MD5: 78dda8eb799e3180d3fefa2ff97ec639
SHA1: 16881982874cd30cbdc68e803d3563d1f8fe72a1
SHA256: 8d379d2c61a82640c383e01d32ce16235ffa21f0abf96d660caf72d8250cc284
SSDeep: 98304:62C02ywEhFzUufD/3eQ9y6vhPr2YQzzABqLSmptfwY2smYMKEecVPohAkZsRQV4Q:whywEbr/uQp2YQfA27YPCAkZveLC
Size: 9444308 bytes
File type: EXE
Platform: WIN32
Entropy: Not Packed
PEID: UPolyXv05_v6
Company: LLC Pentagon
Created at: 2009-12-06 00:50:52
Analyzed on: Windows7 SP1 32-bit

Summary:

Trojan-Downloader. Trojan program, which downloads files from the Internet without user's notice and executes them.

Payload

Process activity

The Trojan creates the following process(es):

setup.exe:2764
files.dat:3800

The Trojan injects its code into the following process(es):

%original file name%.exe:1524

Mutexes

The following mutexes were created/opened:
No objects were found.

File activity

The process setup.exe:2764 makes changes in the file system.
The Trojan creates and/or writes to the following file(s):

C:\Users\"%CurrentUserName%"\AppData\Local\Temp\nss6B31.tmp\files\files.dat (1089 bytes)
C:\Windows\System32\vcruntime140.dll (867 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\nss6B31.tmp\files\setup16.exe (703 bytes)
C:\Windows\System32\msvcp140.dll (560 bytes)

The Trojan deletes the following file(s):

C:\Users\"%CurrentUserName%"\AppData\Local\Temp\nss6B31.tmp\files\files.dat (0 bytes)

The process files.dat:3800 makes changes in the file system.
The Trojan creates and/or writes to the following file(s):

C:\Users\"%CurrentUserName%"\AppData\Local\Temp\nss6B31.tmp\files\x86\msvcr100.dll (8468 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\nss6B31.tmp\files\x64\msvcr100.dll (9120 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\nss6B31.tmp\files\x64\cleanospp.exe (19 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\nss6B31.tmp\files\x86\cleanospp.exe (17 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\nss6B31.tmp\files\Uninstall.xml (59 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\nss6B31.tmp\files\Configure.xml (366 bytes)

The process %original file name%.exe:1524 makes changes in the file system.
The Trojan creates and/or writes to the following file(s):

C:\Users\"%CurrentUserName%"\AppData\Local\Temp\nss6B31.tmp\DOq7i5Iiwc (158 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\nss6B31.tmp\B (149900 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\8D93UTC3\launch_reb[1].htm (158 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\nss6B31.tmp\inetc.dll (44 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\nss6B31.tmp\System.dll (23 bytes)

The Trojan deletes the following file(s):

C:\Users\"%CurrentUserName%"\AppData\Local\Temp\nss6B31.tmp (0 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\nsy6B02.tmp (0 bytes)

Registry activity

The process %original file name%.exe:1524 makes changes in the system registry.
The Trojan creates and/or sets the following values in system registry:

[HKLM\SOFTWARE\Microsoft\Tracing\78dda8eb799e3180d3fefa2ff97ec639_RASMANCS]
"FileTracingMask" = "4294901760"
"MaxFileSize" = "1048576"

[HKLM\SOFTWARE\Microsoft\Tracing\78dda8eb799e3180d3fefa2ff97ec639_RASAPI32]
"MaxFileSize" = "1048576"

[HKLM\SOFTWARE\Microsoft\Tracing\78dda8eb799e3180d3fefa2ff97ec639_RASMANCS]
"ConsoleTracingMask" = "4294901760"
"FileDirectory" = "%windir%\tracing"

[HKLM\SOFTWARE\Microsoft\Tracing\78dda8eb799e3180d3fefa2ff97ec639_RASAPI32]
"FileDirectory" = "%windir%\tracing"

[HKLM\SOFTWARE\Microsoft\Tracing\78dda8eb799e3180d3fefa2ff97ec639_RASMANCS]
"EnableConsoleTracing" = "0"

[HKLM\SOFTWARE\Microsoft\Tracing\78dda8eb799e3180d3fefa2ff97ec639_RASAPI32]
"ConsoleTracingMask" = "4294901760"
"EnableFileTracing" = "0"
"EnableConsoleTracing" = "0"
"FileTracingMask" = "4294901760"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"AutoDetect" = "1"
"UNCAsIntranet" = "0"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Connections]
"SavedLegacySettings" = "46 00 00 00 3E 00 00 00 09 00 00 00 00 00 00 00"

[HKLM\SOFTWARE\Microsoft\Tracing\78dda8eb799e3180d3fefa2ff97ec639_RASMANCS]
"EnableFileTracing" = "0"

Proxy settings are disabled:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings]
"ProxyEnable" = "0"

The Trojan deletes the following value(s) in system registry:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"ProxyBypass"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"ProxyBypass"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings]
"ProxyOverride"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"IntranetName"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"IntranetName"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings]
"ProxyServer"
"AutoConfigURL"

Dropped PE files

HOSTS file anomalies

No changes have been detected.

Rootkit activity

No anomalies have been detected.

Propagation

A worm can spread via removable drives. It writes its executable and creates "autorun.inf" scripts on all removable drives. The autorun script will execute the Trojan's file once a user opens a drive's folder in Windows Explorer.

VersionInfo

No information is available.

PE Sections

Dropped from:

Downloaded by:

Similar by SSDeep:

Similar by Lavasoft Polymorphic Checker:

Total found: 1
2a941efd9af64226bc890985a6122550

URLs

URL	IP
hxxp://dna4mm5c1mahl.cloudfront.net/launch_reb.php?p=sevenzip&tid=13396291&pid=3038&n=TWljcm9zb2Z0IFRvb2xraXQgQ29sbGVjdGlvbiBQYWNrIEZlYnJ1YXJ5IDIwMTc=&b_typ=pe
hxxp://get.ercationiv.club/launch_reb.php?p=sevenzip&tid=13396291&pid=3038&n=TWljcm9zb2Z0IFRvb2xraXQgQ29sbGVjdGlvbiBQYWNrIEZlYnJ1YXJ5IDIwMTc=&b_typ=pe	54.230.44.231

IDS verdicts (Suricata alerts: Emerging Threats ET ruleset)

ET POLICY User-Agent (NSIS_Inetc (Mozilla)) - Sometimes used by hostile installers

Traffic

GET /launch_reb.php?p=sevenzip&tid=13396291&pid=3038&n=TWljcm9zb2Z0IFRvb2xraXQgQ29sbGVjdGlvbiBQYWNrIEZlYnJ1YXJ5IDIwMTc=&b_typ=pe HTTP/1.1

User-Agent: NSIS_Inetc (Mozilla)

Host: get.ercationiv.club

Connection: Keep-Alive

Cache-Control: no-cache

HTTP/1.1 200 OK

Content-Type: text/html; charset=UTF-8

Content-Length: 158

Connection: keep-alive

Date: Sun, 28 May 2017 21:11:36 GMT

Server: Apache/2.2.15 (CentOS)

X-Powered-By: PHP/5.3.3

X-Cache: Miss from cloudfront

Via: 1.1 d0c574ed517101bf0c21ed5df9b18342.cloudfront.net (CloudFront)

X-Amz-Cf-Id: K8tXWX3g-fKq4ICeCBSNEFujyF8cRDwZpXNdwo-kwiMl7h68gNzmjQ==
s=cheat..u=hXXp://gold.bellverse.bid/stub_maker.php?program=sevenzip&t
id=13396291&pid=3038&b_typ=pe&reb=1&name=Microsoft Toolkit Collection 
Pack February 2017HTTP/1.1 200 OK..Content-Type: text/html; charset=UT
F-8..Content-Length: 158..Connection: keep-alive..Date: Sun, 28 May 20
17 21:11:36 GMT..Server: Apache/2.2.15 (CentOS)..X-Powered-By: PHP/5.3
.3..X-Cache: Miss from cloudfront..Via: 1.1 d0c574ed517101bf0c21ed5df9
b18342.cloudfront.net (CloudFront)..X-Amz-Cf-Id: K8tXWX3g-fKq4ICeCBSNE
FujyF8cRDwZpXNdwo-kwiMl7h68gNzmjQ==..s=cheat..u=hXXp://gold.bellverse.
bid/stub_maker.php?program=sevenzip&tid=13396291&pid=3038&b_typ=pe&reb
=1&name=Microsoft Toolkit Collection Pack February 2017..

The Trojan connects to the servers at the folowing location(s):

.text

`.rdata

@.data

.ndata

.rsrc

uDSSh

.DEFAULT\Control Panel\International

Software\Microsoft\Windows\CurrentVersion

GetWindowsDirectoryA

KERNEL32.dll

ExitWindowsEx

USER32.dll

GDI32.dll

SHFileOperationA

ShellExecuteA

SHELL32.dll

RegEnumKeyA

RegCreateKeyExA

RegCloseKey

RegDeleteKeyA

RegOpenKeyExA

ADVAPI32.dll

COMCTL32.dll

ole32.dll

VERSION.dll

verifying installer: %d%%

hXXp://nsis.sf.net/NSIS_Error

... %d%%

~nsu.tmp

%u.%u%s%s

RegDeleteKeyExA

%s=%s

*?|<>/":

C:\Users\"%CurrentUserName%"\AppData\Local\Temp\nss6B31.tmp\setup.exe

C:\Users\"%CurrentUserName%"\AppData\Local\Temp\nss6B31.tmp\B->C:\Users\"%CurrentUserName%"\AppData\Local\Temp\nss6B31.tmp\setup.exe

C:\Users\"%CurrentUserName%"\AppData\Local\Temp\nss6B31.tmp\B

etc.dll

version="1.0.0.0"

name="CompanyName.ProductName.YourApp"

name="Microsoft.Windows.Common-Controls"

version="6.0.0.0"

publicKeyToken="6595b64144ccf1df"

<requestedExecutionLevel

Thawte Certification1

hXXp://ocsp.thawte.com0

.hXXp://crl.thawte.com/ThawteTimestampingCA.crl0

hXXp://ts-ocsp.ws.symantec.com07

 hXXp://ts-aia.ws.symantec.com/tss-ca-g2.cer0<

 hXXp://ts-crl.ws.symantec.com/tss-ca-g2.crl0(

u.Uj@

MSVCRT.dll

HttpSendRequestA

HttpSendRequestExA

HttpQueryInfoA

FtpCreateDirectoryA

FtpOpenFileA

HttpOpenRequestA

HttpAddRequestHeadersA

HttpEndRequestA

InternetCrackUrlA

WININET.dll

inetc.dll

Open URL Error

URL Parts Error

FtpCreateDir failed (550)

Error FTP path (550)

Downloading %s

%dkB (%d%%) of %dkB @ %d.
dkB/s

(%d %s%s remaining)

REST %d

SIZE %s

Content-Length: %d

Content-Type: application/x-www-form-urlencoded

Authorization: basic %s

Proxy-authorization: basic %s

%s:%s

FtpCommandA

wininet.dll

%u MB

%u kB

%u bytes

%d:d:d

%s - %s

(Err=%d)

NSIS_Inetc (Mozilla)

Filename: %s

/password

Uploading %s

9!9-9B9}9

.reloc

System.dll

callback%d

@.reloc

C:\Users\"%CurrentUserName%"\AppData\Local\Temp\nss6B31.tmp

nss6B31.tmp

s\"%CurrentUserName%"\AppData\Local\Temp\nss6B31.tmp\setup.exe

\"%CurrentUserName%"\AppData\Local\Temp\nss6B31.tmp\DOq7i5Iiwc

old.bellverse.bid/stub_maker.php?program=sevenzip&tid=13396291&pid=3038&b_typ=pe&reb=1&name=Microsoft Toolkit Collection Pack February 2017

c:\%original file name%.exe

%original file name%.exe

ers\"%CurrentUserName%"\AppData\Local\Temp\nsy6B02.tmp

C:\Users\"%CurrentUserName%"\AppData\Local\Temp\

201705282111

hXXp://gold.bellverse.bid/stub_maker.php?program=sevenzip&tid=13396291&pid=3038&b_typ=pe&reb=1&name=Microsoft Toolkit Collection Pack February 2017

<?xml version="1.0" encoding="UTF-8" standalone="yes"?><assembly xmlns="urn:schemas-microsoft-com:asm.v1" manifestVersion="1.0"><assemblyIdentity version="1.0.0.0" processorArchitecture="X86" name="Nullsoft.NSIS.exehead" type="win32"/><description>Nullsoft Install System v2.46</description><trustInfo xmlns="urn:schemas-microsoft-com:asm.v3"><security><requestedPrivileges><requestedExecutionLevel level="requireAdministrator" uiAccess="false"/></requestedPrivileges></security></trustInfo><compatibility xmlns="urn:schemas-microsoft-com:compatibility.v1"><application><supportedOS Id="{35138b9a-5d96-4fbd-8e2d-a2440225f93a}"/><supportedOS Id="{e2011457-1546-43c5-a5fe-008deee3d3f0}"/></application></compatibility></assembly>

JOInstallLite (Ratiborus, MSFree Inc.

%original file name%.exe_1524_rwx_10004000_00001000:

callback%d

setup.exe_2764:

.code

`.text

`.rdata

@.data

.rsrc

@.modplug

f9.tD

=CMSG

=CMSGu

<.PATT

t)SSh

j.Xf9D$

Yj.Zj\

uuSSSh

.PQUS

.PQRW

B8%XJ

|$49\$8}

operand of unlimited repeat could match the empty string

POSIX named classes are supported only within a class

erroffset passed as NULL

POSIX collating elements are not supported

this version of PCRE is compiled without UTF support

PCRE does not support \L, \l, \N{name}, \U, or \u

support for \P, \p, and \X has not been compiled

this version of PCRE is not compiled with Unicode property support

\N is not supported in a class

Error text not found (please report)

   jump error in pcre match: label %d non-existent

ws2_32.dll

F0F001X

WAV Header Info: NbChannels %d, BitsPerSamples: %d, NbBlockAlign %d

WAV Header Info: SamplePerSec %d, nAvgBytesPerSec: %d, WavSize %d

1.6.19

COMCTL32.DLL

uxtheme.dll

dwmapi.dll

%d:%d:%d:%d

r@Kernel32.dll

InitOnceExecuteOnce

inflate 1.2.8 Copyright 1995-2013 Mark Adler

1.2.8

%d&&'

libpng version 1.6.19 - November 12, 2015 Copyright (c) 1998-2015 Glenn Randers-Pehrson Copyright (c) 1996-1997 Andreas Dilger Copyright (c) 1995-1996 Guy Eric Schalnat, Group 42, Inc.

libpng version 1.6.19 - November 12, 2015

unsupported zlib version

123456789

libpng does not support gamma background rgb_to_gray

Only compression windows <= 32k supported by PNG

Only compression windows >= 256 supported by PNG

Only compression method 8 is supported by PNG

PNG_TRANSFORM_STRIP_FILLER: BEFORE AFTER not supported

keyword truncated

keyword "@1": bad character '0x@2'

00003333

bad keyword

Too many color components: %d, max %d

Unsupported color conversion request

Bogus DAC index %d

Bogus DAC value 0x%x

Bogus DHT index %d

Bogus DQT index %d

Empty JPEG image (DNL not supported)

Maximum supported image dimension is %u pixels

Cannot transcode due to multiple use of quantization table %d

Arithmetic table 0xx was not defined

Backing store not supported

Huffman table 0xx was not defined

Quantization table 0xx was not defined

Not a JPEG file: starts with 0xx 0xx

Insufficient memory (case %d)

Cannot quantize more than %d color components

Cannot quantize to fewer than %d colors

Cannot quantize to more than %d colors

Unsupported JPEG process: SOF type 0xx

Failed to create temporary file %s

Unsupported marker type 0xx

Adobe APP14 marker: version %d, flags 0xx 0xx, transform %d

Unknown APP0 marker (not JFIF), length %u

Unknown APP14 marker (not Adobe), length %u

Define Arithmetic Table 0xx: 0xx

Define Huffman Table 0xx

Define Quantization Table %d precision %d

Define Restart Interval %u

Freed EMS handle %u

Obtained EMS handle %u

= = = = = = = =

JFIF APP0 marker: version %d.d, density %dx%d %d

Warning: thumbnail image size does not match data length %u

JFIF extension marker: type 0xx, length %u

with %d x %d thumbnail image

Miscellaneous marker 0xx, length %u

Unexpected marker 0xx

%4u %4u %4u %4u %4u %4u %4u %4u

Quantizing to %d = %d*%d*%d colors

Quantizing to %d colors

Selected %d colors for quantization

At marker 0xx, recovery action %d

RST%d

Smoothing not supported with nonstandard sampling ratios

Start Of Frame 0xx: width=%u, height=%u, components=%d

Component %d: %dhx%dv q=%d

Start Of Scan: %d components

Component %d: dc=%d ac=%d

Ss=%d, Se=%d, Ah=%d, Al=%d

Closed temporary file %s

Opened temporary file %s

JFIF extension marker: JPEG-compressed thumbnail image, length %u

JFIF extension marker: palette thumbnail image, length %u

JFIF extension marker: RGB thumbnail image, length %u

Unrecognized component IDs %d %d %d, assuming YCbCr

Freed XMS handle %u

Obtained XMS handle %u

Unknown Adobe color transform code %d

Inconsistent progression sequence for component %d coefficient %d

Corrupt JPEG data: %u extraneous bytes before marker 0xx

Warning: unknown JFIF revision number %d.d

Corrupt JPEG data: found marker 0xx instead of RST%d

Bogus message code %d

Invalid component ID %d in SOS

DCT scaled block size %dx%d not supported

Component index %d: mismatching sampling ratio %d:%d, %d:%d, %c

Wrong JPEG library version: library is %d, caller expects %d

Invalid memory pool code %d

Unsupported JPEG data precision %d

Invalid progressive parameters Ss=%d Se=%d Ah=%d Al=%d

Invalid progressive parameters at scan script entry %d

Invalid scan script at entry %d

Improper call to JPEG library in state %d

JPEG parameter struct mismatch: library thinks size is %u, caller expects %u

Buffer passed to JPEG library is too small

%ld%c

deflate 1.2.8 Copyright 1995-2013 Jean-loup Gailly and Mark Adler

:Ty.gU

.Ve&`$

.text

.sxdata

<x.uW

OLEAUT32.dll

USER32.dll

MSVCRT.dll

KERNEL32.dll

-p{Password}: set Password

Data Error in encrypted file. Wrong password?

CRC Failed in encrypted file. Wrong password?

Unsupported Method

Can not open encrypted archive. Wrong password?

Enter password (will not be echoed):

St.iC

wB.Ec,

}Xw"0.WZ

7-Uj}

n Q%u

9G%XN

Mq%dzw

dE.Jlc

QiZI.zD|

IM%Cy

E%F'%

.QX:=y

n0s.ST/k

UM.dr

MA8%U

5%UfW

P.xYVxD

%s"EK

-%.ii

#%D={

y .wd

0Q.Mqh

eL.uB

CX2%S

.F%Ub

pi.wMkh:

K~C.Ys

9.KLj>y

.-,%d

y>U-U[%U

y.afM

(.jxef

*%Sti

dTcp{

L>hl%Ut^

I_fUUÝ

%cy*U

%u:`Q

.hlgw9*Uv

%FXX>

|.Uuh

PO6(%D

a.tW/

<%xW#X

-4}[i

%fGLw

/.gHT

;Þm

.gfids

@.tls

@.reloc

SSSSh<3a

Ph %c

u.hX1c

t.Sj,3

QSSSSSSSh

} j.Xf9

j.Xf9D_

|>j.Yf9

j.Yf9

~xj.Xf9D_

j.Xf9

j%Xf9Dr

j.Zf9TK

SShlbn

SSh|dn

Tt.jh^;

j.Yf;

_tcPVj@

.PjRW

%$%,%4%<%

S%T%U%V%W%X%Y%Z%[%\%]%^%_%`%a%

b%c%d%e%f%g%h%i%j%k%l%

IMM32.dll

SHELL32.dll

VERSION.dll

SHLWAPI.dll

WININET.dll

CRYPT32.dll

Secur32.dll

msi.dll

ncrypt.dll

Normaliz.dll

WINHTTP.dll

XmlLite.dll

POWRPROF.dll

urlmon.dll

address family not supported

broken pipe

function not supported

inappropriate io control operation

not supported

operation canceled

operation in progress

operation not permitted

operation not supported

operation would block

protocol not supported

operator

operator ""

MaxPolicyElementKey

pExecutionResource

?#%X.y

%S#[k

UxTheme.dll

credui.dll

osppc.dll

osppcext.dll

bond.SerializableExceptionBase

bond.Void

bond.GUID

bond.Variant

bond.TypeDef

bond.Metadata

bond.FieldDef

bond.StructDef

bond.SchemaDef

{02FD33DF-F746-4A10-93A0-2BC6273BC8E4}

HttpResponse

{645183D9-4036-4921-BEC2-F7BBF32129AB}

GroupKey

{8736922d-E8B2-47eb-8564-23E77E728CF3}

wzAddressSMTP

wzHashKey

wzSMTPAddress

wzKey

wzSMTPAddressCache

wzUniqueKey

operationType

WINDOWS_UI_XAML_ETW_PROVIDER

Microsoft_Windows_XAML

{531A35AB-63CE-4BCF-AA98-F88C7A89E455}

ViewportWidth

ViewportHeight

GraphicsDriverSupportType

ViewportId

CompositorViewportId

ReportedQPC

ReportedVBlank

KeyIsType

guidProviderAcceleratorKeys

AcceleratorKeys

{d6dd4818-7123-4abb-ad96-b044c1387b49}

Microsoft.Office.Experiment.ABConfigs

Microsoft.Office.Experiment.SessionFlights

Mso::Telemetry::Rule::TriggerAndReportResults

Ansi string is not supported.

Office.System.Result

Mso::Telemetry::RuleManager::ReportHighImpactRules

%d.%d

Mso::Telemetry::TelemetryManager::InitTelemetry::<lambda_e6db91b17cae021585805c5ee32a3276>::operator ()

Mso::Telemetry::TelemetryManager::ShutdownTelemetry::<lambda_4ba328aae4936684eb439e25934b14c8>::operator ()

Invalid arguments in math operation

Comments are not supported here

Mso::Telemetry::ReportMissingField

Mso::Telemetry::UnaryOperator::HashValue

Mso::Telemetry::SimpleMathRule::DoOperation

()$^.* ?[]|\-{},:=!

