_MACHINE\Software\Classes\AppID\{C092D533-8791-42F8-8EBE-DB116F79B4B7} 3: 2 MSI (s) (80:B0) [22:07:59:676]: Executing op: RegOpenKey(,Key=TypeLib\{6886D7DB-850A-4C92-A2F7-CBD741F825E5},,BinaryType=1,,) MSI (s) (80:B0) [22:07:59:676]: Executing op: RegRemoveKey() MSI (s) (80:B0) [22:07:59:676]: Note: 1: 1402 2: HKEY_LOCAL_MACHINE\Software\Classes\TypeLib\{6886D7DB-850A-4C92-A2F7-CBD741F825E5} 3: 2 MSI (s) (80:B0) [22:07:59:676]: Executing op: RegOpenKey(Root=-2147483646,Key=Software\Sophos\AutoUpdate\Products\NTP64,,BinaryType=0,,) MSI (s) (80:B0) [22:07:59:676]: Executing op: RegRemoveKey() MSI (s) (80:B0) [22:07:59:676]: Note: 1: 1402 2: HKEY_LOCAL_MACHINE32\Software\Sophos\AutoUpdate\Products\NTP64 3: 2 MSI (s) (80:B0) [22:07:59:676]: Executing op: ActionStart(Name=UnregisterSntpEventManifest,,) MSI (s) (80:B0) [22:07:59:676]: Executing op: ActionStart(Name=UnregisterSntpEventManifestRollback,,) MSI (s) (80:B0) [22:07:59:676]: Executing op: CustomActionRollback(Action=UnregisterSntpEventManifestRollback,ActionType=3393,Source=BinaryData,Target=WixQuietExec,CustomActionData="wevtutil.exe" im "C:\Program Files\Sophos\Sophos Network Threat Protection\Sntp.man") MSI (s) (80:B0) [22:07:59:676]: Creating MSIHANDLE (236) of type 790536 for thread 7600 MSI (s) (80:EC) [22:07:59:692]: Invoking remote custom action. DLL: C:\windows\Installer\MSI855D.tmp, Entrypoint: WixQuietExec MSI (s) (80!BC) [22:07:59:692]: Creating MSIHANDLE (237) of type 790531 for thread 7100 MSI (s) (80!BC) [22:07:59:692]: Closing MSIHANDLE (237) of type 790531 for thread 7100 MSI (s) (80!BC) [22:07:59:692]: Creating MSIHANDLE (238) of type 790531 for thread 7100 WixQuietExec: Entering WixQuietExec in C:\windows\Installer\MSI855D.tmp, version 3.11.2318.0 MSI (s) (80!BC) [22:07:59:692]: Closing MSIHANDLE (238) of type 790531 for thread 7100 MSI (s) (80!BC) [22:07:59:817]: Creating MSIHANDLE (239) of type 790531 for thread 7100 WixQuietExec: "wevtutil.exe" im "C:\Program Files\Sophos\Sophos Network Threat Protection\Sntp.man" MSI (s) (80!BC) [22:07:59:817]: Closing MSIHANDLE (239) of type 790531 for thread 7100 MSI (s) (80!BC) [22:07:59:817]: Creating MSIHANDLE (240) of type 790531 for thread 7100 WixQuietExec: C:\Program Files\Sophos\Sophos Network Threat Protection\Sntp.man(0): Error 0x800c0005: At column=0, The system cannot locate the resource specified. MSI (s) (80!BC) [22:07:59:817]: Closing MSIHANDLE (240) of type 790531 for thread 7100 MSI (s) (80!BC) [22:07:59:817]: Creating MSIHANDLE (241) of type 790531 for thread 7100 WixQuietExec: MSI (s) (80!BC) [22:07:59:817]: Closing MSIHANDLE (241) of type 790531 for thread 7100 MSI (s) (80:EC) [22:07:59:817]: Closing MSIHANDLE (236) of type 790536 for thread 7600 WixQuietExec: Failed to load xml document C:\Program Files\Sophos\Sophos Network Threat Protection\Sntp.man. Incorrect function. MSI (s) (80:B0) [22:07:59:817]: Executing op: ActionStart(Name=StopServices,Description=Stopping services,Template=Service: [1]) MSI (s) (80:B0) [22:07:59:817]: Executing op: ActionStart(Name=ProcessComponents,Description=Updating