reg delete "HKCU\Software\Sysinternals\Process Monitor" /f
reg add "HKCU\Software\Sysinternals\Process Monitor" /v "FilterRules" /t REG_BINARY /d 0102000000759c00000000000001180000006d007300690065007800650063002e0065007800650000000000000000000000829c000000000000004600000043003a005c00570069006e0064006f00770073005c00730079007300740065006d00330032005c006d007300690065007800650063002e0065007800650020002f00560000000000000000000000 /f
reg add "HKCU\Software\Sysinternals\Process Monitor" /v "ColumnCount" /t REG_DWORD /d 3 /f
reg add "HKCU\Software\Sysinternals\Process Monitor" /v "ColumnMap" /t REG_BINARY /d 749c0000779c0000829c0000829c0000829c0000829c0000829c0000829c00000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 /f
reg add "HKCU\Software\Sysinternals\Process Monitor" /v "Columns" /t REG_BINARY /d 82009600d7019001d70164006400000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 /f
reg add "HKCU\Software\Sysinternals\Process Monitor" /v "EulaAccepted" /t REG_DWORD /d 1 /f

Procmon.exeI have already installed custom settings for msiexec detection:

msiexec.exe is running I need to wait 10 seconds or something..Now I can see what is going on:

No comments:
Post a Comment