Kernel32.dll

_FastMutexEvent

%d%dM

InvalidCDKey

InvalidOperation

NoSupportedCulture

SQLFailedToAllocateHandle

SQLAlreadyConnected

SQLFailedToSetAttribute

SQLFailedToRetrieveData

SQLFailedToExecuteStatement

SQLFailedToConnect

InvalidServiceOperation

WinHttpConnectFailed

WinHttpCloseFailed

WinHttpOpenFailed

WinHttpNoData

WinHttpReceiveResponseFailed

WinHttpSendRequestFailed

WinHttpOpenRequestFailed

WinHttpQueryHeadersFailed

OHttpReadTruncated

WinHttpDataTruncated

WinHttpReadDataFailed

WinHttpSetProxyOptionFailed

WinHttpSetCredentialsFailed

WinHttpStatusDenied

WinHttpSetOptionFailed

FailedToObtainFileURL

AuthSchemeNotSupported

WinHttpQueryAuthSchemesFailed

OperationCancelled

WinRTWLIDOperationFailed

MsoHttpNetworkError

WinHttpQueryDataAvailableFailed

MsoHttpNotFoundError

MsoHttpServerReachabilityError

PipelineInsufficientDiskSpace

HttpTransportError

FileTransportError

PipelineInsufficientWritePermission

PipelineErrorConnectToSource

BitsTransportError

CachedHttpTransportError

Microsoft.Office.License.LicenseChanged

Microsoft.Office.License.Initialized

Microsoft.Office.License.ExperimentSubscriptionUser

Microsoft.Office.User.UserId

Microsoft.Office.Lang.UILanguage

Office.Experimentation.ExpEndpointInfo

EndpointUrl

HttpStatus

Microsoft.Office.Experimentation.Resiliency.ABData

Microsoft.Office.Experimentation.DisableDynamicConfiguration

HttpRequestError

Office.Experimentation.RandomizationInfo

Office.Experimentation.RandomizationHashingError

Error_Reading_RegKey

RegKey_Not_URL

Unknown_RegKey_Value

RegKey_HTTP_Not_FFN

HrGetExecutingScenario

!"#$%&'()

!"#$%&'(

.ASex

!"#$%&'()* ,-./012

'()* ,-./0

&'()* ,-./

&'()* ,-./012345

3456789

!!!!2222||||

!"#$%&'()* ,-./0123456789:;<=

!!!!2222

%%%f||||

MSOINTL.DLL

VBE7.DLL

MSO.DLL

MSCONV97.DLL

PROTTPLN.DOC

MSOXEV.DLL

CENTURY.TTF

VBLR6.CHM

MSOHEV.DLL

PSS10R.CHM

PSS10O.CHM

CLVWINTL.DLL

IEAWSDC.DLL

PROTTPLV.PPT

CLVIEW.EXE

PROTTPLV.DOC

PROTTPLV.XLS

PROTTPLN.XLS

PROTTPLN.PPT

PRTF9.DLL

PTXT9.DLL

MSQRY32.EXE

OFFICE.ODF

msproof7.dll

msspell7.dll

MSOSTYLE.DLL

MSLID.DLL

EXCEL.EXE

SPDESIGN.EXE

MSACCESS.EXE

lync.exe

INTLDATE.DLL

WINPROJ.EXE

RICHED20.DLL

SAEXT.DLL

VPREVIEW.EXE

THEMES.INF

WINWORD.EXE

VISIO.EXE

MSPUB.EXE

FPCUTL.DLL

OUTLOOK.EXE

POWERPNT.EXE

LSTVIEWS.INI

RSWOP.ICM

ALRTINTL.DLL

SEQCHK10.DLL

ENVELOPR.DLL

STSLIST.DLL

NAVBARS.INI

ONINTL.DLL

CT_ROOTS.XML

MSYUBIN7.DLL

ACEINTL.DLL

MSO0127.ACL

BOLDSTRI.INF

OSETUP.DLL

ONENOTE.EXE

MSO.ACL

MSGR3SC.DLL

WWLIB.DLL

xlsrvintl.dll

WDBRKCHT.DLL

MSSTKO32.DLL

MSOEURO.DLL

MSTAG.TLB

ACCOLKI.DLL

MSORES.DLL

MSPTLS.DLL

MSO40UIRES.DLL

MSO99LRES.DLL

EXP_PDF.DLL

EXP_XPS.DLL

SETUP.CHM

Blog.dotx

GKExcel.dll

GKPowerPoint.dll

pkeyconfig-office.xrm-ms

MSOSYNC.EXE

LICLUA.EXE

pidgenx.dll

OSPPC.DLL

OSPPCEXT.DLL

MOR6INT.DLL

PUBWZINT.DLL

MAPIR.DLL

OMSINTL.DLL

Csi.dll

STINTL.DLL

GKWord.dll

MSOUC.EXE

OUTLLIBR.DLL

OUTLWVW.DLL

XLSLICER.DLL

GRINTL32.DLL

WWINTL.DLL

XLINTL32.DLL

FLTLDR.EXE

BCSProxy32.dll

OSFSHARED.DLL

OSFUI.DLL

PUB6INTL.DLL

OSF.DLL

SGRES.DLL

VISBRRES.DLL

PPINTL.DLL

VISINTL.DLL

VBEUIRES.DLL

MSBARCODE.DLL

VBEUI.DLL

VBEUIINTL.DLL

VBUI6.CHM

VBE7INTL.DLL

WEBSANDBOX.DLL

OSFINTL.DLL

OMICAUTINTL.DLL

MSOIDCLIL.DLL

msotelemetryintl.dll

IFDPINTL.DLL

OLMAPI32.DLL

SOCIALCONNECTOR.DLL

msotelemetry.dll

BRANDING.XML

TellMePowerPoint.nrr

TellMeVisio.nrr

TellMeWord.nrr

TellMeExcel.nrr

lyncDesktopResources.dll

TellMeRuntime.dll

ADAL.DLL

WXPNSE.DLL

TellMeOutlookMeetingReqRead.nrr

TellMeOutlookMeetingReqSend.nrr

TellMeOutlookMail.nrr

TellMeOutlookMailRead.nrr

TellMeOutlookAddr.nrr

TellMeOutlookAppt.nrr

TellMeOneNote.nrr

TellMeOutlook.nrr

Microsoft.Office.PolicyTips.dll

TellMeProject.nrr

MSSRINTL.DLL

PROTOCOLHANDLERINTL.DLL

msointl30.dll

TellMeOutlookTask.nrr

TellMeAccess.nrr

mstr2tsc.dll

PG_INDEX.XML

GROOVE.EXE

MSSOAP30.DLL

MSO.DLL.x86

OSPPSVC.EXE.x64

PKEYCONFIG.COMPANION.DLL.CLIENT

OSPPSVC.EXE.x86

msaccess.exe

vbe.dll_7.1

MSOHTMED.EXE.x86

mso16.x86.dll

LOBICLNT.DLL

OSPPOBJS.DLL.x86

OSPPOBJS.DLL.x64

RICHED20.DLL_0001

SAEXT.DLL_0001

MSSPELL.DLL

msqry32.exe

IEAWSDC.DLL.x86

MSPROOF6.DLL

MSOXEV.DLL.x86

century.ttf

powerpnt.exe

mspub.exe

outlook.exe

Lync.exe

excel.exe

INTLDATE.DLL_0001

winproj.exe

OneNote.exe

FPCUTL.DLL_SPD

winword.exe

CSI.DLL.x86

stintl.dll

GKPOWERPOINT.DLL

GKWORD.DLL

OSPPC.DLL.x86

GKEXCEL.DLL

wwlib.dll

LOBIPROX.DLL

TELLMERUNTIME.DLL

OMICAUTINTL.DLL_1033

LyncMUI.lyncdesktopres

WEBSB.DLL

WebDiscussFiles

AccessHelpFilesIntl_1033

AccessHelpFiles

InternationalSupportFiles_JPN

MsoExportPdf

MsoExportXps

TelemetryBond.WindowsVersion

WindowsVersion

TelemetryBond.OfficeAppVersion

TelemetryBond.RuleResult

TelemetryBond.RuleResultPayload

TelemetryBond.UploadMetadata

windowsVersion

invalid map<K, T> key

1.3.6.1.4.1.311.2.4.1

1.3.6.1.4.1.311.2.1.12

Comctl32.dll

InvokeMainViaCRT

ExitMainViaCRT

Microsoft.CRTProvider

Microsoft.Office.SessionIdProvider

Microsoft.Office.TelemetryEngine

F:\Office\Target\x86\ship\click2run\en-us\AdminBootstrapper.pdb

.text$di

.text$mn

.text$x

.text$yd

.idata$5

.CRT$XCA

.CRT$XCAA

.CRT$XCC

.CRT$XCL

.CRT$XCU

.CRT$XCZ

.CRT$XIA

.CRT$XIAA

.CRT$XIAC

.CRT$XIC

.CRT$XIZ

.CRT$XLA

.CRT$XLZ

.CRT$XPA

.CRT$XPB

.CRT$XPX

.CRT$XPXA

.CRT$XPZ

.CRT$XTA

.CRT$XTZ

.rdata

.rdata$T

.rdata$r

.rdata$sxdata

.rdata$zETW0

.rdata$zETW1

.rdata$zETW2

.rdata$zETW9

.rdata$zzzdbg

.rtc$IAA

.rtc$IZZ

.rtc$TAA

.rtc$TZZ

.xdata$x

.didat$2

.didat$3

.didat$4

.didat$6

.didat$7

.idata$2

.idata$3

.idata$4

.idata$6

.data

.data$r

.didat$5

.gfids$x

.gfids$y

.tls$

.tls$ZZZ

.rsrc$01

.rsrc$02

ShellExecuteExW

MsgWaitForMultipleObjectsEx

MsgWaitForMultipleObjects

UnhookWindowsHookEx

SetWindowsHookExW

CertFreeCertificateContext

WinHttpQueryDataAvailable

WinHttpReadData

WinHttpSetOption

WinHttpAddRequestHeaders

WinHttpQueryHeaders

WinHttpSendRequest

WinHttpWriteData

WinHttpReceiveResponse

WinHttpQueryOption

WinHttpQueryAuthSchemes

WinHttpCloseHandle

WinHttpSetCredentials

WinHttpSetStatusCallback

WinHttpSetTimeouts

WinHttpConnect

WinHttpOpenRequest

WinHttpGetProxyForUrl

WinHttpGetIEProxyConfigForCurrentUser

WinHttpGetDefaultProxyConfiguration

WinHttpOpen

ShellExecuteW

CertVerifyCertificateChainPolicy

CryptMsgGetParam

CryptMsgOpenToDecode

CryptMsgUpdate

WinHttpCrackUrl

InternetCrackUrlW

SLGetInstalledProductKeyIds

SLGetPKeyInformation

RegCreateKeyExW

RegCloseKey

RegDeleteKeyW

RegEnumKeyExW

RegQueryInfoKeyW

RegOpenKeyExW

RegNotifyChangeKeyValue

ADVAPI32.dll

GetCPInfoExW

GetProcessHeap

CreateIoCompletionPort

ole32.dll

WS2_32.dll

GDI32.dll

gdiplus.dll

GetCPInfo

WINTRUST.dll

Cabinet.dll

SETUPAPI.dll

IPHLPAPI.DLL

.?AVstl_critical_section_concrt@details@Concurrency@@

.?AVstl_condition_variable_concrt@details@Concurrency@@

.?AVunsupported_os@Concurrency@@

.?AVinvalid_scheduler_policy_key@Concurrency@@

.?AVinvalid_oversubscribe_operation@Concurrency@@

.?AVinvalid_operation@Concurrency@@

.?AUITopologyExecutionResource@Concurrency@@

.?AVExecutionResource@details@Concurrency@@

.?AUIExecutionResource@Concurrency@@

.?AUIExecutionContext@Concurrency@@

.?AVORegistryKey@@

.PA_W

.PAUIPowerManager@PowerManager@Mso@@

.?AU?$default_delete@VGZipEncodingHandler@Http@Mso@@@std@@

.P6G?AV?$TCntPtr@VIRequest@Http@Mso@@@Mso@@AAVRequestBroker@Http@1@@Z

.PAUIServerReachability@ServerReachability@Mso@@

.PAUIOfficeWebServiceApi@OfficeWebServiceApi@Mso@@

.?AV?$_Ref_count@VORegistryKey@@@std@@

.?AV?$_Ref_count@VSourceFailoverTransportRetry@@@std@@

.?AVSourceFailoverTransportRetry@@

.?AVTransportRetry@@

.?AV?$_Ref_count@VHttpTransport@C2R@@@std@@

.?AV?$_Ref_count@VBitsTransport@C2R@@@std@@

.?AV?$_Ref_count@VFileTransport@C2R@@@std@@

.?AVUrlOrPathSettingValidator@C2R@@

.?AVFileTransport@C2R@@

.?AV?$enable_shared_from_this@VTransport@@@std@@

.?AVTransport@@

.?AVBitsTransport@C2R@@

.?AV?$_Ref_count@VHttpLoadRangeAsyncResult@C2R@@@std@@

.?AVHttpTransport@C2R@@

.?AVHttpLoadRangeAsyncResult@C2R@@

.?AV?$_Ref_count@VOHttpTransport@C2R@@@std@@

.?AVOHttpTransport@C2R@@

.?AV?$_Func_impl@V<lambda_c7622a0c79ea572db0c5e55f05dc9731>@@V?$allocator@H@std@@_NPBVORegistryKey@@AAV?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@3@AAKAAV53@@std@@

.?AV?$_Func_base@_NPBVORegistryKey@@AAV?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@AAKAAV23@@std@@

.?AU_Crt_new_delete@std@@

.?AV?$_Func_impl@V<lambda_8fe4d44a5b4b8e1048c664da62c080b7>@@V?$allocator@H@std@@_NPBVORegistryKey@@AAV?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@3@AAKAAV53@@std@@

.qC*0

U.Ta*

_7.qO

AÏ/

Z%C>Ch

h8z.nl

!iTXtXML:com.adobe.xmp

" id="W5M0MpCehiHzreSzNTczkc9d"?> <x:xmpmeta xmlns:x="adobe:ns:meta/" x:xmptk="Adobe XMP Core 5.5-c021 79.154911, 2013/10/29-11:47:16 "> <rdf:RDF xmlns:rdf="hXXp://VVV.w3.org/1999/02/22-rdf-syntax-ns#"> <rdf:Description rdf:about="" xmlns:xmp="hXXp://ns.adobe.com/xap/1.0/" xmlns:xmpMM="hXXp://ns.adobe.com/xap/1.0/mm/" xmlns:stRef="hXXp://ns.adobe.com/xap/1.0/sType/ResourceRef#" xmp:CreatorTool="Adobe Photoshop CC (Windows)" xmpMM:InstanceID="xmp.iid:D8058835E1E211E39806C5D5F67A863B" xmpMM:DocumentID="xmp.did:D8058836E1E211E39806C5D5F67A863B"> <xmpMM:DerivedFrom stRef:instanceID="xmp.iid:D8058833E1E211E39806C5D5F67A863B" stRef:documentID="xmp.did:D8058834E1E211E39806C5D5F67A863B"/> </rdf:Description> </rdf:RDF> </x:xmpmeta> <?xpacket end="r"?>n

@y.rU

aL.cX

<,`<&%]\

;C~?K%C

;.ul\

9KÎ

&0.FU~

Mp.IB

.nX2bN`

j.WEDV

%.u(^7

.gp$_.rl

%cPZ,

X|.qh

MJ%dI

%U#N6M\

" id="W5M0MpCehiHzreSzNTczkc9d"?> <x:xmpmeta xmlns:x="adobe:ns:meta/" x:xmptk="Adobe XMP Core 5.5-c021 79.154911, 2013/10/29-11:47:16 "> <rdf:RDF xmlns:rdf="hXXp://VVV.w3.org/1999/02/22-rdf-syntax-ns#"> <rdf:Description rdf:about="" xmlns:xmp="hXXp://ns.adobe.com/xap/1.0/" xmlns:xmpMM="hXXp://ns.adobe.com/xap/1.0/mm/" xmlns:stRef="hXXp://ns.adobe.com/xap/1.0/sType/ResourceRef#" xmp:CreatorTool="Adobe Photoshop CC (Windows)" xmpMM:InstanceID="xmp.iid:A0BCA05BE12D11E3BC18FEA99E1DA578" xmpMM:DocumentID="xmp.did:A0BCA05CE12D11E3BC18FEA99E1DA578"> <xmpMM:DerivedFrom stRef:instanceID="xmp.iid:A0BCA059E12D11E3BC18FEA99E1DA578" stRef:documentID="xmp.did:A0BCA05AE12D11E3BC18FEA99E1DA578"/> </rdf:Description> </rdf:RDF> </x:xmpmeta> <?xpacket end="r"?>%

" id="W5M0MpCehiHzreSzNTczkc9d"?> <x:xmpmeta xmlns:x="adobe:ns:meta/" x:xmptk="Adobe XMP Core 5.5-c021 79.154911, 2013/10/29-11:47:16 "> <rdf:RDF xmlns:rdf="hXXp://VVV.w3.org/1999/02/22-rdf-syntax-ns#"> <rdf:Description rdf:about="" xmlns:xmp="hXXp://ns.adobe.com/xap/1.0/" xmlns:xmpMM="hXXp://ns.adobe.com/xap/1.0/mm/" xmlns:stRef="hXXp://ns.adobe.com/xap/1.0/sType/ResourceRef#" xmp:CreatorTool="Adobe Photoshop CC (Windows)" xmpMM:InstanceID="xmp.iid:B34A5F90E1E711E39F46AF289DCCEB78" xmpMM:DocumentID="xmp.did:B34A5F91E1E711E39F46AF289DCCEB78"> <xmpMM:DerivedFrom stRef:instanceID="xmp.iid:B34A5F8EE1E711E39F46AF289DCCEB78" stRef:documentID="xmp.did:B34A5F8FE1E711E39F46AF289DCCEB78"/> </rdf:Description> </rdf:RDF> </x:xmpmeta> <?xpacket end="r"?>

%Uj](

%U38mJo

" id="W5M0MpCehiHzreSzNTczkc9d"?> <x:xmpmeta xmlns:x="adobe:ns:meta/" x:xmptk="Adobe XMP Core 5.5-c021 79.155772, 2014/01/13-19:44:00 "> <rdf:RDF xmlns:rdf="hXXp://VVV.w3.org/1999/02/22-rdf-syntax-ns#"> <rdf:Description rdf:about="" xmlns:xmpMM="hXXp://ns.adobe.com/xap/1.0/mm/" xmlns:stRef="hXXp://ns.adobe.com/xap/1.0/sType/ResourceRef#" xmlns:xmp="hXXp://ns.adobe.com/xap/1.0/" xmpMM:DocumentID="xmp.did:23A257C5FD8311E384D2D471AF6AB4D4" xmpMM:InstanceID="xmp.iid:23A257C4FD8311E384D2D471AF6AB4D4" xmp:CreatorTool="Adobe Photoshop CC (Windows)"> <xmpMM:DerivedFrom stRef:instanceID="xmp.iid:B34A5F90E1E711E39F46AF289DCCEB78" stRef:documentID="xmp.did:B34A5F91E1E711E39F46AF289DCCEB78"/> </rdf:Description> </rdf:RDF> </x:xmpmeta> <?xpacket end="r"?>u

9%C_NN

" id="W5M0MpCehiHzreSzNTczkc9d"?> <x:xmpmeta xmlns:x="adobe:ns:meta/" x:xmptk="Adobe XMP Core 5.5-c021 79.154911, 2013/10/29-11:47:16 "> <rdf:RDF xmlns:rdf="hXXp://VVV.w3.org/1999/02/22-rdf-syntax-ns#"> <rdf:Description rdf:about="" xmlns:xmp="hXXp://ns.adobe.com/xap/1.0/" xmlns:xmpMM="hXXp://ns.adobe.com/xap/1.0/mm/" xmlns:stRef="hXXp://ns.adobe.com/xap/1.0/sType/ResourceRef#" xmp:CreatorTool="Adobe Photoshop CC (Windows)" xmpMM:InstanceID="xmp.iid:C87D1CE4E12D11E393F99EDC3E000F53" xmpMM:DocumentID="xmp.did:C87D1CE5E12D11E393F99EDC3E000F53"> <xmpMM:DerivedFrom stRef:instanceID="xmp.iid:C87D1CE2E12D11E393F99EDC3E000F53" stRef:documentID="xmp.did:C87D1CE3E12D11E393F99EDC3E000F53"/> </rdf:Description> </rdf:RDF> </x:xmpmeta> <?xpacket end="r"?>

<assemblyIdentity processorArchitecture="*" type="win32" name="Firefly" version="16.0.0.0" />

<assemblyIdentity type="win32" name="Microsoft.Windows.Common-Controls" version="6.0.1.0" publicKeyToken="6595b64144ccf1df"

<requestedExecutionLevel level="asInvoker" uiAccess="false"/>

<!--The ID below indicates application support for Windows 7 -->

<supportedOS Id="{35138b9a-5d96-4fbd-8e2d-a2440225f93a}"/>

<!--This Id value indicates the application supports Windows 8 functionality-->

<supportedOS Id="{4a2f28e3-53b9-4441-ba9c-d69d4a4a6e38}"/>

<!-- This Id value indicates the application supports Windows 8.1 functionality-->

<supportedOS Id="{1f676c76-80e1-4239-95bb-83d0f6d0da78}"/>

<!-- This Id value indicates the application supports Windows 10 functionality-->

<supportedOS Id="{8e0f7a12-bfb3-4fe8-b9a5-48fd50a15a9a}"/>

8#8,858>8

01x1

3%4x4

11x1

1 1'1.1~1

0%0u0

6%6.6;6`6

0"0(050<0

4!4&4=4]4

:";);0;7;=;

11u1

0 0'0.050

4%4,434{4

:!;';0;`;{;

8"8@8^8{8

7#8.8>8^8

383F3U3

<!<%<)<-<1<5<<<

1&1,11191

1%1,121\1

0&01080{0

5(6-6}6

>)>/>5><>

6%6S6

;#;.;7;=;

89p9

4F4u4

2!2D2h2

2-2H2}2

5%6s6

2$2C2R2]2g2u2

6d6C6R6a6p6

= =$=(=,=0=4=8=<=@=

8 8$8(8,808

: :$:(:,:0:

5 5$5(5,50545

< <$<(<,<0<4<8<

: :$:(:,:0:4:8:<:

1 1$1(1,1014181<1

; ;$;(;,;0;4;

> >$>(>,>0>4>8><>@>

1 1$1(1,1

; ;$;(;,;0;4;8;<;@;

3 34585<5

3 3$3(3,30343

1054585<5@5

3 3$3(3,3034383

5$50585|5

5,585@5`5|5

:$:0:8:|:

;$;,;8;@;`;|;

8$80888|8

ChXXp://crl.microsoft.com/pki/crl/products/MicrosoftTimeStampPCA.crl0X

<hXXp://VVV.microsoft.com/pki/certs/MicrosoftTimeStampPCA.crt0

 229803 f785b1c0-5d9f-4316-8d6a-74ae642dde1c0

EhXXp://crl.microsoft.com/pki/crl/products/MicCodSigPCA_08-31-2010.crl0Z

>hXXp://VVV.microsoft.com/pki/certs/MicCodSigPCA_08-31-2010.crt0

$Microsoft Root Certificate Authority0

?hXXp://crl.microsoft.com/pki/crl/products/microsoftrootcert.crl0T

8hXXp://VVV.microsoft.com/pki/certs/MicrosoftRootCert.crt0

$Microsoft Root Certificate Authority

.tq[m

hXXp://office.microsoft.com 0

*31642 49e8c3f3-2359-47f6-a3be-6c8c4751c4b60

ChXXp://VVV.microsoft.com/pkiops/crl/MicCodSigPCA2011_2011-07-08.crl0a

EhXXp://VVV.microsoft.com/pkiops/certs/MicCodSigPCA2011_2011-07-08.crt0

)Microsoft Root Certificate Authority 20110

IhXXp://crl.microsoft.com/pki/crl/products/MicRooCerAut2011_2011_03_22.crl0^

BhXXp://VVV.microsoft.com/pki/certs/MicRooCerAut2011_2011_03_22.crt0

3hXXp://VVV.microsoft.com/pkiops/docs/primarycps.htm0@

)Microsoft Root Certificate Authority 20100

EhXXp://crl.microsoft.com/pki/crl/products/MicRooCerAut_2010-06-23.crl0Z

>hXXp://VVV.microsoft.com/pki/certs/MicRooCerAut_2010-06-23.crt0

1hXXp://VVV.microsoft.com/PKI/docs/CPS/default.htm0@

EhXXp://crl.microsoft.com/pki/crl/products/MicTimStaPCA_2010-07-01.crl0Z

>hXXp://VVV.microsoft.com/pki/certs/MicTimStaPCA_2010-07-01.crt0

`.data

?AuthHandlerSupportAutoLogonBasedOnURL@Http@Mso@@YAXXZ

?OutlookAuthSupportVersion@Authentication@Mso@@YAIXZ

CsiVersionSupportsSecureHttpRedirection

GetProcessWindowStation

portuguese-brazilian

Unicows.dll

Visual C   CRT: Not enough memory to complete call to strerror.