component registration,) MSI (s) (80:B0) [22:07:59:817]: Executing op: RegOpenKey(Root=-2147483646,Key=SOFTWARE\Microsoft\Windows\CurrentVersion\SharedDLLs,SecurityDescriptor=BinaryData,BinaryType=1,,) MSI (s) (80:B0) [22:07:59:817]: Executing op: RegOpenKey(Root=-2147483646,Key=SOFTWARE\Microsoft\Windows\CurrentVersion\SharedDLLs,SecurityDescriptor=BinaryData,BinaryType=1,,) MSI (s) (80:B0) [22:07:59:817]: Executing op: RegOpenKey(Root=-2147483646,Key=SOFTWARE\Microsoft\Windows\CurrentVersion\SharedDLLs,SecurityDescriptor=BinaryData,BinaryType=1,,) MSI (s) (80:B0) [22:07:59:817]: Executing op: RegOpenKey(Root=-2147483646,Key=SOFTWARE\Microsoft\Windows\CurrentVersion\SharedDLLs,SecurityDescriptor=BinaryData,BinaryType=0,,) MSI (s) (80:B0) [22:07:59:817]: Executing op: RegOpenKey(Root=-2147483646,Key=SOFTWARE\Microsoft\Windows\CurrentVersion\SharedDLLs,SecurityDescriptor=BinaryData,BinaryType=0,,) MSI (s) (80:B0) [22:07:59:817]: Executing op: RegOpenKey(Root=-2147483646,Key=SOFTWARE\Microsoft\Windows\CurrentVersion\SharedDLLs,SecurityDescriptor=BinaryData,BinaryType=0,,) MSI (s) (80:B0) [22:07:59:817]: Executing op: ComponentUnregister(ComponentId={14E8634F-8AEA-4CD1-AC48-BEBFDA18523A},ProductKey={4B1F9009-CD85-43C0-BCBD-D491908D5A52},BinaryType=1,) MSI (s) (80:B0) [22:07:59:817]: Executing op: ComponentUnregister(ComponentId={570C624B-D57C-4CD1-9013-1B80C800093B},ProductKey={4B1F9009-CD85-43C0-BCBD-D491908D5A52},BinaryType=1,) MSI (s) (80:B0) [22:07:59:817]: Executing op: ComponentUnregister(ComponentId={E5B92048-5859-4AF1-AEAD-B97EBF00B087},ProductKey={4B1F9009-CD85-43C0-BCBD-D491908D5A52},BinaryType=1,) MSI (s) (80:B0) [22:07:59:817]: Executing op: ComponentUnregister(ComponentId={63B83B20-1AB9-4F49-B0B2-4489724CA96C},ProductKey={4B1F9009-CD85-43C0-BCBD-D491908D5A52},BinaryType=0,) MSI (s) (80:B0) [22:07:59:817]: WIN64DUALFOLDERS: 'C:\windows\system32\' will substitute 20 characters in 'C:\windows\SysWOW64\vccorlib120.dll' folder path. (mask argument = 1, the folder pair's iSwapAttrib member = 1). MSI (s) (80:B0) [22:07:59:817]: Executing op: ComponentUnregister(ComponentId={74260D9F-D644-423B-B2D4-0291EA4BA8BE},ProductKey={4B1F9009-CD85-43C0-BCBD-D491908D5A52},BinaryType=0,) MSI (s) (80:B0) [22:07:59:817]: WIN64DUALFOLDERS: 'C:\windows\system32\' will substitute 20 characters in 'C:\windows\SysWOW64\msvcp120.dll' folder path. (mask argument = 1, the folder pair's iSwapAttrib member = 1). MSI (s) (80:B0) [22:07:59:817]: Executing op: ComponentUnregister(ComponentId={0835C947-D6D2-4E52-AF14-0231D04E88EA},ProductKey={4B1F9009-CD85-43C0-BCBD-D491908D5A52},BinaryType=0,) MSI (s) (80:B0) [22:07:59:817]: WIN64DUALFOLDERS: 'C:\windows\system32\' will substitute 20 characters in 'C:\windows\SysWOW64\msvcr120.dll' folder path. (mask argument = 1, the folder pair's iSwapAttrib member = 1). MSI (s) (80:B0) [22:07:59:817]: Executing op: ComponentUnregister(ComponentId={73F7BF07-5A6C-45CF-B42D-786698434BCA},ProductKey={4B1F9009-CD85-43C0-BCBD-D491908D5A52},BinaryType=1,) MSI (s) (80:B0) [22:07:59:817]: Executing op: