AFAIK, the only way to catch this thing would be by live debugging.
Not real practical to do on the online forums.

Maybe check the installation history to see what was installed on 23 Nov 2014?