Broken pipe

Inappropriate I/O control operation

Operation not permitted

PSSh(

vSSSh

XSSSh

SSSSSSSSh

xSSSh

FTPjKS

FtPj;S

C.PjRV

t>Ht6Ht.Ht#Ht

t.Ht&Ht

uùA

t8Nt.Nt$Nt

j.Xf9D{

~jj.Xf9D{

j.Xf9F

t.j.Xf

3uRj.VQ

j%Xf9Dq

EnumWindows

RPCRT4.dll

P:\Target\x86\ship\click2run\en-us\adminbootstrapper.pdb

per.pdb

.?AV<lambda_52D43E82A5F0EE22>@?O@??preauthenticateRequest@CHttpRequestContext_WinHttp@Http@Mso@@UAEXAAVIRequest@34@AAVITokenEnumerator@34@@Z@

.?AV<lambda_162C38B16B11D40>@?BB@??preauthenticateRequest@CHttpRequestContext_WinHttp@Http@Mso@@UAEXAAVIRequest@34@AAVITokenEnumerator@34@@Z@

.?AV<lambda_941CA8726AA3EE7F>@?BN@??preauthenticateRequest@CHttpRequestContext_WinHttp@Http@Mso@@UAEXAAVIRequest@34@AAVITokenEnumerator@34@@Z@

.?AV<lambda_3291A2A164C19B86>@?DO@??preauthenticateRequest@CHttpRequestContext_WinHttp@Http@Mso@@UAEXAAVIRequest@34@AAVITokenEnumerator@34@@Z@

.?AV<lambda_EB8A29BD7DA0B72F>@?EF@??preauthenticateRequest@CHttpRequestContext_WinHttp@Http@Mso@@UAEXAAVIRequest@34@AAVITokenEnumerator@34@@Z@

.?AV<lambda_17C281F65776E03B>@?EN@??preauthenticateRequest@CHttpRequestContext_WinHttp@Http@Mso@@UAEXAAVIRequest@34@AAVITokenEnumerator@34@@Z@

zcÁ

.?AV?$_Ref_count@VORegistryKey@@@tr1@std@@

.?AVOnDemandUninstallWebControl@@

.?AVOnDemandInstallWebControl@@

.?AVOHttp@@

.?AV?$_Impl_base4@_NPBVORegistryKey@@AAV?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@AAKAAV23@@tr1@std@@

.?AV?$_Impl_no_alloc4@U?$_Callable_obj@V<lambda_1DDA6BCFC2B97ADD>@?CL@??AreBlockingProductsInstalled@MSIxC2RBlockValidator@@AAE_NXZ@$0A@@tr1@std@@_NPBVORegistryKey@@AAV?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@3@AAKAAV53@@tr1@std@@

<assemblyIdentity processorArchitecture="*" type="win32" name="Firefly" version="15.0.0.0" />

<!-- Windows 7 -->

<supportedOS Id="{35138b9a-5d96-4fbd-8e2d-a2440225f93a}"/>

6$6(6,60646

8$9,949<9

4(>,>0>4>

5$6(6,6064686<6@6

9 9$9(9,9

2 2$2(2,2024282<2@2

4 :$:(:,:0:4:8:<:

5%5X5s5

=(>3>9>?>

6&7,7074787

6!6%6)6-61656

5'5/575]5

0%2x2

; ;4;<;\;

?(?4?<?\?

0,080@0`0

=(=4=<=\=

2(242<2\2

9,989@9`9

*31595 04079350-16fa-4c60-b6bf-9d2b1cd059840

@.bss

.idata

8.up@

mkisofs 2.01-bootcd.ru

.mkisofsrc

W%X%Y%Z%[%

1.1 02/12/01 2002

Z%T%i%f%`%P%l%

%$%a%b%V%U%c%Q%W%]%\%[%

%<%^%_%Z%T%i%f%`%P%l%g%h%d%e%Y%X%R%S%k%j%

Z%T%i%f%`%P%l%}

!"#$%&'()* ,-./

0123456789

MKISOFS ISO 9660/HFS FILESYSTEM BUILDER & CDRECORD CD-R/DVD CREATOR (C) 1993 E.YOUNGDALE (C) 1997 J.PEARSON/J.SCHILLING

boot.catalog

TRANS.TBL

STREAM.IMG;1

Check all imported ISO9660 names from old session

Hide TRANS.TBL from Joliet tree

Rename RR_MOVED to .rr_moved in Rock Ridge tree

No longer supported

Allow more than one dot in filenames (e.g. .tar.gz) (violates ISO9660)

Cannot open '%s'.

Using "%s"

%s:%d: name required

%s:%d: equals sign required after '%.*s'

%s:%d: field name "%s" unknown

Read error on '%s'.

Usage: %s [options] file...

Use %s -help

%s-%c

%s-%s%s

-i option no longer supported.

Illegal iso9660 Level %d, use 1..3 or 4.

Unsupported sector type '%s'.

Option -%c is reserved for future use.

Illegal UCS Level %d, use 1..3.

Illegal Volume Set Size %s

Volume Set Size > 1 not yet supported

%s (%s-%s-%s)

Warning: Disabling Joliet support for DVD-Video.

Warning: ISO-9660 filenames longer than %d may cause buffer overflows in the OS.

read on Linux. On other operating systems you need to call

Unable to open previous session image %s

Unable to open pathname list %s.

THE ROCK RIDGE INTERCHANGE PROTOCOL PROVIDES SUPPORT FOR POSIX FILE SYSTEM SEMANTICS

can't open logfile: %s

re-directing all messages to %s

Unable to find previous session PVD %s

GRAFT:'%s'

GRAFT Point:'%s' in '%s : %s' (%s)

Invalid node - %s

graft_dir: '%s : %s', node: '%s', (scan)

graft_dir: '%s : %s', node: '%s', short_name: '%s'

Total extents scheduled to be written = %d

Implementation botch: %s should start at %u but starts at %u.

Writing: %-40sStart Block %u

Done with: %-40sBlock(s) %d

Implementation botch: FS should end at %u but ends at %u.

%d extents written (%d MB)

FROM: '%s'

ESC: '%s'

Fatal goof, file '%s' already in hash table.

%s000%s%s

NEW name '%s'

Unable to generate unique name for file %s

Using %s for %s%s%s (%s)

Fatal error - RR overflow (reclen %d) for file %s

Unable to sort directory %s

%c %-*s%s

Translation table size mismatch %d %d

./.rr_moved

.rr_moved

**BAD RRVERSION (%d) for %c%c

Scanning %s

Unable to open directory %s

Directories too deep for '%s' (%d) max is %d; ignored - continuing.

Ignoring file %s

Path name %s/%s too long.

Excluded by match: %s

Excluded: %s

Non-existent or inaccessible: %s

File %s is not readable - ignoring

File %s is too large - ignoring

Warning: Directory loop (%s dev: %lx ino: %lu).

Unknown file type (%s) %s - ignoring and continuing.

Unable to stat file %s - ignoring and continuing.

Hidden from HFS tree: %s

Hidden from ISO9660 tree: %s

Hidden ISO9660 attribute: %s

Hidden from Joliet tree: %s

Warning: missing whole name for: '%s'

stat parent->whole_name: '%s' -> %d.

Directories too deep for '%s' (%d) max is %d.

M ] %s

%s_d

cannot fwrite %d*%d

Trying to write %d bytes (not a multiple of 2048).

cannot open '%s'

cannot read from '%s'

%6.2f%% done, estimate finish %s

BError: '%s' and '%s' have the same ISO9660 name '%s'.

Error: '%s' and '%s' have the same Rock Ridge name '%s'.

Cache hit for '%s%s%s'

Fatal goof - could not find dir entry for '%s'

Implementation botch. Video pad for file %s is %d

Either the *.IFO file is bad or you found a mkisofs bug.

The pad was %d for file %s

%s%s%s

%d %d %s

Unexpected directory length %lld expected: %d '%s'

Continuation entry record length mismatch %d expected: %d.

Entry %d not in path tables

Unable to generate sane path tables - too many directories (%d)

Path table lengths do not match %d expected: %d

Total extents scheduled to be written (inc HFS) = %d

Total extents actually written (inc HFS) = %d

(Size of ISO volume = %d, HFS extra = %d)

Predicted = %d, written = %d

Total translation table size: %d

Total rockridge attributes bytes: %d

Total directory bytes: %d

Path table size(bytes): %d

Non zero-length file '%s' assigned zero extent.

find_hash('%s')

Checking name '%s' isorec.name '%s'

'%s' does NOT END OK

Panic: no space, cannot add RR CE entry (%d bytes mising) for %s line %d.

currlen: %d ipnt: %d, recstart: %d

Send bug report to the maintainer.

Negative RR name length residual: %d

XX

Problems with old ISO directory entry for file: '%s'.

Cannot parse Rock Ridge attributes for '%s'.

Warning: Neither Rock Ridge (-R) nor TRANS.TBL (-T)

Read error on old image %s

Previous session has incompatible sector size %d.

Previous session has volume set size %d (must be 1).

Reading old session failed, cannot execute -old-root.

Reading directory %s in old session failed, cannot execute -old-root.

-old-root (sub)directory %s not found in old session.

%%/%c

Joliet path table lengths do not match %d expected: %d

Unexpected joliet directory length %d expected: %d '%s'

Error: %s and %s have the same Joliet name

VIDEO_TS.IFO

Can't open sort file list %s

Can't allocate memory for %s filename

Can't open %s file list %s

Old session has illegal name '%.*s' length %d

New session will use name '%s'

.tar.gz

.ps.gz

Uh oh, I cant find the boot catalog directory '%s'!

Uh oh, I cant find the boot catalog '%s'!

Uh oh, I cant find the boot image '%s' !

Size of boot image is %d sectors ->

Error opening boot image '%s' for read.

Error reading MBR from boot image '%s'.

Warning: boot image '%s' MBR is not a boot sector.

Boot image '%s' has multiple partitions.

Warning: image size does not match geometry (%d)

Boot image '%s' has no partitions.

Error - boot image '%s' has not an allowable size.

Error opening boot image file '%s' for update.

Odd alignment at non-end-of-file in boot image '%s'.

Boot image file '%s' changed underneath us!

Cannot access '%s'.

Partition %d may not have a filename.

Total extents including %s boot = %d

%s: option `%s' is ambiguous

%s: option `--%s' doesn't allow an argument

%s: option `%c%s' doesn't allow an argument

%s: option `%s' requires an argument

%s: unrecognized option `--%s'

%s: unrecognized option `%c%s'

%s: illegal option -- %c

%s: option requires an argument -- %c

ATIP start of lead in: %ld (d:d/d)

ATIP start of lead out: %ld (d:d/d)

.finderinfo/

.resource/

.AppleDouble/

.rsrc/

FINDER.DAT

RESOURCE.FRK/

finder.dat

resource.frk/

.HSancillary

.HSResource/

warning: %s doesn't appear to be a %s file

.finderinfo

.resource

.ADeskTop

.IDeskTop

.rootinfo

.Desktop

.DeskServer

.Label

.AppleDouble

.AppleDesktop

RESOURCE.FRK

FILEID.DAT

resource.frk

fileid.dat

.HSResource

Name: %s

File type: %s

HFS Name: %s

ISO Name: %s

CREATOR: %s

%s%*s%*1s%c%c%c%c%*1s%*1s%c%c%c%c%*1s

error scanning afpfile %s - continuing

%4s%4s

can't HFS format %s

can't HFS mount %s

can't HFS create file %s

can't HFS open %s

can't HFS set attributes %s

can't HFS close file %s

can't HFS create folder %s

HFS scanning %s

Using HFS name: %s for %s

can't locate relocated directory %s

can't find directory location %s

Blessing %s (%s)

Creating %d PReP boot partition(s)

Uh oh, I cant find the boot image "%s"!

PReP boot partition %d is "%s"

unable to stat HFS boot file %s

unable to open HFS boot file %s

unable to read HFS boot file %s

%s is not a HFS boot file

unable to seek HFS boot file %s

unable to read HFS boot block %s

%s does not contain a valid boot block

Creating HFS Label %s %s

Faild to seek VIDEO_TS.IFO

Faild to read VIDEO_TS.IFO

%s/VIDEO_TS/VTS_d_0.IFO

%s/VIDEO_TS/VIDEO_TS.IFO

Faild to open %s

Can't open device '%s'

Can't open VMG info for '%s'.

Can't stat %s

Either VIDEO_TS.IFO or VIDEO_TS.VOB is not of correct size

%s/VIDEO_TS/VIDEO_TS.VOB

calc: Can't stat %s

Either VIDEO_TS.IFO or VIDEO_TS.VOB is not of correct size.

%s/VIDEO_TS/VTS_i_0.IFO

%s/VIDEO_TS/VTS_i_0.IFO appears to be corrupted.

%s/VIDEO_TS/VTS_i_0.VOB

%s/VIDEO_TS/VTS_i_%i.VOB

%s/%s

/VIDEO_TS/VIDEO_TS.IFO

/VIDEO_TS/VTS_i_0.IFO

/VIDEO_TS/VIDEO_TS.BUP

/VIDEO_TS/VTS_i_0.BUP

Could not open %s

cdrecord.ini

unsupported b*-tree node size

Possible Catalog file overflow - please report error

unsupported block size

unsupported partition map signature

unsupported start of partition logical data

String too long: %s

%s: %r

Error %d

%s: %s. %r

../../gcc-3.4.5/gcc/config/i386/w32-shared-ptr.c

msvcrt.dll

.file

crt1.c

crtstuff.c

_graftcp

_errmsg

CRTglob.c

CRTfmode.c

CRT_fp10.c

.idata$7p

.idata$5H

.idata$7t

.idata$5L

.idata$7L

.idata$5$

.idata$6P

.idata$7x

.idata$5P

.idata$7|

.idata$5T

.idata$7d

.idata$5<

.idata$7P

.idata$5(

.idata$6\

.idata$7l

.idata$5D

.idata$7h

.idata$5@

.idata$7\

.idata$54

.idata$6x

.idata$7`

.idata$58

.idata$7X

.idata$50

.idata$6p

.idata$7T

.idata$5,

.idata$6h

.idata$5

.idata$5X

.idata$7

.idata$5p

.idata$4$

.idata$5x

.idata$68

.idata$5h

.idata$6D

.idata$5l

.idata$5`

.idata$5d

.idata$7@

.idata$4|

.idata$7$

.idata$4`

.idata$4D

.idata$6X

.idata$4(

.idata$4T

.idata$6|

.idata$4P

.idata$6t

.idata$70

.idata$4l

.idata$4<

.idata$4@

.idata$6L

.idata$4H

.idata$6d

.idata$74

.idata$4p

.idata$5|

.idata$4L

.idata$6l

.idata$7H

.idata$7D

.idata$7

.idata$4\

.idata$5\

.idata$6$

.idata$48

.idata$6<

.idata$4X

.idata$7(

.idata$4d

.idata$7,

.idata$4h

.idata$44

.idata$64

.idata$4,

.idata$6

.idata$6,

.idata$5t

.idata$4

.idata$40

.idata$6(

.idata$7<

.idata$4x

.idata$78

.idata$4t

.idata$6`

.idata$2(

.idata$60

.ctors

___mingw_CRTStartup

_mainCRTStartup

_WinMainCRTStartup

_match_key

_r_packcatkey

_r_unpackcatkey

_r_packextkey

_r_unpackextkey

_r_comparecatkeys

_r_compareextkeys

_r_makecatkey

_r_makeextkey

_errmsgno

_errmsgstr

sjl_fc_key.2

eh_globals_key.5

__libmsvcrt_a_iname

___crt_xl_start__

___crt_xi_start__

___crt_xi_end__

___crt_xp_start__

___crt_xp_end__

__head_libmsvcrt_a

__CRT_fmode

___crt_xc_end__

___crt_xc_start__

___crt_xt_start__

__CRT_glob

___crt_xt_end__

Thawte Certification1

hXXp://ocsp.thawte.com0

.hXXp://crl.thawte.com/ThawteTimestampingCA.crl0

hXXp://ts-ocsp.ws.symantec.com07

 hXXp://ts-aia.ws.symantec.com/tss-ca-g2.cer0<

 hXXp://ts-crl.ws.symantec.com/tss-ca-g2.crl0(

2Terms of use at hXXps://VVV.verisign.com/rpa (c)101.0,

/hXXp://csc3-2010-crl.verisign.com/CSC3-2010.crl0D

hXXps://VVV.verisign.com/rpa0

hXXp://ocsp.verisign.com0;

/hXXp://csc3-2010-aia.verisign.com/CSC3-2010.cer0

<VeriSign Class 3 Public Primary Certification Authority - G50

DhXXp://crl.microsoft.com/pki/crl/products/MicrosoftCodeVerifRoot.crl0

hXXps://VVV.verisign.com/cps0*

#hXXp://logo.verisign.com/vslogo.gif04

#hXXp://crl.verisign.com/pca3-g5.crl04

hXXp://ocsp.verisign.com0

hXXp://VVV.vmware.com/0

t.Ht%Ht

kernel32.dll

Unsupported feature

Unsupported method

Headers Error in encrypted archive. Wrong password?

Wrong password

Unsupported Windows version

.?AUCArcCmdLineException@@

.?AVCUnsupportedFeatureException@N7z@NArchive@@

g?9F.ge8

h.LDK8

'.%SU 

.MF~0

W.cL2K

%d[Eh

%U 0|=

8@@5"4!./

fL.hf

-H}o2

1?8~%c

.ODXU

v=.jDhW

<3a/.Kp

o.icG(

Y.UtE

.Zap1k

.vy|/

]:y.pe

7K~Ax-6X#-wW}|Zf

Web,s,

Z.zI:O/34 G9Z4

a ß

{.mEO"

Sl%F=P!p~a"|)t

.GB0]Sz

$W %C

`-v2}

2.cu,w

<-vX}/~

#.df!

IX%X1S

[{.Pq?

n0ü

L%CJ6

b8A.uo*

/.uq0<S

)v.Np'v

%FL7^

%sgB\

5%uyu`

)%Flc 

=XR%D

-.OrA N

\EÛ

?b.NW-

S.VVZ

=V{%xl

.hKX=w"

Q&.so

@.rsrc

vcruntime140.i386.pdb

.cfguard

.rdata$vtableC

.edata

VCRUNTIME140.dll

__report_gsfailure

__vcrt_GetModuleFileNameW

__vcrt_GetModuleHandleW

__vcrt_InitializeCriticalSectionEx

__vcrt_LoadLibraryExW

api-ms-win-crt-runtime-l1-1-0.dll

api-ms-win-crt-string-l1-1-0.dll

api-ms-win-crt-heap-l1-1-0.dll

api-ms-win-crt-stdio-l1-1-0.dll

api-ms-win-crt-convert-l1-1-0.dll

2 2$2(2,2

;0<@<\<`<|<

> >$>,>0>4><>@>

hXXp://microsoft.com0

@.didat

CONCRT140.dll

0123456789-

%b %d %H : %M : %S %Y

%m / %d / %y

%I : %M : %S %p

%H : %M : %S

%d / %m / %y

msvcp140.i386.pdb

t4j.Xf9D$<u[f

j.Xf9D$Tu8f

MSVCP140.dll

??4_Crt_new_delete@std@@QAEAAU01@$$QAU01@@Z

??4_Crt_new_delete@std@@QAEAAU01@ABU01@@Z

?ReportUnhandledError@_ExceptionHolder@details@Concurrency@@AAEXXZ

?_Execute_once@std@@YAHAAUonce_flag@1@P6GHPAX1PAPAX@Z1@Z

?_LogTaskExecutionCompleted@_TaskEventLogger@details@Concurrency@@QAEXXZ

?_ReportUnobservedException@details@Concurrency@@YAXXZ

_Mtx_getconcrtcs

_Thrd_join

_Wcrtomb

__Wcrtomb_lk

__crtCloseThreadpoolTimer

__crtCloseThreadpoolWait

__crtCompareStringA

__crtCompareStringEx

__crtCompareStringW

__crtCreateEventExW

__crtCreateSemaphoreExW

__crtCreateSymbolicLinkW

__crtCreateThreadpoolTimer

__crtCreateThreadpoolWait

__crtFlushProcessWriteBuffers

__crtFreeLibraryWhenCallbackReturns

__crtGetCurrentProcessorNumber

__crtGetFileInformationByHandleEx

__crtGetLocaleInfoEx

__crtGetSystemTimePreciseAsFileTime

__crtGetTickCount64

__crtInitOnceExecuteOnce

__crtInitializeCriticalSectionEx

__crtIsPackagedApp

__crtLCMapStringA

__crtLCMapStringEx

__crtLCMapStringW

__crtSetFileInformationByHandle

__crtSetThreadpoolTimer

__crtSetThreadpoolWait

__crtWaitForThreadpoolTimerCallbacks

__acrt_iob_func

_execute_onexit_table

_crt_atexit

api-ms-win-crt-locale-l1-1-0.dll

api-ms-win-crt-math-l1-1-0.dll

api-ms-win-crt-multibyte-l1-1-0.dll

api-ms-win-crt-time-l1-1-0.dll

api-ms-win-crt-filesystem-l1-1-0.dll

api-ms-win-crt-environment-l1-1-0.dll

api-ms-win-crt-utility-l1-1-0.dll

3L4#5

0 0$0(0,0

GetWindowsDirectoryW

WINSPOOL.DRV

CreatePipe

PeekNamedPipe

USER32.DLL

ExitWindowsEx

GetKeyState

RegisterHotKey

UnregisterHotKey

keybd_event

EnumChildWindows

GDI32.DLL

RegOpenKeyW

RegCreateKeyW

CryptDeriveKey

CryptDestroyKey

ADVAPI32.DLL

OLEAUT32.DLL

OLE32.DLL

SHFileOperationW

SHELL32.DLL

WSOCK32.DLL

WINMM.DLL

ICMP.DLL

IMAGEHLP.DLL

MSI.DLL

NETAPI32.DLL

SETUPAPI.DLL

URLDownloadToFileW

UrlMkSetSessionOption

URLMON.DLL

USERENV.DLL

DeleteUrlCacheEntryW

InternetOpenUrlW

UnlockUrlCacheEntryFileW

WININET.DLL

version="1.0.0.0"

name="CompanyName.ProductName.YourApp"

name="Microsoft.Windows.Common-Controls"

version="6.0.0.0"

publicKeyToken="6595b64144ccf1df"

<requestedExecutionLevel

2147483648

.----/01/01/01

DSOUND.DLL

RICHED32.DLL

lntdll.dll

WindowClass_%d

PB_Hotkey

Shell32.dll

%s*.*

Kernel32.DLL

dUser32.DLL

msimg32.dll

HKEY_CLASSES_ROOT\Installer\Products\00006109C80000000000000000F01FEC

/Office/Data/c2rfireflydata.xml hXXp://officecdn.microsoft.com/pr/

taskkill.exe

\Setup15.exe

\setup15.exe

Coded by: Ratiborus, forum.ru-board.com

files\configure.xml

\Uninstall.xml

/stream.x86.x-none.dat hXXp://officecdn.microsoft.com/pr/39168D7E-077B-48E7-872C-B232C3E72675/Office/Data/

\Configure.xml

mkisofs.exe

Windows 95

Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.