ComponentUnregister(ComponentId={7C58F223-7247-466F-BFB7-7AFCF335E96D},ProductKey={4B1F9009-CD85-43C0-BCBD-D491908D5A52},BinaryType=1,) MSI (s) (80:B0) [22:07:59:817]: Executing op: ComponentUnregister(ComponentId={1B63A9FF-509B-4CD9-BA54-256A7D62B724},ProductKey={4B1F9009-CD85-43C0-BCBD-D491908D5A52},BinaryType=0,) MSI (s) (80:B0) [22:07:59:817]: Executing op: ComponentUnregister(ComponentId={5FDACC4C-306D-434E-8DF0-F356318B9B39},ProductKey={4B1F9009-CD85-43C0-BCBD-D491908D5A52},BinaryType=0,) MSI (s) (80:B0) [22:07:59:817]: Executing op: ComponentUnregister(ComponentId={6EFE6551-BEDB-470F-9B98-4DD9D50BD010},ProductKey={4B1F9009-CD85-43C0-BCBD-D491908D5A52},BinaryType=1,) MSI (s) (80:B0) [22:07:59:832]: Executing op: ComponentUnregister(ComponentId={B9C8E32A-5EB9-4B7F-91AF-9FD883FB729C},ProductKey={4B1F9009-CD85-43C0-BCBD-D491908D5A52},BinaryType=1,) MSI (s) (80:B0) [22:07:59:832]: Executing op: ComponentUnregister(ComponentId={BE16C094-CC09-4502-8856-ED495E915D2D},ProductKey={4B1F9009-CD85-43C0-BCBD-D491908D5A52},BinaryType=1,) MSI (s) (80:B0) [22:07:59:832]: Executing op: ComponentUnregister(ComponentId={1FCDB37D-595F-4837-919B-EC3B0753CEA3},ProductKey={4B1F9009-CD85-43C0-BCBD-D491908D5A52},BinaryType=1,) MSI (s) (80:B0) [22:07:59:832]: Executing op: ComponentUnregister(ComponentId={D27928F9-1751-4CE1-817A-C94C9DDFA521},ProductKey={4B1F9009-CD85-43C0-BCBD-D491908D5A52},BinaryType=1,) MSI (s) (80:B0) [22:07:59:832]: Executing op: ComponentUnregister(ComponentId={4385E7B8-9B0B-4766-ACD7-EDA6DE4B1AE1},ProductKey={00000000-0000-0000-0000-000000000000},BinaryType=1,) MSI (s) (80:B0) [22:07:59:832]: Executing op: ComponentUnregister(ComponentId={4385E7B8-9B0B-4766-ACD7-EDA6DE4B1AE1},ProductKey={4B1F9009-CD85-43C0-BCBD-D491908D5A52},BinaryType=1,) MSI (s) (80:B0) [22:07:59:832]: Executing op: ComponentUnregister(ComponentId={B77F9317-494B-4351-897B-D7676F0A553D},ProductKey={4B1F9009-CD85-43C0-BCBD-D491908D5A52},BinaryType=1,) MSI (s) (80:B0) [22:07:59:832]: Executing op: ComponentUnregister(ComponentId={53CBCC30-891C-4EDC-9106-456F524A7547},ProductKey={4B1F9009-CD85-43C0-BCBD-D491908D5A52},BinaryType=0,) MSI (s) (80:B0) [22:07:59:832]: Executing op: ComponentUnregister(ComponentId={668853A5-00CE-412E-B21F-0721B6A8A0A9},ProductKey={4B1F9009-CD85-43C0-BCBD-D491908D5A52},BinaryType=1,) MSI (s) (80:B0) [22:07:59:832]: Executing op: ComponentUnregister(ComponentId={4E691ABE-115D-4721-9F9A-3547D17077C5},ProductKey={4B1F9009-CD85-43C0-BCBD-D491908D5A52},BinaryType=1,) MSI (s) (80:B0) [22:07:59:832]: Executing op: ComponentUnregister(ComponentId={DF927ABB-6A5F-44F2-A430-137AAC79AA71},ProductKey={4B1F9009-CD85-43C0-BCBD-D491908D5A52},BinaryType=1,) MSI (s) (80:B0) [22:07:59:832]: Executing op: ComponentUnregister(ComponentId={B7D2E43B-E8A6-4483-9BF7-5195F70225EF},ProductKey={4B1F9009-CD85-43C0-BCBD-D491908D5A52},BinaryType=1,) MSI (s) (80:B0) [22:07:59:832]: Executing op: ComponentUnregister(ComponentId={8E48EE2F-1444-46BF-BCD4-B5F66A4AFF10},ProductKey={4B1F9009-CD85-43C0-BCBD-D491908D5A52},BinaryType=1,) MSI (s) (80:B0) [22:07:59:832]: Executing op: