// I've done some investigation using Sysinternals Process Monitor and found out the mshta.exe started at 00:27:11, in my case. By checking the Task Scheduler there was one application set to trigger at hh:27:ss, which might be the caller c:\users...\appdata\local{c112f74e-e5ba-9bf6-8822-be1eac4a4286}\uninstall.exe
I`ve deleted this scheduled task and the uninstall.exe, and so far it looks like the problem is gone //