Windows 98

advapi32.dll

Advapi32.dll

/Office/Data/v64.cab hXXp://officecdn.microsoft.com/pr/

VersionToReport

HKEY_LOCAL_MACHINE

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\ProplusRetail - en-us

1.2.5

\Windows\System32\msvcp140.dll

/fre.cab hXXp://officecdn.microsoft.com/pr/39168D7E-077B-48E7-872C-B232C3E72675/Office/Data/

HKEY_LOCAL_MACHINE\SOFTWARE\Novell\NetWareWorkstation\CurrentVersion

\x64\cleanospp.exe

HKEY_CLASSES_ROOT\.

has joined the domain

/e640.cab hXXp://officecdn.microsoft.com/pr/

hXXp://officecdn.microsoft.com/pr/39168D7E-077B-48E7-872C-B232C3E72675/Office/Data/c2rfireflydata.xml hXXp://officecdn.microsoft.com/pr/39168D7E-077B-48E7-872C-B232C3E72675/Office/Data/v32.cab hXXp://officecdn.microsoft.com/pr/39168D7E-077B-48E7-872C-B232C3E72675/Office/Data/v32_

[0-9]{2}.[0-9]{1}.[0-9]{4}.[0-9]{4}

Not joined to any domain or group

cscript.exe //NoLogo

compilers\pbcompiler.exe

user32.dll

/s640.cab hXXp://officecdn.microsoft.com/pr/39168D7E-077B-48E7-872C-B232C3E72675/Office/Data/

Windows Vista

/stream.x64.x-none.dat hXXp://officecdn.microsoft.com/pr/39168D7E-077B-48E7-872C-B232C3E72675/Office/Data/

Portuguese

\\.\PhysicalDrive

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion

\mkisofs.exe

\v32.hash

OffScrub_O15msi.vbs ALL /NoCancel /Force /OSE 2>&1

\x86\cleanospp.exe

\s320.cab

NetApi32.dll

Netapi32.dll

netapi32.dll

\Media\Windows Error.wav

Windows 2000

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon

\55c92734-d682-4d71-983e-d6ec3f16059f

\55C92734-D682-4D71-983E-D6EC3F16059F

FakeClient.exe

CryptDeriveKey_() failed

/t /f /IM setup15.exe

\Program Files (x86)\Microsoft Office\Office16\ospp.vbs

Version.dll

Port

Joined to the group:

\OffScrub_O16msi.vbs

Program Files\Microsoft Office\Office16\OSPP.VBS

hXXp://forum.ru-board.com

Windows Me

Netsh.exe

HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.

\files.dat

Joined to the domain:

/r320.cab hXXp://officecdn.microsoft.com/pr/

55C44C35-878E-4C43-83EE-B666BF4261A4

..oOo..

Ý/%mm/%yy %hh:%ii:%ss

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Office\ClickToRun\ProductReleaseIDs

\Office\Data\v32.cab

\stream.x86.x-none.dat

b8f9b850-328d-4355-9145-c59439a0c4cf

route.exe

\i640.cab

\OffScrubC2R.vbs

HKEY_USERS

/t /f /IM KMSS.exe

shell32.dll

\Program Files\Microsoft Office\Office16\ospp.vbs

/s640.cab hXXp://officecdn.microsoft.com/pr/

.iso" "

\bin\KMSS.exe

\wget_oinstall.dat

ospp.vbs /rearm

HKEY_LOCAL_MACHINE\System\CurrentControlSet\Control\Session Manager\Environment

Selected folder contains build different from downloaded. Operation can Not Continue.

\log.txt

OffScrubC2R.vbs ALL /NoCancel /OSE

set filesystem = CreateObject("scripting.Filesystemobject")

/e320.cab hXXp://officecdn.microsoft.com/pr/

-udf -log-file log.txt -volid

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Office\ClickToRun\ProductReleaseIDs\

cscript.exe

HKEY_CLASSES_ROOT\Installer\Products\00006109F80000000100000000F01FEC

\stream.x64.x-none.dat

/ui640.cab hXXp://officecdn.microsoft.com/pr/

HKEY_CURRENT_CONFIG

\VersionDescriptor.xml

HKEY_CURRENT_USER

ClientVersionToReport

NetUserChangePassword

/t /f /IM wget_oinstall.exe

-Port 1688 -PWin RandomKMSPID -PO14 RandomKMSPID -PO15 RandomKMSPID -AI 43200 -RI 43200 KillProcessOnPort

HKEY_CLASSES_ROOT\

.cab hXXp://officecdn.microsoft.com/pr/

HKEY_CLASSES_ROOT\Applications\

[0-9]{1,3}%

\Office\Data\v32.cab"

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Authentication\LogonUI

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Office\15.0\ClickToRun\Configuration

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\ProfileList\

HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run

HKEY_LOCAL_MACHINE\System\CurrentControlSet\Control\Print\Printers\

5440fd1f-7ecb-4221-8110-145efaa6372f

Unjoined

Set objFolder = objShell.Namespace(filesystem.GetParentFolderName(Wscript.Arguments(0)))

Windows 2003 Server

Set objFolderItem = objFolder.ParseName(filesystem.GetFileName(WScript.Arguments(0)))

492350f6-3a01-4f97-b9c0-c7c6ddf67d60

\0ff1ce15-a989-479d-af46-f275c6370663

\0FF1CE15-A989-479D-AF46-F275C6370663

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\OfficeSoftwareProtectionPlatform

/i640.cab hXXp://officecdn.microsoft.com/pr/

Setup16.exe

hXXp://goo.gl/eD7s9X

RegDeleteKeyExA

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Office\ClickToRun\Configuration

\Windows\SysWOW64\msvcp140.dll

files.dat

files\setup16.exe

has joined the group

Windows 2012 Server

KMSactivator.vbs //NoLogo /ADR:

/stream.x64.x-none.dat.cobra hXXp://officecdn.microsoft.com/pr/

\wget_oinstall.exe"

Program Files (x86)\Microsoft Office\Office16\OSPP.VBS

\Windows\System32\vcruntime140.dll

\wget_oinstall.exe

install.rdf

Mpr.dll

/Office/Data/v32.cab hXXp://officecdn.microsoft.com/pr/

hXXps://technet.microsoft.com/en-us/library/mt455210

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\SoftwareProtectionPlatform

/s320.cab hXXp://officecdn.microsoft.com/pr/

\Program Files (x86)\Microsoft Office\Office15\ospp.vbs

/fre.cab hXXp://officecdn.microsoft.com/pr/

/download Download.xml

255.255.255.255

psapi.dll

\Windows\SysWOW64\vcruntime140.dll

\s640.cab

sc.exe

wget_oinstall.dat

\cmd.exe

HKEY_USERS\S-1-5-20\SOFTWARE\Microsoft\Windows NT\CurrentVersion\SoftwareProtectionPlatform

HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run

\x86\msvcr100.dll

[0-9]{1,}.[0-9]{2}%

/configure d:\MyPath\Configuration.xml

\autorun.inf

Windows NT 3.51

Set objShell = CreateObject("Shell.Application")

replace.bat

Windows 2008 Server

Last.js

HKEY_CLASSES_ROOT

/stream.x86.x-none.dat.cobra

7ffbc6bf-bc32-4f92-8982-f9dd17fd3114

\Setup16.exe

\setup16.exe

NetJoinDomain

/ui320.cab hXXp://officecdn.microsoft.com/pr/

/stream.x86.x-none.dat.cobra hXXp://officecdn.microsoft.com/pr/

hXXp://officecdn.microsoft.com/pr/

Windows 7

Windows 8

SelfDelete.bat

/t /f /IM FakeClient.exe

/stream.x64.x-none.dat hXXp://officecdn.microsoft.com/pr/

hXXp://officecdn.microsoft.com/pr/39168D7E-077B-48E7-872C-B232C3E72675/Office/Data/c2rfireflydata.xml hXXp://officecdn.microsoft.com/pr/39168D7E-077B-48E7-872C-B232C3E72675/Office/Data/v64.cab hXXp://officecdn.microsoft.com/pr/39168D7E-077B-48E7-872C-B232C3E72675/Office/Data/v64_

Advfirewall Firewall delete rule name=0pen_Port_KMS protocol=TCP

\prefs.js

\Program Files\Microsoft Office\Office15\ospp.vbs

Advfirewall Firewall add rule name=0pen_Port_KMS dir=in action=allow protocol=TCP localport=

NetUnjoinDomain

\install.rdf

\hash.txt

\OffScrub_O15msi.vbs

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Office\15.0\ClickToRun\ProductReleaseIDs\Active\

OffScrub_O16msi.vbs ALL /NoCancel /Force /OSE 2>&1

\Media\Windows Notify.wav

\i320.cab

.cab hXXp://officecdn.microsoft.com/pr/39168D7E-077B-48E7-872C-B232C3E72675/Office/Data/

/workaround.cab

Setup15.exe

64256afe-f5d9-4f86-8936-8840a6a4f5be

\x64\msvcr100.dll

\Download.xml

files\setup15.exe

profiles.ini

/stream.x64.x-none.dat.cobra

If Replace(objVerb.name, "&", "") = "

hXXp://officecdn.microsoft.com/pr/39168D7E-077B-48E7-872C-B232C3E72675/Office/Data/v32.cab

/s320.cab hXXp://officecdn.microsoft.com/pr/39168D7E-077B-48E7-872C-B232C3E72675/Office/Data/

\Sysnative\cmd.exe

Set colVerbs = objFolderItem.Verbs

Windows NT4

0.0.0.0

HKEY_LOCAL_MACHINE\SOFTWARE\Mozilla\Mozilla

/stream.x86.x-none.dat hXXp://officecdn.microsoft.com/pr/

/i320.cab hXXp://officecdn.microsoft.com/pr/

PureBasic.exe\DefaultIcon\

\59A52881-A989-479D-AF46-F275C6370663

Windows 2008 R2 Server

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System

HKEY_CLASSES_ROOT\Installer\Products\00006109C80090400000000000F01FEC

0.0.0.0

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\ProplusRetail - ru-ru

5.21.003

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Print\Printers\

/configure Uninstall.xml

/configure Configure.xml

NetGetJoinInformation

v5.9.2

" Then objVerb.DoIt

Windows XP

Ý%mm%yy-%hhh%iim%sss.js

0.0.0.0 IF 1

hXXp://officecdn.microsoft.com/pr/39168D7E-077B-48E7-872C-B232C3E72675/Office/Data/

unable to call IWbemServices::ExecQuery

/Office/Data/v32.cab

/t /f /IM setup16.exe

/r640.cab hXXp://officecdn.microsoft.com/pr/

EXTRAC32.exe

%mm.Ý.%yyyy-%hh.%ii.%ss

7z.sfx

7z.sfx.exe

%u.%u.%u

d-d-dTd:d:dZ

%.*s%s%s

{00000000-0000-0000-0000-000000000000}

\\?\Volume

\\?\UNC\

d-d-dTd:d:d.dZ

combase.dll

minkernel\crts\ucrt\inc\corecrt_internal_strtox.h

__crt_strtox::floating_point_value::as_double

__crt_strtox::floating_point_value::as_float

mscoree.dll

ext-ms-win-ntuser-windowstation-l1-1-0

KERNEL32.DLL

OfficeClickToRun.exe

IntegratedOffice.exe

VersionDescriptor.xml

AttemptGetKey

hXXp://officeredir.microsoft.com/r/rlidOfficeWebHelp?p1=OCSAC2R%s&ver=16&clid=%d&helpid=%"%s-%s-%s%"&app=webview

hXXp://officecdn.microsoft.com

c2r32.dll

hXXp://

root hkey is expected

Failed to create registry key: registry key name "%s" is too long

Failed to create registry key "%s\%s": %d

/pr/492350f6-3a01-4f97-b9c0-c7c6ddf67d60

/pr/64256afe-f5d9-4f86-8936-8840a6a4f5be

/pr/b8f9b850-328d-4355-9145-c59439a0c4cf

/pr/7ffbc6bf-bc32-4f92-8982-f9dd17fd3114

/pr/5440fd1f-7ecb-4221-8110-145efaa6372f

@C2R.exe

ClickToRun.Install.ODT

AdminBootstrapper::Main: Installation came back with %d.

OException has occured %s. Exiting bootstrapper.

Exception has occured %s. Exiting bootstrapper.

@0xx

, Error:0x%x

CoInitializeEx(0, %d) failed; Appartment type: current=%d,requested=%d. Error code: 0xx.

CoInitializeEx(0, %d) failed. Error code: 0xx.