ComponentUnregister(ComponentId={38879DEA-36FA-41BE-ACF3-B084CB40689B},ProductKey={4B1F9009-CD85-43C0-BCBD-D491908D5A52},BinaryType=1,) MSI (s) (80:B0) [22:07:59:832]: Executing op: ComponentUnregister(ComponentId={173F7C99-1A05-4365-B40A-D4EE897D94DE},ProductKey={4B1F9009-CD85-43C0-BCBD-D491908D5A52},BinaryType=1,) MSI (s) (80:B0) [22:07:59:832]: Executing op: ComponentUnregister(ComponentId={355DC0F9-A6B5-4FCA-8121-00847E59A436},ProductKey={4B1F9009-CD85-43C0-BCBD-D491908D5A52},BinaryType=1,) MSI (s) (80:B0) [22:07:59:832]: Executing op: ComponentUnregister(ComponentId={FC337C28-D909-4BF7-826A-F06F35C592F8},ProductKey={4B1F9009-CD85-43C0-BCBD-D491908D5A52},BinaryType=1,) MSI (s) (80:B0) [22:07:59:832]: Executing op: ComponentUnregister(ComponentId={76F354A6-97D5-4872-9781-2F2642A4F18A},ProductKey={4B1F9009-CD85-43C0-BCBD-D491908D5A52},BinaryType=1,) MSI (s) (80:B0) [22:07:59:832]: Executing op: ComponentUnregister(ComponentId={43CBB64E-B6FD-496B-8B4D-9D8842C8E5B2},ProductKey={4B1F9009-CD85-43C0-BCBD-D491908D5A52},BinaryType=1,) MSI (s) (80:B0) [22:07:59:832]: Executing op: ComponentUnregister(ComponentId={9DAD77F9-1B7B-4731-8A40-3EC32A42ACC7},ProductKey={4B1F9009-CD85-43C0-BCBD-D491908D5A52},BinaryType=1,) MSI (s) (80:B0) [22:07:59:832]: Executing op: ComponentUnregister(ComponentId={14456086-9032-4E19-9F29-9F1F9DD21F4E},ProductKey={4B1F9009-CD85-43C0-BCBD-D491908D5A52},BinaryType=1,) MSI (s) (80:B0) [22:07:59:832]: Executing op: ComponentUnregister(ComponentId={8D83ACDA-6DCE-41F3-B5C1-7C01BD45026C},ProductKey={4B1F9009-CD85-43C0-BCBD-D491908D5A52},BinaryType=1,) MSI (s) (80:B0) [22:07:59:832]: Executing op: ComponentUnregister(ComponentId={270CF92A-C3C0-4385-B596-337555FE9560},ProductKey={4B1F9009-CD85-43C0-BCBD-D491908D5A52},BinaryType=1,) MSI (s) (80:B0) [22:07:59:832]: Executing op: ComponentUnregister(ComponentId={F1B8B8D7-46D7-4CA9-B109-35931536EA8A},ProductKey={4B1F9009-CD85-43C0-BCBD-D491908D5A52},BinaryType=1,) MSI (s) (80:B0) [22:07:59:832]: Executing op: ComponentUnregister(ComponentId={74F91047-4C42-457F-B531-A83EF6EC85E2},ProductKey={4B1F9009-CD85-43C0-BCBD-D491908D5A52},BinaryType=1,) MSI (s) (80:B0) [22:07:59:832]: Executing op: ComponentUnregister(ComponentId={4D81D62C-8373-45B8-ABF2-0C0D6ED2DE34},ProductKey={4B1F9009-CD85-43C0-BCBD-D491908D5A52},BinaryType=1,) MSI (s) (80:B0) [22:07:59:832]: Executing op: ComponentUnregister(ComponentId={E1E87C49-DD4A-4C77-8D42-3ACD20DBC536},ProductKey={4B1F9009-CD85-43C0-BCBD-D491908D5A52},BinaryType=1,) MSI (s) (80:B0) [22:07:59:832]: Executing op: ComponentUnregister(ComponentId={07B90057-705F-44F2-8465-C2A4C77784E7},ProductKey={4B1F9009-CD85-43C0-BCBD-D491908D5A52},BinaryType=1,) MSI (s) (80:B0) [22:07:59:832]: Executing op: ActionStart(Name=CheckMaxNumFilters,,) MSI (s) (80:B0) [22:07:59:832]: Executing op: End(Checksum=0,ProgressTotalHDWord=0,ProgressTotalLDWord=0) MSI (s) (80:B0) [22:07:59:832]: Error in rollback skipped. Return: 5 MSI (s) (80:B0) [22:07:59:832]: Note: 1: 2318 2: MSI (s) (80:B0) [22:07:59:832]: No System Restore sequence number for this installation. MSI (s) (80:B0) [22:07:59:832]: Unlocking Server MSI (s) (80:B0) [22:07:59:910]: PROPERTY CHANGE: Deleting UpdateStarted property. Its current value is '1'. Action ended 22:07:59: INSTALL. Return value 3. Property(S): UpgradeCode = {A6CF693D-C171-4DF5-AE49-223B66F65A1A} Property(S): INSTALLTYPE_IS_CENTRAL = #1 Property(S): INSTALLDIR = C:\Program Files\Sophos\Sophos Network Threat Protection\ Property(S): ProductData = C:\ProgramData\Sophos\Sophos Network Threat Protection\ Property(S): Config = C:\ProgramData\Sophos\Sophos Network Threat Protection\Config\ Property(S): Status = C:\ProgramData\Sophos\Sophos Network Threat Protection\Config\Status\ Property(S): Logs = C:\ProgramData\Sophos\Sophos Network Threat Protection\Logs\ Property(S): SnortData = C:\ProgramData\Sophos\Sophos Network Threat Protection\IPS\ Property(S): HeartbeatData = C:\ProgramData\Sophos\Heartbeat\ Property(S): HeartbeatConfig = C:\ProgramData\Sophos\Heartbeat\Config\ Property(S): HeartbeatLogs = C:\ProgramData\Sophos\Heartbeat\Logs\ Property(S): HeartbeatPersist = C:\ProgramData\Sophos\Heartbeat\Persist\ Property(S): SophosNTPLWFDir = C:\Program Files\Sophos\Sophos Network Threat Protection\SophosNTPLWF\ Property(S): TARGETDIR = C:\ Property(S): VersionNT64 = 601 Property(S): RegisterSntpEventManifest = "wevtutil.exe" im "C:\Program Files\Sophos\Sophos Network Threat Protection\Sntp.man" Property(S): RegisterSntpEventManifestRollback = "wevtutil.exe" um "C:\Program Files\Sophos\Sophos Network Threat Protection\Sntp.man" Property(S): UnregisterSntpEventManifest = "wevtutil.exe" um "C:\Program Files\Sophos\Sophos Network Threat Protection\Sntp.man" Property(S): UnregisterSntpEventManifestRollback = "wevtutil.exe" im "C:\Program Files\Sophos\Sophos Network Threat Protection\Sntp.man" Property(S): MsiInstallDrivers = 2.12{76F354A6-97D5-4872-9781-2F2642A4F18A}C:\Program Files\Sophos\Sophos Network Threat Protection\212Sophos Network Threat ProtectionSophos Limited Property(S): MsiRollbackInstall = 2.12{76F354A6-97D5-4872-9781-2F2642A4F18A}212Sophos Network Threat ProtectionSophos Limited Property(S): AddTrustedPublisher = C:\Program Files\Sophos\Sophos Network Threat Protection\SophosNTPLWF\SophosNTPLWF.cat Property(S): AddTrustedPublisherRollback = C:\Program Files\Sophos\Sophos Network Threat Protection\SophosNTPLWF\SophosNTPLWF.cat Property(S): RemoveTrustedPublisher = C:\Program Files\Sophos\Sophos Network Threat Protection\SophosNTPLWF\SophosNTPLWF.cat Property(S): InstallSophosNTPLWF = "C:\windows\system32\\netcfg.exe" /l "C:\Program Files\Sophos\Sophos Network Threat Protection\SophosNTPLWF\SophosNTPLWF.inf" /c s /i SOPHOS_SOPHOSNTPLWF Property(S): RollbackInstallSophosNTPLWF = "C:\windows\system32\\netcfg.exe" /u SOPHOS_SOPHOSNTPLWF Property(S): ExecSecureObjects_64 = ********** Property(S): ExecServiceConfig = SchedServiceConfig€SntpService€0€restart€restart€none€1€120€€ Property(S): RollbackServiceConfig = SchedServiceConfig Property(S): UnregisterManagementAdapterRollback = C:\Program Files\Sophos\Sophos Network Threat Protection\NTPAdapter.dll