office-AppPrivilege.ProEE-DRM

office-AppPrivilege.ProXML

office-AppPrivilege.VisioDataFeature

office-AppPrivilege.ProEE-Classify

office-AppPrivilege.ProEE-BarcodesAndLabels

office-AppPrivilege.ProEE-Workflow

office-AppPrivilege.SaveForXLServices

office-AppPrivilege.ProSlideLibraryPublish

office-AppPrivilege.CommercialUse

office-AppPrivilege.ProOutlookPolicyTags

office-AppPrivilege.ServicesA

office-AppPrivilege.ServicesB

office-AppPrivilege.GroupPolicySupport

office-AppPrivilege.SharePointWorkspace

office-AppPrivilege.BusinessIntelligence

office-AppPrivilege.LyncPro

office-AppPrivilege.ProjectPro

office-AppPrivilege.OPEP

office-AppPrivilege.OneNotePro

office-AppPrivilege.PremiumBI

office-AppPrivilege.IRM

office-AppPrivilege.PolicyNudge

office-AppPrivilege.ArchiveMailbox

office-AppPrivilege.SiteMailbox

office-AppPrivilege.RetentionPolicies

office-AppPrivilege.licensing_testingEnabled

office-AppPrivilege.licensing_isPIPC

office-AppPrivilege.licensing_isPaid

office-AppPrivilege.licensing_isSubscription

office-AppPrivilege.licensing_isVolume

office-AppPrivilege.omex_suppressTMS

office-AppPrivilege.licensing_unknownEnabled

office-AppPrivilege.licensing_isCommercial

office-AppPrivilege.licensing_isPerpetual

office-AppPrivilege.mso_EnterpriseDataProtection

office-PerpetualUrl

office-DependsOnWindows

{DFC79B08-1388-44E8-8CBE-4E4E42E9F73A}

{DAF2E6D5-1424-47B9-8820-42B32E4BC3A2}

{BFA358B0-98F1-4125-842E-585FA13032E6}

{BB6FE552-10FB-4C0E-A4BE-6B867E075735}

{9D9FAF9E-D345-4B49-AFCE-68CB0A539C7C}

{67C0FC0C-DEBA-401B-BF8B-9C8AD8395804}

{3B2FA33F-CD5A-43A5-BD95-F49F3F546B0B}

{FC61B360-59EE-41A2-8586-E66E7B43DB89}

{740A90D3-A366-49FA-9845-1FA8257ED07B}

{424D52FF-7AD2-4BC7-8AC6-748D767B455D}

{A49503A7-3084-4140-B087-6B30B258F92E}

{C3E65D36-141F-4D2F-A303-A842EE756A29}

{685062A7-6024-42E7-8C5F-6BB9E63E697F}

{2AA09C36-3E86-4580-8E8D-E67DFC13A5A6}

{0C6911A0-1FD3-4425-A4B3-DA478D3BF807}

{D95CFA27-EDDF-4116-8D28-BBDB1E07B0A5}

{C02FB62E-1CD5-4E18-BA25-E0480467FFAA}

{E260D7A1-49DC-41EE-B275-33A544C96904}

{6379F5C8-BAA4-482E-A5CC-38ADE1A57348}

{BEA06487-C54E-436A-B535-58AEC833F05B}

{45C8342D-379D-4A4F-99C5-61141D3E0260}

{327DAB29-B51E-4A29-9204-D83A3B353D76}

{91AB0C97-4CBE-4889-ACA0-F0C9394046D7}

{55671CEE-5384-454B-9160-975BD5441C4B}

{86834D00-7896-4A38-8FAE-32F20B86FA2B}

{AC9C8FB4-387F-4492-A919-D56577AD9861}

{522F8458-7D49-42FF-A93B-670F6B6176AE}

{3A4A2CF6-5892-484D-B3D5-FE9CC5A20D78}

{3E0F37CC-584B-46B1-873E-C44AD57D6605}

{090896A0-EA98-48AC-B545-BA5DA0EB0C9C}

{5F2C45C3-232D-43A1-AE90-40CD3462E9E4}

{6BBE2077-01A4-4269-BF15-5BF4D8EFC0B2}

{1ECBF9C7-7C43-483E-B2AD-06EF5C5744C4}

{8E2E934E-C319-4CCE-962E-F0546FB0AA8E}

{253CD5CD-F190-4A8C-80AC-0144DF8990F4}

{C28ACDB8-D8B3-4199-BAA4-024D09E97C99}

{861343B3-3190-494C-A76E-A9215C7AE254}

{99D89E49-3F21-4D6E-BB17-3E4EE4FE8726}

{A9833863-A86B-4DEA-A034-7FDEB7A6276B}

{E2127526-B60C-43E0-BED1-3C9DC3D5A468}

{8BDA5AA2-F2DB-4124-A513-7BE79DA4E499}

{E7B23B5D-BDB1-495C-B7CE-CC13652ACF2F}

{8507F630-BEE7-4833-B054-C1CA1A43990C}

{E914EA6E-A5FA-4439-A394-A9BB3293CA09}

{BF3AB6CF-1B0D-4250-BAD9-4B61ECA25316}

{B21367DF-9545-4F02-9F24-240691DA0E58}

{69EC9152-153B-471A-BF35-77EC88683EAE}

{37256767-8FC0-4B6A-8B92-BC785BFD9D05}

{9E7FE6CF-58C6-4F36-9A1B-9C0BFC447ED5}

{CEBCF005-6D81-4C9E-8626-5D01C48B834A}

{26421C15-1B53-4E53-B303-F320474618E7}

{EE6555BB-7A24-4287-99A0-5B8B83C5D602}

{D229947A-7C85-4D12-944B-7536B5B05B13}

{9CAABCCB-61B1-4B4B-8BEC-D10A3C3AC2CE}

{2CD0EA7E-749F-4288-A05E-567C573B2A6C}

{81D507D6-E729-436D-AD4D-FED2CBE4E566}

{3D0631E3-1091-416D-92A5-42F84A86D868}

{6337137E-7C07-4197-8986-BECE6A76FC33}

{742178ED-6B28-42DD-B3D7-B7C0EA78741B}

{812837CB-040B-4829-8E22-15C4919FEBA4}

{7AB38A1C-A803-4CA5-8EBB-F8786C4B4FAA}

{D7279DD0-E175-49FE-A623-8FC2FC00AFC4}

{0C7137CB-463A-44CA-B6CD-F29EAE4A5201}

{EB778317-EA9A-4FBC-8351-F00EEC82E423}

{52263C53-5561-4FD5-A88D-2382945E5E8B}

{02BB3A66-D796-4938-94E3-1D6FF2A96B5B}

{E6930809-6796-466F-BC45-F0937362FDC1}

{6516C530-02EA-49D9-AD33-A824902B1065}

{AA1A1140-B8A1-4377-BFF0-4DCFF82F6ED1}

{5770F497-3F1D-4396-A729-18677AFE6359}

{003D2533-6A8C-4163-9A4E-76376B21ED15}

{0B40C0DA-6C2C-4BB6-9C05-EF8B30F96668}

{59C95D45-74A6-405E-815B-99CF2692577A}

{ADE257E8-4824-497F-B767-C0D06CDA3E4E}

{9CF873F3-5112-4C73-86C5-B94808F675E0}

{2D40ED06-955E-4725-80FC-850CDCBC1396}

{B688E64D-6305-4CCF-9981-CBF6823B3F65}

{65A4C65F-780B-4B57-B640-2AEA70761087}

{7BBE17F2-24C7-416A-8821-A7ACAF91A4AA}

{5D8AAAF2-3EAB-48E0-822A-6EFAE35980F7}

{FDA59085-BDB9-4ADC-B9D7-4B5E7DFD3EAC}

{AB2A78FF-5C52-494A-AE2A-99C0E481CA99}

{9540C768-CEDF-401C-B27A-15DD833E7053}

{949594B8-4FBF-44A7-BD8D-911E25BA2938}

{2A859A5B-3B1F-43EA-B3E3-C1531CC23363}

{5B7C4417-66C2-46DB-A2AF-DD1D811D8DCA}

{7E6F537B-AF16-43E6-B07F-F457A96F58FE}

{AE88E21A-D981-45A0-9813-3452F5390A1E}

{09322079-6043-4D33-9AB1-FFC268B8248E}

{E0C4D41F-B115-4D51-9E8C-63AF19B6EEB8}

{5917FA4B-7A37-4D70-B835-2755CF165E01}

{12F1FDF0-D744-48B6-9F9A-B3D7744BEEB5}

{A46815E5-C7E6-4F4F-8994-65BD19DC831D}

{D059DF6E-43A4-40EE-894D-5186F85AF9A0}

{E47D40AD-D9D0-4AB0-9C3D-B209E77E7AE8}

{58DB55C7-BB77-4C4D-A170-D7ED18A4AECE}

{B58FB371-5E42-46CE-927B-1A27AE89194C}

{D84CB3EA-CB53-466A-85C8-E8ED69D3F394}

{286E0A48-550E-4AFE-A223-27D510DE9E3B}

{A4CB27DA-2524-4998-92AE-6A836124BF9F}

{DAA7B9D0-F65A-482B-8AD3-474A33A05BE2}

{21757D20-006A-4BA0-8FDB-9DE272A11CF4}

{44938520-350C-4919-8E2F-E840C99AF4BF}

{F1997D24-27E6-4350-A9C7-50E63F85406A}

{7F3D4AF1-E298-4C30-8118-A0533B436C43}

{CB9FE322-23F2-4FC5-8569-0E63D0853072}

{F3449F6D-D512-4BBC-AC02-8C654845F6CB}

{436055A7-25A6-40FF-A124-B43A216FD369}

{3B694869-1556-4339-98C2-96C893040E31}

{7BAA6D3A-9EA9-47A8-8DFF-DC33F63CFEB3}

{11FC26E1-ADC8-4BEE-B42A-5C57D5FEC516}

{396D571C-B08F-4BEE-BE0B-28C5B640BC23}

{B6C0DE84-37D8-41B2-9EAF-8A80A008D58A}

{BCEF3379-4C3F-46D6-9922-8D3E513E75FA}

{C299D07D-803A-423C-88E9-029DE50D79ED}

{8C4F02D4-30C0-441A-860D-A68BE9EFC1EE}

{89B643DB-DFA5-4AF4-AEFC-43D17D98B084}

{D7E4AF12-6EB0-40DA-BF0E-D818BBC62AFB}

{183C0D5A-5AAE-45EB-B0CE-88009B8B3939}

{2E8E87E2-ED03-4DFB-8B40-0F73785B43FD}

{6B102F6C-50D4-4137-BF9F-5E446348188B}

{BE161169-49EC-4277-9802-6C5964D96593}

{D495DE19-448F-4C7E-8343-E54D7F336582}

{16C432FF-E13E-46A5-AB7D-A1CE7519119A}

{E0ECE06B-9123-4314-9570-338573410DE7}

{1752DF1B-8314-4790-9DF8-585D0BF1D0E3}

{3CF36478-D8B9-4FF4-9B42-0EDC60415E6A}

{CCB0F52E-312E-406E-A13A-566AF3C6B91D}

{634C8BC9-357C-4A70-A6B1-C2A9BC1BF9E5}

{B6512468-269D-4910-AD2D-A6A3D769FEBA}

{FEDA65D8-640B-4220-B8AE-6E221A990258}

{F337DD12-BF19-456B-82ED-B022B3032737}

{CB5E4CFF-1C96-43CA-91F8-0559DBA5456C}

{C2B1EC65-443F-4B2A-BF99-B46B244F0179}

{C9D3D19B-60A6-4213-BC72-C1A1A59DC45B}

{943CDA82-BDAC-4298-981F-21E97303DCCE}

{991A2521-DBB2-436C-82EB-C1BF93AC46FD}

{ED7482AE-C31E-4B62-A7CB-9291A0D616D2}

{63F119BD-171E-4034-B98F-A85759367616}

{792DE587-45FD-4F49-AD84-BFD40087792C}

{90984839-248D-4746-8F55-C943CAB009CF}

{62CCF9BD-1F60-414A-B766-79E98E55283B}

{F600E366-4C93-4CF0-BED5-BF2398759E00}

{174F331D-103E-4654-B6BD-C86D5B259A1A}

{DEA194EA-A396-4F91-88F2-77E501C8B9D2}

{B64CFCED-19A0-4C81-8B8D-A72DDC7488BA}

{C5B6E8E0-AD3D-4712-A5C6-FB7E7CC4DA59}

{A9AF7310-F6E0-40E2-B44A-076B2BA7E118}

{1F3BF441-3BD5-4DC5-B3DA-DB90450866F4}

{BDA57528-BB32-43DB-8CF0-36A32372F527}

{F98827AD-4B5F-48F1-B81B-FEE63DF5858E}

{B333EAB2-86CB-4B08-A5B8-A4C64AFC7A4B}

{F988DF4F-10DF-444F-909F-679BB9DF70D2}

{4D57374B-F5EA-4513-BB95-0456E424BCEE}

{9AF02C45-EE74-4400-A4E7-1251D11780A0}

{9459DA1D-F113-416B-AB41-A81D1C29A7A0}

{F8FF7F1C-1D40-4B84-9535-C51F7B3A70D0}

{04D62A0B-845D-48ED-A872-A064FCC56B07}

{5CA79892-8746-4F00-BB15-F3C799EDBCF4}

{E96A7A9C-162D-41E1-8C3D-D4C0929B6558}

{934ECDD6-7438-4464-B0FD-ED374AAB9CA6}

{5F1FB9D5-F241-4543-994F-36B37F888585}

{E5606A7D-8C29-4AD7-94B5-7427BF457616}

{4B9B31AA-00FA-481C-A25F-A2067F3FF24C}

{92B51A69-397D-4796-A5E8-D1672B349469}

{1AE119A6-40ED-4FA9-B52A-909841BD6E3F}

{FA25F074-80F9-44C1-B233-4019D3E70230}

{77A58083-E86D-45C1-B56E-77EC925167CF}

{523AABDF-9353-4151-9179-F708A2B48F6B}

{85133BEE-AD80-4CB4-977B-F16FD2DC3A20}

{3DC943FD-4E44-4FD6-A05F-8B421FF1C68A}

{8978F58A-BDC1-418C-AB3E-8017859FCC1E}

{9156E89A-1370-4079-AAA5-695DC9CEEAA2}

{B7CD5DC5-A2E6-4E74-BA44-F16B81B931F2}

{87D9FF03-50F4-4247-83E7-32ED575F2B1B}

{064A3A09-3B2B-441D-A86B-F3D47F2D2EC6}

{09775609-A49B-4F28-97AE-7F7740415C66}

{C9693FD7-4024-4544-BF5B-45160F7D5687}

{537EA5B5-7D50-4876-BD38-A53A77CACA32}

{52287AA3-9945-44D1-9046-7A3373666821}

{C85FE025-B033-4F41-936B-B121521BA1C1}

{B58A5943-16EA-420F-A611-7B230ACD762C}

{28F64A3F-CF84-46DA-B1E8-2DFA7750E491}

{A96F8DAE-DA54-4FAD-BDC6-108DA592707A}

{77F47589-2212-4E3B-AD27-A900CE813837}

{96353198-443E-479D-9E80-9A6D72FD1A99}

{B4AF11BE-5F94-4D8F-9844-CE0D5E0D8680}

{4C1D1588-3088-4796-B3B2-8935F3A0D886}

{951C0FE6-40A8-4400-8003-EEC0686FFBC4}

{FB3540BC-A824-4C79-83DA-6F6BD3AC6CCB}

{86AF9220-9D6F-4575-BEF0-619A9A6AA005}

{AE9D158F-9450-4A0C-8C80-DD973C58357C}

{95820F84-6E8C-4D22-B2CE-54953E9911BC}

{35EC6E0E-2DF4-4629-9EE3-D525E806B988}

{3AD61E22-E4FE-497F-BDB1-3E51BD872173}

{149DBCE7-A48E-44DB-8364-A53386CD4580}

{E3DACC06-3BC2-4E13-8E59-8E05F3232325}

{A8119E32-B17C-4BD3-8950-7D1853F4B412}

{6E5DB8A5-78E6-4953-B793-7422351AFE88}

{FF02E86C-FEF0-4063-B39F-74275CDDD7C3}

{46D2C0BD-F912-4DDC-8E67-B90EADC3F83C}

{26B6A7CE-B174-40AA-A114-316AA56BA9FC}

{B6B47040-B38E-4BE2-BF6A-DABF0C41540A}

{E538D623-C066-433D-A6B7-E0708B1FADF7}

{DFC5A8B0-E9FD-43F7-B4CA-D63F1E749711}

{18C10CE7-C025-4615-993C-2E0C32F38EFA}

{8DED1DA3-5206-4540-A862-E8473B65D742}

{58E55634-63D9-434A-8B16-ADE5F84737B8}

{BACD4614-5BEF-4A5E-BAFC-DE4C788037A2}

{0BC1DAE4-6158-4A1C-A893-807665B934B2}

{65C607D5-E542-4F09-AD0B-40D6A88B2702}

{4CB3D290-D527-45C2-B079-26842762FDD3}

{881D148A-610E-4F0A-8985-3BE4C0DB2B09}

{6AE65B85-E04E-4368-80A7-786D5766325E}

{2030A84D-D6C7-4968-8CEC-CF4737ACC337}

{2F756D47-E1B1-4D2A-922B-4D76F35D007D}

{C5A706AC-9733-4061-8242-28EB639F1B29}

{090506FC-50F8-4C00-B8C7-91982A2A7C99}

{D98FA85C-4FD0-40D4-895C-6CC11DF2899F}

{436366DE-5579-4F24-96DB-3893E4400030}

{66C66DB4-55EA-427B-90A8-B850B2B87FD0}

{F680A57C-24C4-4FDD-80A3-778877F63D0A}

{83AC4DD9-1B93-40ED-AA55-EDE25BB6AF38}

{04388DC4-ABCA-4924-B238-AC4273F8F74B}

{D8CACE59-33D2-4AC7-9B1B-9B72339C51C8}

{23B672DA-A456-4860-A8F3-E062A501D7E8}

{6D47BDDA-2331-4956-A1D6-E57889F326AB}

{6FAC4EBC-930E-4DF5-AAAE-9FF5A36A7C99}

{5A670809-0983-4C2D-8AAD-D3C2C5B7D5D1}

{2DCD3F0B-AAFB-48D7-9F5F-01E14160AC43}

{EC9D9265-9D1E-4ED0-838A-CDC20F2551A1}

{50059979-AC6F-4458-9E79-710BCB41721A}

{338E5858-1E3A-4ACD-900E-7DBEF543BB9B}

{8BF9E61F-3905-4E9B-99C4-1C3946C1FCA7}

{34EBB57F-0773-4DF5-8EBD-BF55D194DC69}

{5AAB8561-1686-43F7-9FF5-2C861DA58D17}

{D545CCF1-CF46-41D0-8D55-D3E8B03CDB64}

{B444EF2B-340F-4E88-9E32-FCB747EE5D04}

{E66E9AA9-D6CE-43DA-8A34-EF62ECDAE720}

{A9F645A1-0D6A-4978-926A-ABCB363B72A6}

{FBBC4AAB-247A-43DB-8CE6-69ABE89A82E5}

{E5101C42-817D-432D-9783-8C03134A51C2}

{17A89B14-4244-4B97-BF6B-76D586CF91D0}

{F32D1284-0792-49DA-9AC6-DEB2BC9C80B6}

{E48D4EBB-FD30-43B2-BE87-0EB2335EC2C9}

{D70B1BBA-B893-4544-96E2-B7A318091C33}

{9B4060C9-A7F5-4A66-B732-FAF248B7240F}

{EB264A11-A2EE-4740-8AC2-3751C8859374}

{2A3D3010-CDAB-4F07-8BF2-0E3639BC6B98}

{4E26CAC1-E15A-4467-9069-CB47B67FE191}

{70A633E5-AB58-487A-B077-E410B30C5EA4}

{7A0560C5-21ED-4518-AD41-B7F870B9FD1A}

{54FF28C4-56AD-4168-AB75-7207F98DE5EB}

{12367CA7-3B7D-44FD-8765-02469CA5004E}

{D64EDC00-7453-4301-8428-197343FAFB16}

{39A1BE8C-9E7F-4A75-81F4-21CFAC7CBECB}

{D20B83AB-A959-4FA3-9C28-82C14D74285A}

{4031E9F3-E451-4E18-BEDD-91CAA3690C91}

{AE1310F8-2F53-4994-93A3-C61502E91D04}

{2B456DC8-145A-4D2D-9C72-703D1CD8C50E}

{13104647-EE01-4016-AFAF-BBA564215D6E}

{2CB19A15-BAB2-4FCB-ACEE-4BDE5BE207A5}

{2F72340C-B555-418D-8B46-355944FE66B8}

{539165C6-09E3-4F4B-9C29-EEC86FDF545F}

{330A4ACE-9CC1-4AF5-8D36-8D0681194618}

{CA5B3EEA-C055-4ACF-BC78-187DB21C7DB5}

{2A9E12E5-48A2-497C-98D3-BE7170D86B13}

{0F42F316-00B1-48C5-ADA4-2F52B5720AD0}

{067DABCC-B31D-4350-96A6-4FCAD79CFBB7}

{AEEDF8F7-8832-41B1-A9C8-13F2991A371C}

{4F414197-0FC2-4C01-B68A-86CBB9AC254C}

{82F502B5-B0B0-4349-BD2C-C560DF85B248}

{829B8110-0E6F-4349-BCA4-42803577788D}

{16728639-A9AB-4994-B6D8-F81051E69833}

{053D3F49-B913-4B33-935E-F930DECD8709}

{594E9433-6492-434D-BFCE-4014F55D3909}

{B480F090-28FE-4A67-8885-62322037A0CD}

{58D95B09-6AF6-453D-A976-8EF0AE0316B1}

{5DF83BED-7E8E-4A28-80EF-D8B0A004CF3E}

{75F08E14-5CF5-4D59-9CEF-DA3194B6FD24}

{587BECE0-14F5-4039-AA1F-7CFCE036FCCC}

{6185F4C9-522C-4808-8508-946D28CEA707}

{E9F0B3FC-962F-4944-AD06-05C10B6BCD5E}

{DA7DDABC-3FBE-4447-9E01-6AB7440B4CD4}

{82E6B314-2A62-4E51-9220-61358DD230E6}

{CBBACA45-556A-4416-AD03-BDA598EAA7C8}

{431058F0-C059-44C5-B9E7-ED2DD46B6789}

{60AFA663-984D-47A6-AC9C-00346FF5E8F0}

{84832881-46EF-4124-8ABC-EB493CDCF78E}

{70D9CEB6-6DFA-4DA4-B413-18C1C3C76E2E}

{6C1BED1D-0273-4045-90D2-E0836F3C380B}

{596BF8EC-7CAB-4A98-83AE-459DB70D24E4}

{26B394D7-7AD7-4AAB-8FCC-6EA678395A91}

{5829FD99-2B17-4BE4-9814-381145E49019}

{339A5901-9BDE-4F48-A88D-D048A42B54B1}

{AA64F755-8A7B-4519-BC32-CAB66DEB92CB}

{DE52BD50-9564-4ADC-8FCB-A345C17F84F9}

{C8CE6ADC-EDE7-4CE2-8E7B-C49F462AB8C3}

{E1FEF7E5-6886-458C-8E45-7C1E9DAAB00C}

{D450596F-894D-49E0-966A-FD39ED4C4C64}

{C47456E3-265D-47B6-8CA0-C30ABBD0CA36}

{AD96EEE1-FD16-4D77-8A5A-91B0C9A2369A}

{6CB2AFA8-FFFF-49FE-91CF-5FFBB0C9FD2B}

{6BB0FF35-9392-4635-B209-642C331CF1EE}

{6E0C1D99-C72E-4968-BCB7-AB79E03E201E}

{FBD9E09F-6B81-4FFB-97EF-E8919A0C9E06}

{041A06CB-C5B8-4772-809F-416D03D16654}

{FCC1757B-5D5F-486A-87CF-C4D6DEDB6032}

{971CD368-F2E1-49C1-AEDD-330909CE18B6}

{17C5A0EB-24EE-4EB3-91B6-6D9F9CB1ACF6}

{418D2B9F-B491-4D7F-84F1-49E27CC66597}

{BDB32189-C636-46CD-A011-FFB834B552D9}

{E7851824-6844-4D85-ABE7-7CA026FB3314}

{83E04EE1-FA8D-436D-8994-D31A862CAB77}

{03CA3B9A-0869-4749-8988-3CBC9D9F51BB}

{9103F3CE-1084-447A-827E-D6097F68C895}

{2395220C-BE32-4E64-81F2-6D0BDDB03EB1}

{C7D96193-844A-44BD-93D0-76E4B785248E}

{4A31C291-3A12-4C64-B8AB-CD79212BE45E}

{6CE96173-4198-49FC-9924-CC8EEC1A7285}

{DEDFA23D-6ED1-45A6-85DC-63CAE0546DE6}

{0ED94AAC-2234-4309-BA29-74BDBB887083}

{D4639CC7-7B3A-4AC6-99C4-B0AF9ACE7B27}

{4B2E77A0-8321-42A0-B36D-66A2CDB27AF4}

{6C44E4BD-C6DB-474A-877E-1BB899ACA206}

{79EEBE53-530A-4869-B56B-B4FFE0A1B831}

{D0C2BC53-DB5F-4A9E-84AC-17C8862C27DA}

{3846A94F-3005-401E-B663-AF1CF99813D5}

{A56A3B37-3A35-4BBB-A036-EEE5F1898EEE}

{27B162B5-F5D2-40E9-8AF3-D42FF4572BD4}

{402DFB6D-631E-4A3F-9A5A-BE753BFD84C5}

{5821EC16-77A9-4404-99C8-2756DC6D4C3C}

{ED967494-A18E-41A9-ABB8-9030C51BA685}

{2DFE2075-2D04-4E43-816A-EB60BBB77574}

{1F7413CF-88D2-4F49-A283-E4D757D179DF}

{A17F9ED0-C3D4-4873-B3B8-D7E049B459EC}

{6BF301C1-B94A-43E9-BA31-D494598C47FB}

{295B2C03-4B1C-4221-B292-1411F468BD02}

{B234ABE3-0857-4F9C-B05A-4DC314F85557}

{0594DC12-8444-4912-936A-747CA742DBDB}

{C5A7B998-FAE7-4F08-9802-9A2216F1EC2B}

{1B170697-99F8-4B3C-861D-FBDBE5303A8A}

{2F632ABD-D62A-46C8-BF95-70186096F1ED}

{980F9E3E-F5A8-41C8-8596-61404ADDF677}

{CEED49FA-52AD-4C90-B7D4-926ECDFD7F52}

{2E5F5521-6EFA-4E29-804D-993C1D1D7406}

{AD310F32-BD8D-40AD-A882-BC7FCBAD5259}

{15265EDE-4272-4B92-9D47-EF584858D0AE}

{C76DBCBC-D71B-4F45-B5B3-B7494CB4E23E}

{AA2A7821-1827-4C2C-8F1D-4513A34DDA97}

{44151C2D-C398-471F-946F-7660542E3369}

{361FE620-64F4-41B5-BA77-84F8E079B1F7}

{1D1C6879-39A3-47A5-9A6D-ACEEFA6A289D}

{5B45E2C1-3D5A-4C24-AD16-B26499F64FC2}

{6285E8B3-2D05-4954-BF85-65159DEEB966}

{60F6C5C4-96C1-4FFB-9719-388276C61605}

{CACAA1BF-DA53-4C3B-9700-11738EF1C2A5}

{E52D2A85-80E5-435B-882F-8884792D8ABF}

{BB11BADF-D8AA-470E-9311-20EAF80FE5CC}

{C3000759-551F-4F4A-BCAC-A4B42CBF1DE2}

SkypeServiceBypassRetail

fb_SkypeServiceBypassRetail

dKernel32.dll

Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced

failed to copy string '%s' to buffer of size %Iu

Failed to copy string '%S' to buffer.

OrapiCachedKey Expired call

Failure returned attempting to open cached key

KeyPath

Requested key path is too long

Failed to find a cached key anywhere in the chain?