Property(S): RegisterManagementAdapter = C:\Program Files\Sophos\Sophos Network Threat Protection\NTPAdapter.dll Property(S): UnregisterHbtManagementAdapterRollback = C:\Program Files\Sophos\Sophos Network Threat Protection\HbtAdapter.dll Property(S): RegisterHbtManagementAdapter = C:\Program Files\Sophos\Sophos Network Threat Protection\HbtAdapter.dll Property(S): SetupSspUserAccount = NT SERVICE\sntpservice Property(S): SetupSspUserAccountRollback = NT SERVICE\sntpservice Property(S): AddSIPSSubmitterUserAccount = NT SERVICE\SntpService Property(S): AddSIPSSubmitterUserAccountRollback = NT SERVICE\SntpService Property(S): plugins = C:\Program Files\Sophos\Sophos Network Threat Protection\plugins\ Property(S): SnortDynModulesDir = C:\Program Files\Sophos\Sophos Network Threat Protection\IPS Dynamic Modules\ Property(S): SnortPreProcDir = C:\Program Files\Sophos\Sophos Network Threat Protection\IPS Dynamic Preprocessors\ Property(S): SnortConfDir = C:\Program Files\Sophos\Sophos Network Threat Protection\IPS Configuration\ Property(S): Sophos = C:\Program Files\Sophos\ Property(S): ProgramFiles64Folder = C:\Program Files\ Property(S): SophosAppData = C:\ProgramData\Sophos\ Property(S): CommonAppDataFolder = C:\ProgramData\ Property(S): SourceDir = C:\ProgramData\Sophos\AutoUpdate\Cache\decoded\ntp64\ Property(S): VersionNT = 601 Property(S): ALLUSERS = 1 Property(S): MSIRESTARTMANAGERCONTROL = Disable Property(S): ARPCOMMENTS = Network threat protection Property(S): ARPCONTACT = Sophos Technical Support Property(S): ARPHELPLINK = http://www.sophos.com/support/ Property(S): ARPNOMODIFY = 1 Property(S): ARPNOREPAIR = 1 Property(S): ARPPRODUCTICON = shield.ico Property(S): ARPURLINFOABOUT = http://www.sophos.com/ Property(S): ARPURLUPDATEINFO = http://www.sophos.com/support/updates Property(S): Manufacturer = Sophos Limited Property(S): ProductCode = {4B1F9009-CD85-43C0-BCBD-D491908D5A52} Property(S): ProductLanguage = 1033 Property(S): ProductName = Sophos Network Threat Protection Property(S): ProductVersion = 1.9.2373.0 Property(S): RegisterWithAutoUpdate = {8087796B-2289-4897-98A5-58FF23DAAFD0};ntp64 Property(S): SecureCustomProperties = WIX_DOWNGRADE_DETECTED;WIX_UPGRADE_DETECTED Property(S): MsiHiddenProperties = ExecSecureObjects_64;ExecSecureObjectsRollback_64 Property(S): INSTALLDIR.4D96E9F9_7E7B_4556_8D25_ABEE814FE4E0 = C:\ Property(S): SystemFolder_x86_VC.194841A2_D0F2_3B96_9F71_05BA91BEA0FA = C:\windows\SysWOW64\ Property(S): SystemFolder = C:\windows\SysWOW64\ Property(S): DirectoryTable100_x86.194841A2_D0F2_3B96_9F71_05BA91BEA0FA = DirectoryTable Property(S): System64Folder_amd64_VC.05F0B5F5_44A8_3793_976B_A4F17AECF92C = C:\windows\system32\ Property(S): System64Folder = C:\windows\system32\ Property(S): DirectoryTable100_amd64.05F0B5F5_44A8_3793_976B_A4F17AECF92C = DirectoryTable Property(S): MsiLogFileLocation = C:\windows\TEMP\Sophos Network Threat Protection Install Log 20200721 220331.txt Property(S): PackageCode = {33601027-BB79-4C6F-B891-2D4A958AED7F} Property(S): ProductState = -1 Property(S): PackagecodeChanging = 1 Property(S): REBOOT = ReallySuppress Property(S): INSTALLINGVERSION = 1.9.2373.0 Property(S): ARPSYSTEMCOMPONENT = 1 Property(S): CURRENTDIRECTORY = C:\windows\system32 Property(S): CLIENTUILEVEL = 3 Property(S): MSICLIENTUSESEXTERNALUI = 1 Property(S): CLIENTPROCESSID = 6504 Property(S): VersionDatabase = 405 Property(S): VersionMsi = 5.00 Property(S): WindowsBuild = 7601 Property(S): ServicePackLevel = 1 Property(S): ServicePackLevelMinor = 0 Property(S): MsiNTProductType = 1 Property(S): WindowsFolder = C:\windows\ Property(S): WindowsVolume = C:\ Property(S): RemoteAdminTS = 1 Property(S): TempFolder = C:\windows\TEMP\ Property(S): ProgramFilesFolder = C:\Program Files (x86)\ Property(S): CommonFilesFolder = C:\Program Files (x86)\Common Files\ Property(S): CommonFiles64Folder = C:\Program Files\Common Files\ Property(S): AppDataFolder = C:\windows\system32\config\systemprofile\AppData\Roaming\ Property(S): FavoritesFolder = C:\windows\system32\config\systemprofile\Favorites\ Property(S): NetHoodFolder = C:\windows\system32\config\systemprofile\AppData\Roaming\Microsoft\Windows\Network Shortcuts\ Property(S): PersonalFolder = C:\windows\system32\config\systemprofile\Documents\ Property(S): PrintHoodFolder = C:\windows\system32\config\systemprofile\AppData\Roaming\Microsoft\Windows\Printer Shortcuts\ Property(S): RecentFolder = C:\windows\system32\config\systemprofile\AppData\Roaming\Microsoft\Windows\Recent\ Property(S): SendToFolder = C:\windows\system32\config\systemprofile\AppData\Roaming\Microsoft\Windows\SendTo\ Property(S): TemplateFolder = C:\ProgramData\Microsoft\Windows\Templates\ Property(S): LocalAppDataFolder = C:\windows\system32\config\systemprofile\AppData\Local\ Property(S): MyPicturesFolder = C:\windows\system32\config\systemprofile\Pictures\ Property(S): AdminToolsFolder = C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Administrative Tools\ Property(S): StartupFolder = C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\ Property(S): ProgramMenuFolder = C:\ProgramData\Microsoft\Windows\Start Menu\Programs\ Property(S): StartMenuFolder = C:\ProgramData\Microsoft\Windows\Start Menu\ Property(S): DesktopFolder = C:\Users\Public\Desktop\ Property(S): FontsFolder = C:\windows\Fonts\ Property(S): GPTSupport = 1 Property(S): OLEAdvtSupport = 1 Property(S): ShellAdvtSupport = 1 Property(S): MsiAMD64 = 6 Property(S): Msix64 = 6 Property(S): Intel = 6 Property(S): PhysicalMemory = 3983 Property(S): VirtualMemory = 5149 Property(S): AdminUser = 1 Property(S): MsiTrueAdminUser = 1 Property(S): LogonUser = SYSTEM Property(S): UserSID = S-1-5-18 Property(S): UserLanguageID = 1033 Property(S): ComputerName = K17WSHOP-PC Property(S): SystemLanguageID = 1033 Property(S): ScreenX = 1024 Property(S): ScreenY = 768 Property(S): CaptionHeight = 22 Property(S): BorderTop = 1 Property(S): BorderSide = 1 Property(S): TextHeight = 16 Property(S): TextInternalLeading = 3 Property(S): ColorBits = 32 Property(S): TTCSupport = 1 Property(S): Time = 22:07:59 Property(S): Date = 7/21/2020 Property(S): MsiNetAssemblySupport = 4.0.30319.36415 