Failed to create key with read-only access

Failed to open key with read-only access

OrapiWriteFail: CacheKey in WriteValue

AllowConsecutiveSlashesInUrlPathComponent

CipherKeyBits

PasswordSpinCount

NewKeyOnPwdChange

DisableWinHttpCertAuth

HttpLogWriterEndpoint

hXXp://127.0.0.1:13556/

MsoHttpVerbose

Keywords

TransportNetworkBackoff

WinHttpSecureProtocols

Windows

Windows NT

WindowsUpdate

Windows Error Reporting

mso.dll

00000000-0000-0000-0000-000000000000

ykernel32.dll

.corp.microsoft.com

sppc.dll

sppcext.dll

Determining Windows version

IsWindows8OrGreater

IsWindows8OrLater

IsWindows7

Trying to load SPP based on Windows version

{A2E714DE-1AB8-4D98-8C47-51003DAB4D3A}

ETW_Keywords

HAX Http Request

Xl Keyboard Input

Word Keyboard Input

Url Liblet

Project XCMD

Assert Reporting

Datapoint Reporting

Visio Text Operations Handler

Csi Web Service Requests

Nexus Transport

OfficeTelemetry_HTTPTransport

OfficeTelemetry_TelemetryTransport

Outllib_Default_Keyword

OneNote.Storage.Cache

OneNote.LegacyLog

OneNote.Storage.Replication

OneNote.Optimization

OneNote.Storage.Backup

OneNote.Storage.ObjectSpaceStoreCell

OneNote.Canvas.Print

OneNote.Ocr

OneNote.Storage.Presence

OneNote.Canvas.EmbeddedFiles

OneNote.Capture.LaunchScreenClip

OneNote.System.WindowEvents

OneNote.Canvas.Editors

OneNote.System.LaunchViaArguments

OneNote.Canvas.Ink

OneNote.Canvas.Image

OneNote.NotebookManager

OneNote.Navigation

OneNote.Capture.QuickNotes

OneNote.Capture.ClickNote

OneNote.Canvas.NoteTag

OneNote.Canvas.Audio

OneNote.Canvas.Text

OneNote.Canvas.Math

OneNote.Canvas.Undo

OneNote.PageAnalysis

OneNote.Whiteboard

OneNote.System.BootDialogs

OneNote.System.Resume

Rpc_Default_Keyword

AcceleratorKeys_Default_Keyword

OutlookAddressWell_Default_Keyword

OutlookGlobal_Default_Keyword

OutlookGlobal_LeakReport

Mapi_OWinHTTP

Mapi_Transport

Mapi_NetworkCallReporter

Outlmime_Default_Keyword

Outlph_Default_Keyword

Rpc_HTTPTransport

Rpc_HTTPClient

HxCalendarAppImmSystemEvents_WindowsPushNotification

HxCalendarAppImmSystemEvents_WindowsBackgroundTask

HxMailXaml_WebView

HxPeopleGlobal_Default_Keyword

Microsoft_Office_Word_KeyboardInput

WebServiceApi

Identity Http Client

HxMailXaml_Default_Keyword

HxSharedServiceApi_HttpSocketResponseLevel

HxSharedServiceApi_HttpSockets

HxSharedServiceApi_WebSockets

OfficeFastModel_Default_Keyword

MsoLegacyDebugSupport

HxSharedServiceApi_HttpRequests

Identity_Default_Keyword

HxCalendarLocalStorage_StorageAccessHelper

HxCalendarLocalStorage_HxsDraftProvider

IdentityShipAssert

WordWebScalingView

Proofing - Spelling not Supported

Calendar_Default_Keyword

Emsmdb_Default_Keyword

Css_Default_Keyword

Mapi_Default_Keyword

InetProtocols_Default_Keyword

Ost_Default_Keyword

Network_Default_Keyword

Pstprx_Default_Keyword

Pst_Default_Keyword

Search_Default_Keyword

OneNote.TestAutomation

Microsoft_Office_Word2_WebScalingView

OneNote.System.LiveTiles

Edp_Default_Keyword

Outllib_WebExt

PPT Keyboard Input

OneNote.Accessibility

OfficeTelemetryTest_Keyword2

OfficeTelemetryTest_Keyword1

OfficeTelemetryTest_Keyword4

OfficeTelemetryTest_Keyword3

OfficeTelemetryTest_Keyword5

SharePointWorkspace_HTTPStatus

OneNote.License

OneNote.DemoMode

OneNote.Storage.EnterpriseDataProtection

OneNote.System.AboveLock

OneNote.System.AppContract

OneNote.Storage

Microsoft Access File operations telemetry

OneNote.First Run

OEP Rich API Pipeline

OneNote.Storage.WindowsPhoneUpgrade

OneNote.Ribbon

OneNote.Navigation.QuickFiling

OneNote.System.Input

OneNote.Canvas.IFrame

OneNote.WhatsNew

OneNote.Canvas.Tools

OneNote.LiveSearch

OneNote.FontService

CocoaUI.CocoaUIDocumentShell

Identity Authenticated URL

PCX.ContactCard.Tab

PCX.ContactCard.Flyout

PCX.ContactCard.Hyperlink

PCX.ContactCard.Button

PCX.ContactCard.State

PCX.ContactCard.Edit

Advertisement Campaign Reporting

Keychainaccess

OLEO.trace

http.request

vba.generic

CocoaUI.TaskPane.iOS

CocoaUI.TaskPane

CocoaUI.RibbonButton

CocoaUI.ThemePreferences

OneNote.Experiments

OneNote.PagePreviews

OneNote.WatchKitExtension

OneNote.Notifications

OneNote.WordNLVUpsell

OneNote.Canvas.Render

OneNote.NotebookManagement

OneNote.Referrals

OneNote.URLPageCreation

OneNote.SearchManager

outlook.accounts

outlook.account.identity

outlook.build

outlook.app.navigation

outlook.categories

outlook.calendar

outlook.cocoa.appleevent

outlook.clutter

outlook.cocoa.dldetection

outlook.cocoa.cdhxhelper

outlook.cocoa.folderlistjump

outlook.cocoa.domnode

outlook.cocoa.views

outlook.cocoa.onlinemeeting

outlook.database

outlook.olkcore.dbrecordcache

outlook.database.messagequeue

outlook.database.checkandfix

outlook.database.spotlight.index

outlook.database.notifications

outlook.dataprovider.changenotification

outlook.database.recordvalidation

outlook.dataprovider.rebuild

outlook.dataprovider.fileio

outlook.dataprovider.sql

outlook.dataprovider.recovery

outlook.device.metadata

outlook.dataprovider.transaction

outlook.exchange.delegation

outlook.account.exchange.addaccount.config

outlook.exchange.ews.response.codes

outlook.exchange.ews

outlook.exchange.oab

outlook.exchange.ews.response.errors

outlook.exchange.outofoffice

outlook.exchange.openotherusersfolder

outlook.export

outlook.exchange.syncmap

outlook.account.imap

outlook.fullscreen

outlook.account.ldap

outlook.import

outlook.mail.antispam

outlook.mail

outlook.mail.outbox

outlook.mail.attachment

outlook.network

outlook.misc

outlook.onlinearchive

outlook.network.connectioncache

outlook.account.pop

outlook.performance

outlook.process

outlook.powerplant

outlook.selection

outlook.rules

outlook.statetracker

outlook.spotlight.search

outlook.tasks

outlook.sync

outlook.test.automation

outlook.test

outlook.toolkit.fileutils

outlook.threading

outlook.cocoa.events.userinteraction

outlook.database.upgrade

outlook.weather

outlook.uti

outlook.focusedinbox

outlook.assert

outlook.txp

outlook.contactsupport

OneNote.Indexer

outlook.authentication

OneNote.Canvas.TodoList

OneNote.Authentication

OneNote.App

OneNote.AllNotes

OneNote.AppFeedback

OneNote.TodayExtension

OneNote.ShareExtension

Excel Keyboard Shortcut

OneNote.PadMultitasking

OneNote.Storage.Fishbowl

OneNote.Canvas.Schema

OneNote.Storage.Merge

OneNote.System.AppLifeCycle

OneNote.Storage.CellStorage

OneNote.Storage.RealTime

OneNote.ShareCharm

OneNote.Capture.UI

OneNote.Legacy.ShipLog

OneNote.Canvas.Input

OneDrive Client Transport

PCX.PeopleSearch.PickerAutoComplete

PCX.Persona.Photo

Exchange Web Services

PCX.PeopleSearch.Algorithm

Graph Import Desktop UI

PCX.IM.Utils

OneNote.Storage.CreateNotebook

OneNote.SharePane

OneNote.Testimonials

OneNote.TextYourself

OneNote.UserInfoService

PCX.MailTip.SuggestedRecipients

PCX.MailTip

UnitTest.Test

Outllib_KeyboardNavigation

Outllib2_Default_Keyword

UrlMon

HockeyApp

OneNote.MisplacedSections

OneNote.UserSurvey

OneNote.Background.BackgroundFetch

OneNote.ClassNotebook

OneNote.Tutorial

Publishing Office documents to Docs.com

Document Activity Capture, Transport, and Retrieval

LibletGraphimport

@mention support

outlook.protocols.rest

outlook.shadowmailbox

outlook.modernattachments

outlook.oauth

outlook.shadowauth

outlook.flags

outlook.modernconversations

Canvas execution rules telemetry

API executor

Web dialog canvas

PCX.PCXPeopleFavorite

OneNote.PushNotifications

OneNote.MathPane

OneNote.SharePane.Xaml

OneNote.Agaves

OneNote.Extensibility

OneNote.InkAnalyzer

App integration of Document Activity Capture, Transport, and Retrieval

OfficeExecutionContext_Fallback

PCX.Groups

Url Reputation Liblet

_Rules.xml

OTele_ETW_RuleProcessing_ReadMetadataKeywordsFailed

Microsoft.Office.Telemetry.EnableABMetadata

Passthrough

hXXp://msdn.microsoft.com/en-us/library/windows/desktop/ms753129(v=vs.85).aspx

Line=%d Position=%d

Hourly

Error processing Operator type

Error processing UnaryOperator type

Operator

UnaryOperator

OTele_ETW_NexusTransport_RuleRetrieveEnd

OTele_ETW_NexusTransport_RuleRetrievedSize

OTele_RulesService_UnknownHttpResponse

Http stream should not be empty.

Http Status

RulesXmlDir key set

The rules xml vector passed to WriteRulesToDisk is empty

k%u.%u.%u.%u

EMicrosoft.Office.RuleResults

Keyword/Level pair is not enabled.

%d_%d

Payload%u

OpportunisticProcessingLevelInBytes

hXXp://VVV.w3.org/2000/09/xmldsig#

CNG Create Hash Error: 0xx, HashAlg: %s, HMAC Salt: %u bytes

CNG Algorithm Creation Error: 0xx, %S: %s, Flags: %u

3DES TWO KEY

CNG Context Search Error: 0xx, Context: %s, %S: %s

WDTCD.LOG

pACTCD.LOG

XLTCD.LOG

OLTCD.LOG

PPTCD.LOG

SDTCD.LOG

wPJTCD.LOG

VSTCD.LOG

PBTCD.LOG

IPTCD.LOG

POWRPROF.DLL

Feedback pipe (SQM/CEIP) enabled?

%S (%#x)

%s_%d.%d.%d.%d_%s_%s%s

HMSWHEEL_ROLLMSG

WM_MSOEXECUTECMD

D%s%s

Microsoft.Office.Experimentation.Registry

Microsoft.Office.Experimentation.TasPersistentStore.

Microsoft.Office.Experimentation.SendUserIdToEcs

Microsoft.Office.Experimentation.UserIdMappingRegistry

Microsoft.Office.Experimentation.UsePlainTextUserId

Microsoft.Office.Experimentation.Audience.Current

Microsoft.Office.Experimentation.RDXAudience

Microsoft.Office.

Microsoft.Office.Experiment.PollingDuration

Microsoft.Office.Experimentation.UseEcsIntUrl

hXXps://config.edge.skype.net/config/v1/Office/0.0.0.0?

hXXps://config.edge.skype.com/config/v1/Office/0.0.0.0?

Microsoft.Office.Experimentation.EnableEcsHoldout

Microsoft.Office.Experimentation.SendChannelInformation

Microsoft.Office.Experimentation.SendRolloutGroupInformation

hXXps://ocos-office365-s2s.msedge.net/ab?

Microsoft.Office.Experimentation.TasValidatorInt

Microsoft.Office.Experimentation.TasValidatorBool

Microsoft.Office.Experimentation.TasValidatorMicrosoftScope

Microsoft.Office.Experimentation.TasValidatorEBrake

Microsoft.Office.Experimentation.TasValidatorWString

Microsoft.Office.Experimentation.TasValidatorAutomation

Microsoft.Office.Experimentation.AutomationValidator

Microsoft.Office.Experimentation.ValidatorInt

Microsoft.Office.Experimentation.ValidatorBool

Microsoft.Office.Experimentation.EBrakeValidator

Microsoft.Office.Experimentation.MicrosoftScopeValidator

Microsoft.Office.TrustCenter.Experimentation

Microsoft.Office.Experimentation.ExecuteTasksOnIdleQueue

Microsoft.Office.Experimentation.DisableNetworkReq

Microsoft.Office.Experimentation.TasEnabled

Microsoft.Office.Experimentation.ConfigsFetchRefactoring

Microsoft.Office.Experimentation.EnterpriseChannel

ShouldExecuteRequest is returning NetworkDisallowedError because network use is not permitted.

ShouldExecuteRequest is returning NetworkDisallowedError because the network is high cost.

ShouldExecuteRequest is returning NetworkDisallowedError due to lack of network connectivity.

Microsoft.Office.Experimentation.CheckConnectivity

NotSupported

UnsupportedAuthScheme

ClientCertificateRequired

Failed to open http request.

Failed to create HTTP request context.

wzUrl

Failed to create HTTP request settings.

Failed to create http request.

Failed to initialize HTTP request context.

Only Edge, Ecs, or Tas flights write supported

Microsoft.Office.Experimentation.Audience.Dogfood

r3e9515db-340e-42f1-a08d-192c405f522a,66536430-4e10-4d95-bbb9-2245181341bf

Microsoft.Office.Experimentation.RandomizationSalt

JMicrosoft.Office.Experimentation.TasPersistentStore

Microsoft.Office.Experimentation.RolloutGroup

Microsoft.Office.Experimentation.RolloutGroupPercentage

Microsoft.Office.Experimentation.ServerSideRolloutGroupPartition

.Team

Microsoft.Office.Experimentation.TasPollingDuration

hXXps://client-office365-tas.msedge.net/ab?

Microsoft.Office.Experimentation.TasEndpoint

ORegistryKey.GetValue failure: Cannot get registry %s value %s

ORegistryKey.Open failure: The length of subkey %s is longer than the maximum length allowed

HrGetPackageVersionToReport failed

^/(?:pr|sg|db)/([0-9a-z]{8}-[0-9a-z]{4}-[0-9a-z]{4}-[0-9a-z]{4}-[0-9a-z]{12})/office/data/(?:16\.0\.\d{4}.\d{4})/stream.x(?:86|64).x-none.dat$

ORegistryKey.GetValue failure: Cannot get value. The

registry key is closed or not set

ORegistryKey.Open failure: Parent key is NULL

SOFTWARE\Microsoft\Office\ClickToRun\UpdateSupport\ExpiredBuild

StreamPackageUrl

Unable to create MsoUrl from stream package URL.

RCannot get stream package URL.

Cannot extract FFN from a stream package URL.

CDNBaseUrl

2C508370-A266-4CFC-8877-AF06FDEB0C24

834504CC-DC55-4C6D-9E71-E024D0253F6D

EA4A4090-DE26-49D7-93C1-91BFF9E53FC3

pF3260CF1-A92C-4C75-B02E-D64C0A86A968

5462EEE5-1E97-495B-9370-853CD873BB07

B61285DD-D9F7-41F2-9757-8F61CBA4E9C8

C4A7726F-06EA-48E2-A13A-9D78849EB706

CBC7891E-9126-44DE-8A56-2BD6D2E06C48

5440FD1F-7ECB-4221-8110-145EFAA6372F

64256AFE-F5D9-4F86-8936-8840A6A4F5BE

B8F9B850-328D-4355-9145-C59439A0C4CF

9A3B7FF2-58ED-40FD-ADD5-1E5158059D1C

F4F024C8-D611-4748-A7E0-02B6E754C0FE

E404F044-0870-4935-8B00-1F59A813F7D6

492350F6-3A01-4F97-B9C0-C7C6DDF67D60

7FFBC6BF-BC32-4F92-8982-F9DD17FD3114

AppVEntSubsystems32.dll

AppVEntSubsystems64.dll

C2R32.dll

C2R64.dll

URLPOLICY_CREDENTIALS_MUST_PROMPT_USER

URLPOLICY_CREDENTIALS_CONDITIONAL_PROMPT

URLPOLICY_CREDENTIALS_ANONYMOUS_ONLY

URLZONE_LOCAL_MACHINE

URLPOLICY_CREDENTIALS_SILENT_LOGON_OK

AllowAutoLogon: CredUsePolicy for %s is %s

AllowAutoLogon: %s is in %s

URLZONE_INTRANET

URLZONE_TRUSTED

URLZONE_INTERNET

URLZONE_UNTRUSTED

AllowAutoLogon is called for %s

Unexpected failure in Mso::Url::AllowAutoLogon

https

webcal

rlogin

webcals

.mhtml

Mso::Http[%s]: calling WinHttpReadData

Mso::Http[%s]: ReadComplete with %u bytes read

Mso::Http[%s]: Read is finished

Mso::Http[%s]: calling WinHttpQueryDataAvailable

[GZipEncodingHandler] AddHeaderIfSupported

Received PASSPORT auth scheme - ignoring

[HttpUtil] ChooseAuthScheme

[HttpUtil] GetRequestIdFromSettings

[HttpUtil] IsKnownProxyError

HttpResult

WindowsAutoLogonLevel

HasPassword

SupportedSchemes

WinHttp handle is null

[HttpWin] CreateAndValidateMsoUrl

Failure due to invalid HTTP URL.

Failure due to invalid absolute URL.

Setting WINHTTP_OPTION_CLIENT_CERT_CONTEXT on the WinHttp request handle failed.

[HttpWin] getResponseHeader

[HttpWin] sendInternal

Sending request for Url.

[HttpWin] DisableClientCertContext

[HttpWin] CHttpRequest_WinHttp

HttpWin sendInternal: MsoRewindStream failed

WinHttpWriteData failed

[HttpWin] sendInternal: request already aborted

[HttpWin] sendInternal: request already sent

[HttpWin] sendInternal: request not open

WinHttpSendRequest failed

Request for Url is sent.

An error occurred while querying for the Server Certification Context.

Failed to send WinHttp request.

WinHttpReceiveResponse failed

[HttpWin] processRequestSettings

[HttpWin] authScheme

WinHttpQueryAuthSchemes returned.

CHttpRequest_WinHttp::authScheme: Logging failure

[HttpWin] statusText

Valid url is expected for pre-auth

Setting AutoLogonLevel on the WinHttp request handle.

WinHttpSetOption failed to set WINHTTP_OPTION_SECURITY_FLAGS

HttpWin set ignore SSL cert warning.

HttpWin Failed to set autologon level

HttpWin failed to set WINHTTP_OPTION_CLIENT_CERT_CONTEXT

CHttpRequestContext_WinHttp::initializeContext

CHttpRequestContext_WinHttp::initializeNewRequest

[HttpWin] preauthenticateRequest

Setting certificate.

HttpWin Failed to add LiveId auth header

HttpWin Failed to add ADAL token

Authenticating with name/password.

Mso::Http::Details::ResourceUsageNetworkMonitorTemplate<class Mso::Http::Details::NetworkUsageProductionBase>::ReportEndOfResponse

Mso::Http::Details::ResourceUsageNetworkMonitorTemplate<class Mso::Http::Details::NetworkUsageProductionBase>::ReportResponseReceived

HttpWin Failed to add Cookie header

Invalid/missing entries (i.e. username, password)

The authentication operation was canceled

User must change some account setting (i.e. password)

The identity has not been validated by a successful HTTP request

Server certificate is invalid.

Server certificate is not trusted.

ADFS retryable config error. This error is retryable by collecting and sending in password

[HttpWin_Async] open

Http open request.

[HttpWin_Async] sendInternal: request already aborted

[HttpWin_Async] sendInternal: helper already set

[HttpWin_Async] sendInternal

[HttpWin_Async] statusText

[HttpWin_Async] getResponseHeader

[HttpWin_Async] sendInternal: null context

[HttpWin_Async] sendInternal: request already sent

[HttpWin_Async] sendInternal: request not open

[HttpWin_Async] ProcessResponseTimeoutSetting

[HttpWin_Async] authScheme

[HttpWin_Async] processRequestSettings

Setting WINHTTP_OPTION_DISABLE_FEATURE |= WINHTTP_DISABLE_COOKIES on the WinHttp request handle.

Mso::Http[%s]: received WINHTTP_CALLBACK_STATUS_WRITE_COMPLETE

Mso::Http[%s]: received WINHTTP_CALLBACK_STATUS_SENDREQUEST_COMPLETE

Mso::Http[%s]: received WINHTTP_CALLBACK_STATUS_HEADERS_AVAILABLE

Mso::Http[%s]: received WINHTTP_CALLBACK_STATUS_DATA_AVAILABLE

[HttpWin_Async] abort

CHttpRequest_WinHttp_Async::WinHttpCallbackStatic

HINTERNET passed to WinHttp callback does not match HINTERNET stored on IRequest

[HttpWin_Async] WinHttpCallback

Mso::Http[%s]: received WINHTTP_CALLBACK_STATUS_REQUEST_ERROR with no WINHTTP_ASYNC_RESULT

Mso::Http[%s]: received WINHTTP_CALLBACK_STATUS_HANDLE_CLOSING

[HttpWin_Async] WinHttpCallback: handle is being closed without aborting

Mso::Http[%s]: received WINHTTP_CALLBACK_STATUS_READ_COMPLETE

Mso::Http[%s]: received WINHTTP_CALLBACK_STATUS_SECURE_FAILURE

Mso::Http[%s]: received WINHTTP_CALLBACK_STATUS_REQUEST_ERROR: result: %u; error: %u

Got a ERROR_WINHTTP_RESEND_REQUEST - Resending the request now

Mso::Http[%s]: received WINHTTP_CALLBACK_STATUS_CONNECTING_TO_SERVER

Mso::Http[%s]: received WINHTTP_CALLBACK_STATUS_REDIRECT

[CHttpRequest_WinHttp_Async] AdvanceProxy

Received a relative redirect URL and could not appropriately resolve it.

LError: failed to create http request settings.

ATrouble with initialization of http context

Mso::Http[%s]: calling WinHttpSendRequest

Mso::Http[%s]: SendRequestHelper::WriteStream: Calling WinHttpWriteData with %u bytes (%u bytes already written)

Mso::Http[%s]: SendRequestHelper::WriteStream: No data to write

Mso::Http[%s]: calling WinHttpReceiveResponse

Error: Failed to send request for Url.

%s/16.0 (Windows NT %d.%d; %s 16.0.%d; %s)

(%u.%u.%u) Windows NT %u.%u

%s 2014%s

WCould not create CWinHttpProxyHandler

[CWinHttpHelperBase] InitializeComm

[CWinHttpHelperBase] SetWinHttpSecureProtocols

Error: CreateRequest failed in WinHttpOpenRequest.

Error: CreateRequest failed in WinHttpSetStatusCallback.

[CWinHttpHelperBase] NewProxySetAndShouldRetry

Error: InitConnection failed in WinHttpConnect.

[CWinHttpHelperBase] InitConnection

[CWinHttpHelperBase] CreateRequest

ProxyBypass

[CWinHttpHelperBase] AutomaticProxyConfiguration

InitSession detected proxy, and auto config URL.

Proxies were returned from WinHttpGetProxyForUrl.

Error: Failed in WinHttpOpen with no proxy.

[CWinHttpHelperBase] OpenWinhttpSessionWithoutProxy

[CWinHttpHelperBase] SetNamedProxyServerOption

InitSession detected named proxy, and bypass.

Error: InitSession failed in WinHttpOpen with named proxy.

InitSession detected proxy option named proxy, and bypass.

Failed to split the proxies returned by WinHttpGetProxyForUrl into the proxy list!

The proxy list was cached using the given proxy string from WinHttpGetProxyForUrl.

[CWinHttpHelperBase] InitSession

[CWinHttpProxyHandler] InitProxyList

[CWinHttpProxyHandler] FindAndSetcurrentProxy

[CWinHttpProxyHandler] FindAndSetNextProxy

[CWinHttpProxyHandler] NewProxySetAndShouldRetry

CWinHttpProxyHandler

[CWinHttpSessionManager] WinHttpOpen

[CWinHttpSessionManager] WinHttpClose

MwsStats.PrivateWorkingSet

wsStats.TotalWorkingSet

wsStats.VirtualSet

wsStats.WorkingSetPeak

MContent.MSO

#$%&%&'(

@office.odf

%s_%s

application/vnd.ms-nexus-telemetrydata-v3 bond

NShouldExecuteRequest is returning false because payload size is greater than limit.

ShouldExecuteRequest is returning false because active number of outstanding request has exceeded the limit.

Request satisfies all criteria to be executed.

application/vnd.ms-nexus-rules-v12 xml

msoNexusTransport: Exception while getting nexus transport client

ShouldExecuteRequest is returning false due to lack of network connectivity.

ShouldExecuteRequest is returning false because network use is not permitted.

ShouldExecuteRequest is returning false because the network is high cost.

hXXps://nexus.officeapps.live.com

hXXps://nexusrules.officeapps.live.com

NredirectionUrl

originalUrl

httpCode

Failed to create HTTP request.

Failed to open HTTP request.

application/vnd.ms-nexus-uls-v1

application/vnd.ms-nexus-telemetrydata-v2 binary

msgr8imm.dll

msth8imm.dll

mssp7imm.lex

mssp3ko.lex

MSOINTLIMM.DLL

msointlandroid.dll

MSOINTL30_ANDROID.dll

MSOIMM.DLL

mscss7imm.dll

MSOINTL30_WINRT.DLL

mshy7imm.dll

mshy7imm.lex

msgr8imm.lex

msth8imm.lex

mso.acl

xlsrvintlandroid.dll

RICHEDIM.DLL

SEQCHK10IMM.DLL

mssp7imm.dll

officeandroid.odf

msoresandroid.dll

msproof7imm.dll

MsoIdCliM.dll

TellMeRuntimeImm.dll

MsPtlsImm.dll

CSIIMM.DLL

OParseProductCode failed for %s

{610F491D-BE5F-4ED1-A0F7-759D40C7622E}

{86573C72-9908-4334-9CC0-0A39C4B58833}

Call to GetPackageVersionToReport failed.

GetPackageVersionToReport did not return an expected package version.

Invalid GUID string: %s

SOFTWARE\Microsoft\Windows\Windows Error Reporting

SOFTWARE\Microsoft\Windows\CurrentVersion\WindowsUpdate

WindowsErrorReportingMachineId

WindowsSqmMachineId

%d.%d

Failed to set fields on OperatingSystemStateProvider.

OperatingSystemStateProvider triggered.

OperatingSystemStateProvider triggered with no data.

IsJoinedToDomain

Windows OS Version not set.

RuleResultPacket reports invalid column.

Null byte pointer passed to PayloadBuilder::GetUTF8String

Invalid type passed to GetUTF8String

OTeleMediumCost.dat

OTeleCritical.dat

OTele.dat

{*} (*) - *

Windows Version not set.

Given FieldType is not supported on Rule Results.

Stream operation failed.

@Call to ITelemetryTransport::SubmitPayload failed.

TryParseConfig failed because at least one of required regkey is empty or 0.

MsoGetRemoteHostNetworkStatusWithUrlType failed

OTele_ETW_NexusTransport_PayloadSendStart

OTele_ETW_NexusTransport_PayloadSendEnd

TelemetryTransport::ProcessRuleResultPayload failure.