Property(S): MsiWin32AssemblySupport = 6.1.7601.17514 Property(S): RedirectedDllSupport = 2 Property(S): MsiRunningElevated = 1 Property(S): Privileged = 1 Property(S): USERNAME = Binzagr Co. Property(S): COMPANYNAME = Binzagr Co. Property(S): DATABASE = C:\windows\Installer\6406dff.msi Property(S): OriginalDatabase = C:\ProgramData\Sophos\AutoUpdate\Cache\decoded\ntp64\Sophos Network Threat Protection.msi Property(S): UILevel = 2 Property(S): ACTION = INSTALL Property(S): ROOTDRIVE = C:\ Property(S): CostingComplete = 1 Property(S): OutOfDiskSpace = 0 Property(S): OutOfNoRbDiskSpace = 0 Property(S): PrimaryVolumeSpaceAvailable = 0 Property(S): PrimaryVolumeSpaceRequired = 0 Property(S): PrimaryVolumeSpaceRemaining = 0 Property(S): INSTALLLEVEL = 1 Property(S): SOURCEDIR = C:\ProgramData\Sophos\AutoUpdate\Cache\decoded\ntp64\ Property(S): SourcedirProduct = {4B1F9009-CD85-43C0-BCBD-D491908D5A52} Property(S): ProductToBeRegistered = 1 MSI (s) (80:B0) [22:07:59:942]: Note: 1: 1708 MSI (s) (80:B0) [22:07:59:942]: Product: Sophos Network Threat Protection -- Installation failed. MSI (s) (80:B0) [22:07:59:942]: Windows Installer installed the product. Product Name: Sophos Network Threat Protection. Product Version: 1.9.2373.0. Product Language: 1033. Manufacturer: Sophos Limited. Installation success or error status: 1603. MSI (s) (80:B0) [22:07:59:942]: Deferring clean up of packages/files, if any exist MSI (s) (80:B0) [22:07:59:942]: MainEngineThread is returning 1603 MSI (s) (80:20) [22:07:59:942]: No System Restore sequence number for this installation. === Logging stopped: 7/21/2020 22:07:59 === MSI (s) (80:20) [22:07:59:942]: User policy value 'DisableRollback' is 0 MSI (s) (80:20) [22:07:59:942]: Machine policy value 'DisableRollback' is 0 MSI (s) (80:20) [22:07:59:942]: Incrementing counter to disable shutdown. Counter after increment: 0 MSI (s) (80:20) [22:07:59:942]: Note: 1: 1402 2: HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Installer\Rollback\Scripts 3: 2 MSI (s) (80:20) [22:07:59:942]: Note: 1: 1402 2: HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Installer\Rollback\Scripts 3: 2 MSI (s) (80:20) [22:07:59:942]: Decrementing counter to disable shutdown. If counter >= 0, shutdown will be denied. Counter after decrement: -1 MSI (s) (80:20) [22:07:59:942]: Restoring environment variables MSI (s) (80:20) [22:07:59:942]: Destroying RemoteAPI object. MSI (s) (80:F4) [22:07:59:942]: Custom Action Manager thread ending. MSI (c) (68:C0) [22:07:59:942]: Decrementing counter to disable shutdown. If counter >= 0, shutdown will be denied. Counter after decrement: -1 MSI (c) (68:C0) [22:07:59:942]: MainEngineThread is returning 1603 === Verbose logging stopped: 7/21/2020 22:07:59 === setup::MsiInstaller::installOrUpgrade: Install/upgrade returned 1603 `anonymous-namespace'::setResult: installation failed setup::TamperProtectionControl::enable: Registered tamper protection integrity.dat for NTP setup::TamperProtectionControl::enable: Enabled tamper protection for NTP ProductSetup::~ProductSetup: End product setup