%s is %s (TrustStatus:%d)

%s is not signed by Microsoft (TrustStatus:%d)

Warning: %s is not signed.

Error: %s is not trusted. Error=0x%x

%s is signed. Trusted By Microsoft

%s is signed. Trusted By Machine

Failed to retrieve SeessionId for processId=%d.

%s\%s

Error: Deadlock: Thread %d is waiting for itself to exit

Failed to get the exit code for finished thread, error = %d.

OSmartPointer cannot apply operator '->' to an empty object pointer

failed to open file '%s'

Cannot set file %s attbutes to %u

failed to delete file %s

CreateDirectory failed for directory: %s

Error: %s HResult: %s. %s

Error: %s Type: %d::%S. %s

Error: %s ErrorCode: %d(0x%x). %s

Error: Type: %s. %S ErrorCode: %d(0x%x). %s

{'OSVersion':'%d.%d','SP':'%d','ProductType:'%d','ProcessorArch':'%d','Locale':'%d'}

{'ModulePath':'%s','CommandLine':'%s','Bitness':'%d','IntegrityLevel':'0x%x','SecuritySessionId':'%d','ExeVer':'%s','ProcessType':'%s'}

OException caught {'Error':'%s'}

OException caught in call to IsElevated {'Error':'%s'}

%d|%s

Settings::TryGetValue: Not a valid Setting Type (%d) for the Store %s

ORegistryKey.GetValue failure: Cannot get the binary value "%s" in registry key %s.

ORegistryKey.CreateSubKey failure: The length of the specified subkey is too long

ORegistryKey.CreateSubKey failure: The RegistryKey on which this method is being invoked is closed

ORegistryKey.CreateSubKey failure: Empty key name string.

QPipelineServerName

ProductKeys

BackgroundTransportMethodDefault

BackgroundTransportMethodFailures

UpdateUrl

ORegistryKey.GetValue failure: Cannot get DWORD value. The registry key is closed or not set

APersistenceStore::Persist: Not a valid setting for the Store %s

PersistenceStore::TryGetValue: Not a valid setting for the Store %s

AORegistryKey.SetValue failure: Cannot set DWORD name "%s" value "%i" in registry key %s

ORegistryKey.SetValue failure: Cannot set DWORD value. value name is too long

ORegistryKey.SetValue failure: Cannot set DWORD value. The registry key is closed or not set

ORegistryKey.SetValue failure: Cannot set "%s" string. The registry key is closed or not set

ORegistryKey.SetValue failure: Cannot set "%s" string into registry key %s. The value name is too long

ORegistryKey.SetValue failure: Cannot set "%s" string name "%s" value "%s" into registry key %s.

%s.%s

Settings::PersistSetting: (%s) is not valid for Setting Type (%d)

Settings::PersistSetting: Not a valid Setting Type (%d) for the Store %s

(%s) is not valid for Setting Type (%d) from Store (%s)

Setting Type (%d) is not valid for Store (%s)

PCabManager::IsReachable %s not reachable

CabManager::Extract: Cab not found %s

CabManager::Extract: Extracting %s -> %s

Cab not found %s

Downloaded the experiment cab {'cabName':'%s'}

Failed to reach the experiment cab. Fell back {'cabName':'%s'}

Not a valid version %s

CabManager::DetermineCabName: Type:%d, Platform:%s, Version:%s, Culture:%s -> %s

CabManager::GetCabPrefix: Unknown CabType %d

.hash

Extraction Failed {'File':'%s'}

hash.txt

.hash file is not found. Was expecting %s

CabErrorDetection::Validate: .hash file not found for "%s". Was expecting %s

PRID %s maps to Deferred with priority %s

New Best Channel found - PRID %s maps to channel %s with priority %s

UpdateChannels::GetDefaultChannelUrl returned invalid data.

PRID %s maps to channel %s with priority %s

PRID %s maps to %s with priority %s

PRID %s maps to Current with priority %s

/pr/39168d7e-077b-48e7-872c-b232c3e72675

BitfieldValues contained an unexpected channelId value {'BitfieldValues':'%s','ChannelIdValue':'%d'}

RGetGroupPolicyValue: Got %s setting from policy.

Software\Policies\Microsoft\Office\%d.%d\Common\OfficeUpdate

stream.%s.%s

Copy failed. Last error : %d

FileTransport::DoLoadFile

Bytes read (%d) != Bytes to read (%d)

Failed to read file. Exception: %s

FileTransport::DoConnect

Failed to open file. Exception: %s

Failed to read %d bytes from %s. Number of bytes read = %d

Transport: Not a valid address: %s.

WBitsTransport::DoLoadFile: Failed to load the file.

Bits download job returned false. Source address %s

BitsTransport::DoLoadFile: Wrong format for Source Address.

Bits download job error. Source address %s

Bits download job error. Source Address format is not expected. Source address %s

BitsTransport::DoLoadFile

OSmartPointer cannot apply operator '*' to an empty object pointer

Opening Http %s request

bytes=%d-%d

HttpTransport::CreateHttpRequest

Failed to create Http Request

Failed to create Http Request : {'Result':'%s'}

CheckReachable via Http %s request failed

HttpTransport::CheckReachable

Sending Http %s request

Getting Http GET request status

HttpTransport::DoConnect: Create Http request settings

HttpTransport::ReadRangeProc: Getting response stream

HttpTransport::DoConnect: Creating Http request context

HttpTransport::DoConnect: Initializing request context

{'X-CID':'%s'}

ClickToRun Http Transport

Http %s request failed

HttpTransport::DoBeginLoadRange

Opening Http GET request

Sending Http GET Range request

Failed to Read the response stream: 0x%x.

Create Http request settings

HttpTransport::ReadRangeProc

HttpTransport::DoEndLoadRange - Request is cancelled

Http request cancelled

HttpTransport::EndLoadRange: Invalid loadRangeAsyncResult

HttpTransport::DoEndLoadRange - Request is being cancelled.

Http GET Range request failed: Status = %d

Http GET Range request failed

Http GET Range request failed. Unexpected response received.

Sending Http GET request

Http GET request failed: Status = %d

Http GET request failed to set user agent: %s

HttpTransport::DoLoadFile

HttpTransport::CancelLoadRange

HttpTransport::CancelLoadRange - Empty loadRangeAsyncResult.

Didn't find directory %s. Ensured it. %s

Getting Http GET response blob

Got response blob {'Expected':'%d','Actual':'%d','Match':'%d'

Http GET request failed

%s. Error: %s (0x%x)

failed to create security descriptor from string %s, error = %d

QHttpTransportLoadRangeCancelEvent

Failed to create event %s

Invalid TransportRetry: no available transport

Download failed {'SourcePath':'%s','Attempt':'%d'}

TransportRetry::ExecuteDownloadFile

Download failed for current transport {'SourcePath':'%s','Attempt':'%d','Size':'%u','MD5Hash':'%s'}

ClickToRun.TransportRetry.ExecuteDownloadFile

Download succeeded {'SourcePath':'%s','DestinationPath':'%s','Attempt':'%d'}

hXXp://officecdn.microsoft.com/pr

hXXp://officecdn.microsoft.com/sg

hXXp://officecdn.microsoft.com/db

ATransport::LoadFile: Not Connected.

[F] Move "%s" -> "%s"

[F] Move to backup "%s"

RobustFileOps::MoveFileToBackup: Moving existing file "%s" to backup path "%s": Attempt %d of %d.

RobustFileOps::MoveFileToBackup: MoveFileEx failed to move existing file "%s" to backup path "%s": LastError: %d

RobustFileOps::EnsureDirectoryForFile: Creating directory at "%s".

RobustFileOps::MoveFileToBackup: Shutdown event set, abandoning MoveFileEx of existing file "%s" to backup path "%s".

[D] Ensure "%s"

RobustFileOps::DoFileOp: %s: Attempt %d of %d.

RobustFileOps::DoFileOp: %s failed: LastError: %d

RobustFileOps::DoFileOp: Shutdown event set, abandoning FileOp %s.

RobustFileOps::DoFileOp: %s is moving to the same destination as the previous %s, is this expected?

RobustFileOps::MoveFileToBackup: FAILED! MoveFileEx failed to move existing file "%s" to backup path "%s". All %d of %d attempts exhausted!

RobustFileOps::DoFileOp: %s

RobustFileOps::MoveFileToBackup: File at fileToMoveToBackupPath "%s" no longer exists; no need to move it to a backup location.

RobustFileOps::MoveFileToBackup: Shutdown event set, abandoning MoveFileEx of existing file "%s" to backup path "%s" (after failure)

RobustFileOps::RollbackFiles: Rolling back %d file operations.

RobustFileOps::RollbackFiles: ROLLBACK of %s.

RobustFileOps::DoFileOp: %s failed

RobustFileOps::DoFileOp: FileOp %s succeeded

RobustFileOps::DoFileOp: %s is trying to delete a file from the previous %s, disallowing the delete!

RobustFileOps::DoFileOp: %s FAILED! All %d of %d attempts exhausted!

RobustFileOps::DoFileOp: Shutdown event set, abandoning %s (after failure)

backupDirPath is required for FileOpType::MoveFileToBackup operations, for %s.

RobustFileOps::DeleteFiles: Failed to delete "%s"! Ignoring failure.

RobustFileOps::MoveFiles: Applying %d file operations.

RobustFileOps::DeleteFiles: Deleting "%s".

RobustFileOps::DeleteFiles: Failed to delete "%s"! Marking file to be deleted at next reboot.

RobustFileOps::RollbackFiles: FAILED ROLLBACK of %s!

RobustFileOps::DeleteFiles: Deleting %d files, markFilesThatFailToDeleteAsDeleteOnReboot=%d.

RobustFileOps::RollbackFiles: Unexpected FileOp type %s, continuing.

RobustFileOps::RollbackFiles: FAILED ROLLBACK of Empty Dir removal for "%s"!

RobustFileOps::MoveFiles: Done with %d backup files, result=%d.

RobustFileOps::MoveFiles: Done applying %d file operations, result=%d.

RobustFileOps::MoveFiles: %d backup files were created.

RobustFileOps::MoveFiles: Not deleting backup files, as backupFileDeleteType is %d.

RobustFileOps::AddFilesToFileOpsForDirectoryMove: No further subdirectories found under "%s".

RobustFileOps::AddFilesToFileOpsForDirectoryMove: Found %d subdirectories under "%s".

RobustFileOps::AddFilesToFileOpsForDirectoryMove: Added Empty Dir creation at "%s".

RobustFileOps::AddFilesToFileOpsForDirectoryMove: Skipping move from "%s" to "%s".

RobustFileOps::AddFilesToFileOpsForDirectoryMove: Added move from "%s" to "%s".

RobustFileOps::AddFilesToFileOpsForDirectoryMove: Adding files in "%s", total file ops so far=%d.

RobustFileOps::AddFilesToFileOpsForDirectoryMove: Found %d files to add in "%s".

RobustFileOps::RemoveDirectory: Errors encountered while cleaning install directory: %s

RobustFileOps::RemoveDirectory: Exception caught: %s

RobustFileOps::RemoveDirectory: GetFilesRecursive failed with exception: %s

RobustFileOps::MoveDirectoryFiles : No source directory found at "%s".

RobustFileOps::AddFilesToFileOpsForDirectoryMove: Done adding files in "%s", total file ops so far=%d.

RobustFileOps::MoveDirectoryFiles : Destination directory not found at "%s", attempting to create it.

RobustFileOps::RemoveDirectory: Removed install directory: %s

Q.hashid

.pseudo

UrlOrPathSettingValidator::Validate

Invalid Url or Path : %s

Not an Http source

OHttp does not implement range downloads

configuration.xml

PIDKEY

cdnbaseurl

baseurl

SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Uninstall\%s

hXXp://o15.officeredir.microsoft.com/r/rlidC2RRemovalTool?clid=

SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\%s

updatebaseurl

pidkeys

flt.prefsxs

Exception occured %d

BaseCommandLine::TryGetCommandLine: Adding %s as a Sku

BaseCommandLine::TryGetCommandLine: Adding %s as an unchanged Sku

BaseCommandLine::TryGetCommandLine: No config file. Using default values for bootstrapper: %s

%s.%d_%s

%s=%s

%s %s

hXXp://officecdn.microsoft.com/pr/39168D7E-077B-48E7-872C-B232C3E72675

BootstrapperContext::GetRepairableProducts: Removing Product :'%s' during online repair as client is not SxS

%lu-%d (%lu)

%s %s%s%d=%s

%s%s%d=%s

%s %s=%s

RInvalid VersionedString: %s

Microsoft.Office.Click2Run.

OException in getting opt-in preference for '%s'. Silently ignoring this.

Exception in getting flight data for '%s'. Silently ignoring this.

OException in getting flight data for '%s'. Silently ignoring this.

Exception in getting flight overrides for '%s'. Silently ignoring this.

OException in getting flight overrides for '%s'. Silently ignoring this.

{'flightData':'%s','userIsUsingSxS':'%d','userPrefersSxSClient':'%d','userOnSxSClient':'%d','useExperimentalCab':'%d'}

Exception in getting opt-in preference for '%s'. Silently ignoring this.

ClientCapabilities.json

{'flightIdentifier':'%s','overrideValue':'%s','flightData':'%s','returnValue':'%s'}

TrySetUserRegistry::TrySetAttemptGetKey

OException has occured %s. Continuing bootstrapper.

TrySetUserRegistry::TrySetAttemptGetKey: Setting Attempt Get Key for %s

Failed to parse command line: %s

TrySetUserRegistry::HandleStateAction: Unable to write out the Token or Key appropriately.

TrySetUserRegistry::HandleStateAction: Unable to set AttemptGetKey for bootstrapper.

Failed to set read property for: %s

No key or token found for %s

Token found. {'OlsToken':'0x%s'}

TrySetUserRegistry::TrySetLicenseTokenOrKey

Based on size, key was found.

TrySetUserRegistry::TrySetLicenseTokenOrKey: Key or Token was found for %s

Failed to set AttemptGetKey for: %s

Failed to parse the command line succesfully: %s

HandleCommandLineAction::HandleStateAction: Start installation with configuration file: %s

%s_x-none

HandleCommandLineAction::HandleStateAction: Invalid Admin command. Command: %s

DownloadOffice::DownloadPackages: Getting Office for culture: %s

v%s.cab

MRO::DetermineVersionToUse triggered for {'TriggerSource':'ODT','Scenario':'Download'} returns %s

DownloadOffice::DownloadPackages: Getting Office in directory: %s

DownloadOffice::DownloadPackages: Override download path from %s to %s

DownloadOffice::DownloadPackages: Succesfully downloaded .dat file

Hash check skipped for version %s

Failed on hashcheck of %s

Failed to download %s

File is missing: %s

Exception throw when downloading %s,Retry:%d,BufferSize:%d,LastError:%x

std::bad_alloc throw when downloading %s,Retry:%d,BufferSize:%d

Oexception throw when downloading %s,Retry:%d,BufferSize:%d

DownloadOffice::DownloadFile: Downloading file %s

CDNBaseUrl is not empty, so setting propertyBag[PB_CDN_BASE_URL] to %s

Starting CDNBaseUrl is %s

BaseUrl is not empty, using value of %s

InstallationConfigure::HandleStateAction: Using recovery data from property bag: %s

InstallationConfigure::HandleStateAction: Using recovery data: %s

BaseConfigure::TryGetConfiguration: Setting product keys.

Ignoring client culture request as it is not known to be a full-product culture. {'Culture':'%s'}

AdminConfigure::HandleStateAction Do not have a valid installation and attempting to do a remove operation.

BypassPromptUserToContinueOrQuit::HandleStateAction

Failed determine if prereqs have passed or not.

{'ErrorUrl':'%s','ErrorCode':'%d','ErrorSource':'%s'}

{'ErrorUrl':'%s','ErrorCode':'%d','ErrorSource':'%d'}

Failure has occured with unknown action: %d

Determined version to install {'VersionToInstall':'%s'}

TryGetVersionDescriptor::HandleStateAction: Getting Cab: %s

MRO::DetermineVersionToUse triggered for {'TriggerSource':'%s','Scenario':'%s'} returns %s

TryGetClient::HandleStateAction: Getting Client Cabs: %s

Failed to download and extract the client cab: %s

TryGetClient::HandleStateAction: Installation path is: %s

TryConfigureUninstallClient::HandleStateAction: removing: %s

TryConfigureUninstallClient::HandleStateAction: Platform to be removed: %s

Failed to build command line. command: %s parameters: %s

Failed to open configuration key

Got configuration key

TryLaunchClient::HandleStateAction: Launching %s with parameters: %s

Preparing to launch client. {'ProductInfoAdding':'%s','ProductInfoRemoving':'%s','BranchID':'%d'}

TryConfigureUninstallClient::HandleStateAction There is no client found at %s.

Failed to find the C2R Client {'CommandLine':'%s'}

Upgrade completed as expected : %d

C2R client returned failing error code %d

Upgrade failed with error code %d

scenario=removeinstallation displaylevel=%s

TryCheckNetworkCost::HandleStateAction: Failed to initialize NetworkCostManager for %s. Assuming low cost and proceeding.

ConfigureUpdatesSettings::HandleStateAction: Installation path is: %s

Removed O15 product due to client doesn't support SxS. Removed product:%s

DisplayUpgradeAddRemovePrompt::HandleStateAction: User has following installed: %s

DisplayUpgradeAddRemovePrompt::DetermineUninstallationSkuMappings: Looking at: %s comparing to: %s

DisplayUpgradeAddRemovePrompt::DetermineUninstallationSkuMappings: Unable to match %s

DisplayUpgradeAddRemovePrompt::DetermineUninstallationSkuMappings: %s does not match %s

DisplayUpgradeAddRemovePrompt::DetermineUninstallationSkuMappings: Mapping succesful. %s is in set contained by HomeStudentRetail

DisplayUpgradeAddRemovePrompt::DetermineUninstallationSkuMappings: Mapping succesful. %s is in set contained by HomeBusinessRetail

DisplayUpgradeAddRemovePrompt::DetermineUninstallationSkuMappings: Mapping succesful. %s is in set contained by O365HomePremRetail or ProfessionalRetail

DisplayUpgradeAddRemovePrompt::DetermineUninstallationSkuMappings: Mapping succesful. %s is in set contained by O365SmallBusPremRetail

DisplayUpgradeAddRemovePrompt::DetermineUninstallationSkuMappings: Mapping succesful. %s is in set contained by O365ProPlusRetail or ProPlusRetail

Unable to get display names for all the PRIDs. Outliers : [%s]

C2R Service is running with unexpected command line - '%s'. Expected clientPath - '%s'. Expected client15Path - '%s'

Not updating client because client culture is not known to be a full-product culture. {'Culture':'%s'}

RestorePreviousService::HandleStateAction: Attempt to restore previous service. Previous client located here: %s

Machine State {'fatalInconsistencyDetected' : '%d', 'currentClientExists' : '%d', 'o15ClientExists' : '%d', 'fireFlyClientExists' : '%d', 'nextState' : '%lu', 'noServiceIsRunning' : '%d', 'o16ServiceIsInstalled' : '%d'}

MonitoredScope::ExecuteUnderStopWatch

%s.Approximate duration : %d milliseconds.

A%s.%d

Got handle to existing mutex %s

Mutex '%s' already created

Failed to create the mutex %s: LastError: 0x%x

SETUP %s [path to configuration file]

SETUP %s [path to configuration file] %s

SETUP %s

Args::GetNextArgument: Next argument: %s

Property Bag value from Signature : '%s' is SAME as value from Resource String : '%s' ; for ModulePath : '%s'

Args::GetConfigFile: config file: %s

%s %s

Args::Load: Setting baseurl to: %s

Args::Load: Have scenario: %s

Property Bag value from Signature : '%s' is DIFFERENT as value from Resource String : '%s' ; for ModulePath : '%s'

CryptMsgGetParam to get CMSG_SIGNER_UNAUTH_ATTR_PARAM size, failed with Error.

Args::Load: Invalid commands passed in for admin scenario: %s

Args::Load: product release id: %s culture: %s

hXXps://

CryptMsgGetParam to get CMSG_SIGNER_AUTH_ATTR_PARAM information object, failed with Error.

CryptMsgGetParam to get CMSG_SIGNER_AUTH_ATTR_PARAM size, failed with Error.

CryptMsgUpdate , failed with Error.

CryptMsgOpenToDecode , failed with Error.

CryptMsgGetParam to get PCRYPT_ATTRIBUTES information object, failed with Error.

Encountered continuable prereq failure {'error':'%d'}

windowsversion

Prereq::ShowPrereqFailure: A Prereq check has failed. %s

Exception has occured.Exiting bootstrapper

OException has occured %s.Exiting bootstrapper.

hXXp://go.microsoft.com/fwlink/?LinkId=%d

C2RWindowUtil::LoadUIString: string ID %d not found.

{1280039B-E673-41f9-A9ED-F0548E91C02B}

GetHeaderTextFont: height is %d pixels.

GetSmallTextFont: height is %d pixels.

GetTextFont: height is %d pixels.

Failed to copy file src: %s, dest: %s

\StringFileInfo\xx\FileVersion

Failed to schedule delete file %s. Error Code: 0x%x.

OCOMInterface cannot apply operator '->' to NULL interface pointer

Failed to check free space in drive "%s"

Software\Microsoft\Windows\CurrentVersion\Policies\System

GetFiles: search path %s does not exist

GetDirectories: search path %s does not exist

OREgistryKey.SubKeyCount failure: Cannot get sub key count. The registry key is closed or not set

ORegistryKey.DeleteSubKeyTree failure: Cannot delete Registry Key %s\%s.

ORegistryKey.DeleteSubKeyTree failure: The subkey name "%s" is too long

ORegistryKey.DeleteSubKeyTree failure: Empty key path

ORegistryKey.ValueCount failure: Cannot get value count for registry key %s

ORegistryKey.ValueCount failure: Cannot get value count. The registry key is closed or not set

OREgistryKey.SubKeyCount failure: Cannot get sub key count for registry key %s

ORegistryKey.GetValueNames failure: Cannot get all value names for registry %s

ORegistryKey.GetValueNames failure: Cannot get all value names. The registry is closed or not set

ORegistryKey.GetSubKeyNames failure: Cannot get all sub key names for registry %s

ORegistryKey.GetSubKeyNames failure: Cannot get all sub key names. The registry is closed or not set

ORegistryKey.DeleteValue failure: The registry key is closed or not set

ORegistryKey.SetValue failure: Cannot set binary "%s" reg value %s.

ORegistryKey.SetValue failure: Cannot set binary into registry key %s. The value name is too long

ORegistryKey.SetValue failure: Registry key is not initialized

Failed to convert the blob to hex string, empty blob passed

Path passed in is too long.

_-%\.[]{}`~!@#$^&() =,;

Failed to get path root %s, driveNumber=%d

_-%[]{}`~!@#$^&() =,;

TGetStatus called for an invalid state %d

While downloading %s to %s

Unable to obtain BITS job state: error code: 0x%x

Initialization failed 0x%x

Unexpected error while enumerating BITS job, 0x%x

Download file operation cancelled

%s. %s

BITS connection error: %s

Operation Cancelled

Starting %s %s

Failed to start process for file: %s arguments: %s

Failed to runas admin for file: %s arguments: %s

ShellExec: %s %s admin=%d

sftldr_wow64.dll

sftldr.dll

xxxxxxxxxxxxxxxx

Failed to connect the url

Failed to set the passport option

Crack URL failed

Failed to Open Win Http session

OHttp::SendRequest: Http Send request failed, trying proxy index %d.

OHttp::SendRequest: Http Send request failed

OHttp::SendRequest: WinHttp request resend count exceeded limits

WinHttp request resend is required

OHttp::DownloadRangesEx, not enough data

OHttp::DownloadRanges, not enough data

Range: bytes=%d-%d

OHttp::ReadRequestData: cancelled

Unexpected status code received for Http Send request

OHttp::SendRequest: Http Receive request failed, trying proxy index %d.

OHttp::SendRequest: Http Receive request failed

WinHttpReceiveResponse failed, error=%d

OHttp::SendRequest: Failed to set authentication scheme

Header %d not available in the request: LastError: 0x%x

WinHttpQueryDataAvailable: failed Http Request has no data: Last error: 0xx

Passport is not supported by the server

Unsupported IP Family

GetAddrInfoW failed on server %s with error %d

CoCreateInstance failed with HRESULT=0xx

TSOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall

WindowsInstaller

SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Uninstall

OService::StartService - Failed to Start Service : ret = %d : errCode = %d

OService::Open - Open service %s failed %d

OService::TryStopDependents - Warning: Failed to stop dependent service '%S'

OService::TryStopDependents - Stopping dependent service '%S'

OService::TryStopDependents - Warning: failed to enumerate dependent services : errCode = %d

OService::StopServiceRecursive - Failed to control service : errCode = %d

failed to create service '%s'

OService::Install - CreateService failed %d

failed to delete service '%s'

7971f918-a847-4430-9279-4a52d1efe18d

Failed to load XML document %s, HRESULT=0xx

%s not found

XML node %s is not found

selectSingleNode failed for %s

SelectNodes: %s called for OXmlNode with null interface

T http session not initialized

Reporting configuration of non-default log writers.

L%s-ddd-dd%s.log

d/d/d d:d:d.d

USent sync request to Http.

Failed to send sync request to Http.

Sent async request to Http.

Failed to send async request to Http.

Uapplication/vnd.ms-ots-uls-v1

Failed to load client capabilities: %S

BO15Client::StopOfficeService: Service %s running. Need to stop it.

Service stopped. {'ServiceName':'%s', 'TimeToStopService':'%d'}

O15Client::StopOfficeService: Unable to stop service %s. WaitHint:%d, LastError:%d

{'TimeToStopService':'%d', 'TimeToFinishShuttingDown':'%d', 'LastError':'%d'}

Service unable to be stopped. {'ServiceName':'%s','CurrentState':'%d'}

O15Client::StartOfficeService: Unable to open service. {'ServiceName':'%s'}

O15Client::StopOfficeService: Unable to open service. {'ServiceName':'%s'}

O15Client::IsInstalled: O15 client version: "%s"

O15 client version failed to parse; ignoring and continuing. {'O15ClientVersion':'%s'}

O15Client::IsFireflyInstalled: O15 client version: "%s"

O15 firefly client version failed to parse; ignoring and continuing. {'O15ClientVersion':'%s'}

O15Client::StartOfficeService: Service %s is not running. Need to start it.

Service started. {'ServiceName':'%s', 'TimeToStartService':'%d'}

O15Client::StartOfficeService: Unable to start service %s. WaitHint:%d, LastError:%d

{'TimeToStartService':'%d', 'TimeToFinishStartingUp':'%d', 'LastError':'%d'}

Service unable to be started. {'ServiceName':'%s','CurrentState':'%d'}

Unable to open service. {'ServiceName':'%s'}

O15Client::IsFireflyInstalled: is firefly installed: %d

O15Client::RemoveOfficeService: '%s' is not installed. Continuing.

O15Client::RemoveOfficeService: Ensure service '%s' is shut down and removed.

Service removal failed. {'ServiceName':'%s'}

"%s" /service

Binary path cannot be set {'ServiceName':'%s'}

Service cannot open {'ServiceName':'%s'}

O15Client::RestoreOfficeService - %s previous service re-installed, starting the service.

Service removal completed successfully. {'ServiceName':'%s'}

O15Client::IsServiceRestoreRequired: RestorePreviousService:'%d' PreviousClientPath:'%s' PreviousServiceName:'%s'

Service cannot start {'ServiceName':'%s'}

Removal state {'RemovalComplete':'%s','ElapsedTime':'%d', 'LastError':'%d'}

O15Client::IsSubscriptionOrFreemiumPrid: Added %s to AcidList for %s

O15Client::IsSubscriptionOrFreemiumPrid: Found acid %s

O15Client::IsSubscriptionOrFreemiumPrid: Acid %s is grace

O15Client::IsSubscriptionOrFreemiumPrid: Acid %s is not subscription, freemium or grace

O15Client::GetInstalledPackages - found package %s.

O15Client::GetProductEquivalents - ignoring %s.

O15Client::GetProductEquivalents - Adding subscription/freemium product %s.

O15Client::GetProductEquivalents - unchanged perpetual product %s.

O15Client::GetConfigurationSetting: Read property %s: Value %s Out of: %s

O15Client::GetConfigurationSetting: Unable to read property %s: Out of: %s

hXXp://officecdn.microsoft.com/pr/39168d7e-077b-48e7-872c-b232c3e72675

Looking for O15 version at {'url':'%s'}

Got version cab {'basePath':'%s','availableBuild':'%s'}

Failed to download cab {'basePath':'%s}

Descriptor::Load: Reading Available value from descriptor: %s

Failed to parse VersionDescriptor.xml.

Descriptor::Load: Failed to parse VersionDescriptor.xml.

Descriptor::Load: Reading Bootstrapper value from descriptor: %s

Configuration::InitializeDefaults: Base URL is %s

Repair recovery data detected, so using BaseUrl %s as the CDNBaseUrl too.

Default PRID is %s. Reconciled CDNBaseUrl is %s

Configuration::InitializeDefaults: Adjusted base url for local source: %s

Not using OEM or local source. Using reconciled CDNBaseUrl '%s' and Tax Origin '%s' to initialize BaseUrl to %s

Configuration::Load: Using config file: %s

Configuration::Load: Failed while trying to load data out of %s

Configuration::Load: Setting culture to: %s

Configuration::FShouldCheckOemSource: Found PRID match: %s

Configuration::FShouldCheckOemSource: Looking for branding: %s

Calculated Channel ID based on product list is: %s

Configuration::AdjustBaseUrlForLocalSource: Found the version cab at: %s

Configuration::AdjustBaseUrlForLocalSource: Removing %s

Configuration::AdjustBaseUrlForLocalSource: Could not find version cab ending in a folder with Office\Data: %s

%CommonProgramW6432%

%CommonProgramFiles%

Configuration::GetClientFolder - Unknown Installation Type (%d)

Found OEM source registry keys. Redirecting base url. {'BaseURL':'%s'}

Configuration::AdjustBaseUrlForOEMSource

Reconciled Channel ID based on product list vs. existing CDNBaseUrl is: %s

Version was invalid, ignoring {'Version':'%s'}

No Channel assigned from config XML, so using CDNBaseUrl based product calculation: %s

Configuration::GetSourceType: Base Url %s is of type DVD or USB

UpdateSupport

{'Branch':'%s','CurInstBld':'%s','AvailBld':'%s','LKG':'%s','MROThroVal':'%d','MachineThroVal':'%d','CurBldExp':'%i', 'CurBldFnd':'%i', 'AvailBldExp':'%i','AvailBldFnd':'%i','LKGFnd':'%i','VerToUse':'%s','success':'%s'}

Current build %s is not reachable, clear current installed build

Available build %s in MRO cab is not reachable.

LKG build %s in MRO cab is not reachable.

%s.xml

ar-sa.pseudo

ja-jp.pseudo

OException has occured %s. Continuing...

ThrottleValue::ResetUpdatesThrottleValue: rand_s failed, not resetting throttle value from previous value of %d for major version %u.

ThrottleValue::ResetUpdatesThrottleValue: new throttle value: %u, old throttle value: %u.

IsNativeValidator::CheckPreReq: returning: %d.

OException has occured %s. Failing test

BootstrapperValidator::CheckPreReq: Version of bootstrapper too low to install with: Have: %s Need: %s

BootstrapperValidator::CheckPreReq: returning: %d.

O15BetaValidator::CheckPreReq: Currently installed version: %s

O15BetaValidator::CheckPreReq: Current build is newer than Beta build. Prereq check passes.

SXSValidator::CheckPreReq: Has preexisting 64bit products: %s.

SXSValidator::CheckPreReq: Has preexisting 32bit products: %s.

SXSValidator::CheckPreReq: Cross bitness test passed.

{'BlockingApp': '%s', 'Bitness' : '%s'}

OException has occured %s. Using default value

O15BetaValidator::GetErrorMessageBodyParam: returning: %s.

32 Bit Windows detected.

O15BetaValidator::CheckPreReq: No Office 15 installation detected. Prereq check passes.

O15BetaValidator::CheckPreReq: returning: %d.

ILanguage value used: %d

Blocking apps: %s

Outlook key not found.

Unknown platform type: %s.

MSIxC2RBlockValidator::CheckPreReq: returning: %d.

OException has occured %s.

Exception has occured %s.

Software\Microsoft\Office\Outlook\Addins\Microsoft.BusinessSolutions.eCRM.OutlookAddIn.Connect.5

%s %s %s

PartnerAppValidator::GetErrorMessageBodyParam Unexpected PrereqFailureType: %d

%s\Profiles\%s\%s

ProfileValueKey not found.

guid vector '%s' size: %d

guidKeyPath '%s'

PartnerAppValidator::LoadUIString: string ID %d not found.

shared_ptr cannot apply operator '->' to an empty object pointer

AORegistryKey.GetValue failure: Cannot get String value. The registry key is closed or not set

ConfigFile::ParseAddNode: No source path specified. Using default value: %s

ConfigFile::ParseAddNode: ForceDowngrade: %s

ConfigFile::ParseAddNode: ForceUpgrade: %s

OfficeMgmtCOM: %s

Branch [alias to channel]: %s

Channel: %s

ConfigFile::ParseAttribute: Value of %s: %s

Invalid Branch name specified in configuration: %s

Illegal app specified for exclude %s

%s.%s.%d

Has has unknown C2R Client platform installed: %s

Has has unknown Firefly platform installed: %s.

Failed to convert ACID: %s to SLID

Failed to get attribute %s

'Office needs a newer version of Windows

We're sorry, we couldn't install your Office product because you don't have a modern Windows operating system.

You need Microsoft Windows 7 (or newer) to install this product.

Please save the file you used to start this installation to a place you can find easily. Then use Windows Explorer to view that location and try installing Office again.

We found a problem!kWe're sorry, Office does not work with Windows 8 Consumer Preview.

You need the full version of Windows 8.

&Close3%s

<a href="%s">Go online for additional help.</a>

Invalid product %s specified.

Important: Once we

We hit an issue trying to uninstall your previous Office version./<a href="%s">Go online for additional help.</a>'hXXp://support.microsoft.com/kb/2739501 Save your work before continuing$We need to close the following apps:

We're sorry, Office (64-bit) couldn't be installed because your computer does not support 64-bit applications. Please try installing the 32-bit version of Office instead.

We're sorry, Office Click-to-Run installer encountered a problem because you have these Windows Installer based Office programs installed on your computer:

Click-to-Run and Windows Installer editions of Office programs don't get along for this version, so you can only have one type installed at a time. Please try installing the Windows Installer edition of Office instead, or uninstall your other Windows Installer based Office programs and try this installation again.

Microsoft OfficeB%s

Error Code: %s

Client update needed.QWe are sorry, but we could not complete the installation. Please try again later.-hXXp://go.microsoft.com/fwlink/?LinkId=613501

<a href="%s">Learn more</a>\This installation requires a compatible Microsoft Office program installed on your computer.

<a href="%s">Learn why</a>

<a href="%s">Learn why</a>#I understand. I don't want to wait.

%s You may want to contact your mailbox provider or system administrator about this issue.

<a href="%s">Learn why</a>MBusiness Contact Manager will no longer work.

%s You may want to contact your mailbox provider about these issues.

<a href="%s">Learn why</a>2Outlook 2016 is not compatible with Exchange 2007.SOutlook 2016 requires access to the AutoDiscover service for your Exchange service.

16.0.7407.3600

Bootstrapper.exe

OfficeOnDemand.exe

RoamingOffice.exe

{225F8CFE-1B76-48E6-8E75-62CC471AFA28}

hXXp://officeredir.microsoft.com/r/rlidOfficeWebHelp?p1=OCSAC2R%s&ver=15&clid=%d&helpid=%s-%s-%s&app=webview

Failed to create registry key: %d

AdminBootstrapper::Main: OException has occured. Exiting bootstrapper. %s

AdminBootstrapper::Main: Exception has occured %s. Exiting bootstrapper.

%s-ddd-dd%s.log

Xls Keyboard Input

%c%c%c%c

%c%c%c%c%c

%s (%#x)

hXXps://nexus.officeapps.live.com/nexus/upload/

CMicrosoft Office/15.0 (Windows NT %d.%d; %s 15.0.%d; %s)

Passport

Mso::Http[%s]: setting identity '%s'

csi.dll

nMso::Http[%s]: failure due to the following not being an HTTP URL: %s

Mso::Http[%s]: failure due to the following not being an absolute URL: %s

Mso::Http[%s]: opens request method=%s, url=%s

Mso::Http[%s]: Error: failed to create http request settings

Mso::Http[%s]: received response header Id=%s

Mso::Http[%s]: Sending request for url=%s

Mso::Http[%s]: Request for url=%s is sent. Response status=%d

Mso::Http[%s]: Error: Failed to send request for %s, error=0xx

Mso::Http[%s]: Error: The request failed to send, but WinHttp reports OK. Overwriting with InternalError

Mso::Http[%s]: Failed to send winhttp request, probably due to an auth issue

Mso::Http[%s]: received status text of ="%s"

Mso::Http[%s]: setting AutoLogonLevel=%u on the WinHttp request handle

Mso::Http[%s]: WinHttpQueryAuthSchemes returned: 0xx (%s)

Mso::Http[%s]: ChooseAuthScheme returned 0xx (%s)

Mso::Http[%s]: Context: Processing request token, authReason='Any'

Mso::Http[%s]: Context: AutoLogonLevel=%u

Mso::Http[%s]: Context: Processing request token, authReason='%s'

Mso::Http[%s]: Context: Setting certificate

Mso::Http[%s]: Context: Authenticating with LiveId token

Mso::Http[%s]: Context: Authenticating with Sharepoint Cookie

Mso::Http[%s]: Context: Authenticating with ADAL token

, null password

Mso::Http[%s]: Context: Authenticating with name/password, name=%s%s

HttpWin set ignore SSL cert warning

Mso::Http[%s]: Context: Failed to set %s creds

HttpWin Failed to set passport proxy creds

Mso::Authentication::IsADALErrorHandlingFixDisabled: Using manual override registry key, with value: %s

Mso::Authentication::IsADALErrorHandlingFixDisabled: Using config service setting, with value: %s

HttpWin received PASSPORT auth scheme - ignoring

@Mso::Http: Error: Could not get REQUEST_ID from settings

Received HTTP error that might be resolved with proxy failover: %d

Received HTTP error but it isn't considered a proxy error, so not trying proxy failover: %d

DCWinHttpHelperBase::SetWinHttpSecureProtocols failed to set secure protocols option, error %d

CWinHttpHelperBase::InitConnection failed in WinHttpConnect, error %d

CWinHttpHelperBase::CreateRequest failed in WinHttpOpenRequest, error %d

CWinHttpHelperBase::CreateRequest failed in WinHttpSetStatusCallback, error %d

redirect URL and could not appropriately resolve it: hr=0xx

CWinHttpProxyHandler::InitSession detected named proxy %s, bypass %s

CWinHttpProxyHandler::InitSession failed in WinHttpOpen with named proxy, error %d

CWinHttpProxyHandler::InitSession detected no proxy

CWinHttpProxyHandler::InitSession failed in WinHttpOpen with no proxy, error %d

CWinHttpProxyHandler::InitSession detected proxy %s auto config URL %s

CWinHttpProxyHandler::InitSession detected proxy auto detect

CWinHttpProxyHandler::InitSession setting proxy option proxy name %s, bypass %s

CWinHttpProxyHandler::InitSession setting default proxy option

CWinHttpProxyHandler::InitSession setting no proxy option

CWinHttpProxyHandler::InitSession using no proxy (on fallback)

CWinHttpProxyHandler::InitSession caught an unhandled exception

Missing Url when trying to create ProxyMap entry

Failed to create CMsoUrlSimple from given url

Failed to initialize the server url

No proxies were found for the given URL; do not advance, do not retry.

Failed to set the new proxy on WinHttp ProxyOption.

Cannot lookup proxies for an empty url!

Found no proxies for this url. Do not advance to the next proxy. Clear the proxyList.

HINTERNET Session was null, unable to set proxy on WinHttp option

Unable to set the proxy option onto Windows, error %d

Could not find the current-in-use proxy in the proxy list that was mapped for the url. Have proxy settings changed?

0xx

Cannot load system string for error x in language %i

IMM32.DLL

msosync.exe

- Attempt to initialize the CRT more than once.

- CRT not initialized

- floating point support not loaded

WUSER32.DLL

PipelineServerName

software\policies\microsoft\windows\windows error reporting

software\microsoft\windows\windows error reporting

software\policies\windows\microsoft\windows error reporting

software\policies\microsoft\windows\windows error reporting\consent

software\microsoft\windows\windows error reporting\consent

ModulePath||%s,,CommandLine||%s,,Bitness||%d,,IntegrityLevel||0x%x,,SecuritySessionId||%d,,ExeVer||%s

OSVersion||%d.%d,,SP||%d,,ProductType||%d,,ProcessorArch||%d,,Locale||%d

GetMachineID - OException caught: %s.

"%s":"%s"

ErrorCode||%d,,ErrorType||%s,,AppVErrorSource||%s,,ErrorMessage||%s%s

G%s\%s

PersistenceStore::Persist: Not a valid setting for the Store %s

G%s.%s

Settings::PersistSetting - Setting Type (%d) is not valid for Store (%s)

Settings::PersistSetting - (%s) is not valid for Setting Type (%d) from Store (%s)

.hashid

{80C94D2C-4DDE-47AE-82D2-A2ADDE81E653}

{6EE7622C-18D8-4005-9FB7-92DB644A279B}

{360E9813-EA13-4152-B020-B1D0BBF1AC17}

{F7461D52-7C2B-43B2-8744-EA958E0BD09A}

{323277B1-D81D-4329-973E-497F413BC5D0}

{FB4875EC-0C6B-450F-B82B-AB57D8D1677F}

{0900883A-7F90-4A04-831D-69B5881A0C1C}

{CE6A8540-B478-4070-9ECB-2052DD288047}

{FBE35AC1-57A8-4D02-9A23-5F97003C37D3}

{A30B8040-D68A-423F-B0B5-9CE292EA5A8F}

{FF693BF4-0276-4DDB-BB42-74EF1A0C9F4D}

{0EA305CE-B708-4D79-8087-D636AB0F1A4D}

{1B9F11E3-C85C-4E1B-BB29-879AD2C909E3}

{E1F5F599-D875-48CA-93C4-E96C473B29E7}

{DC981C6B-FC8E-420F-AA43-F8F33E5C0923}

{3391E125-F6E4-4B1E-899C-A25E6092D40D}

{FD97BCB1-8F3C-4185-91D2-A2AB7EE278C2}

{EFE1F3E6-AEA2-4144-A208-32AA872B6545}

{A3A4593B-97DC-4364-9910-70202AF2D0B5}

{771C3AFA-50C5-443F-B151-FF2546D863A0}

{A75ADD9F-3982-464D-93FE-7D3BEC07FB46}

{F3A4939A-92A7-47CC-9D05-7C7DB72DD968}

{8C762649-97D1-4953-AD27-B7E2C25B972E}

{A9419E0F-8A3F-4E58-A143-E4B4803F85D2}

{AE7B1E26-3AEE-4FE3-9C5B-88F05E36CD34}

{4A5D124A-E620-44BA-B6FF-658961B33B9A}

{6883893B-9DD9-4943-ACEB-58327AFDC194}

{427A28D1-D17C-4ABF-B717-32C780BA6F07}

{1B686580-9FB1-4B88-BFBA-EAE7C0DA31AD}

{B322DA9C-A2E2-4058-9E4E-F59A6970BD69}

{DB8E8683-A848-473B-B2E7-D1DE4D042095}

{00C79FF1-6850-443D-BF61-71CDE0DE305F}

{BA3E3833-6A7E-445A-89D0-7802A9A68588}

{370155F7-D1EC-4B8B-9FBA-EE8ACC6E0BB7}

{B13AFB38-CD79-4AE5-9F7F-EED058D750CA}

{024EA285-2685-48BC-87EF-79B48CC8C027}

{E13AC10E-75D0-4AFF-A0CD-764982CF541C}

{F97246FA-C8CE-4D41-B6F7-AE718E7891C5}

{AC4EFAF0-F81F-4F61-BDF7-EA32B02AB117}

{92485559-060B-44A7-9FC4-207C7A9BD39C}

{D9F5B1C6-5386-495A-88F9-9AD6B41AC9B3}

wwwbaseurl

reportid

%userprofile%\AppData\Local\Microsoft\Internet Explorer\Downloaded Program Files\Microsoft Office 15

-UNINSTALL_WEBCONTROLS

BootstrapperStateMachine::Run: OException has occured. Exiting bootstrapper. %s

G%lu-%d (%lu)

::LookupAccountNameW failed to retrieve size of account security identifier (systemname=%s, accountname=%s).

::LookupAccountNameW failed to retrieve account security identifier (systemname=%s, accountname=%s).

ORegistryKey.SetValue failure: Cannot set DWORD name "%s" value "%i" in registry key %s

Dexcel.exe

firstrun.exe

groove.exe

infopath.exe

onenote.exe

visio.exe

winwordd.exe

Software\MozillaPlugins\@microsoft.com/Office on Demand;version=1

SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall

TrySetUserRegistry::HandleStateAction: OException has occured. Exiting bootstrapper. %s

TrySetUserRegistry::HandleStateAction: Failed to parse command line: %s

TrySetUserRegistry::TrySetAttemptGetKey: OException has occured. Continuing bootstrapper. %s

TrySetUserRegistry::TrySetAttemptGetKey: Failed to set AttemptGetKey for: %s

TrySetUserRegistry::TrySetLicenseTokenOrKey: Based on size, key was found.

OlsToken||%s

TrySetUserRegistry::TrySetLicenseTokenOrKey: Token found: %s

TrySetUserRegistry::TrySetLicenseTokenOrKey: No key or token found for %s

TrySetUserRegistry::TrySetLicenseTokenOrKey: OException has occured. Continuing bootstrapper. %s

TrySetUserRegistry::TrySetLicenseTokenOrKey: Failed to set read property for: %s

TrySetUserRegistry::GetHashedOLSToken: Failed to compute token hash. %s

TryParseCommandLine::HandleStateAction: Failed to parse the command line succesfully: %s

TryParseCommandLine::HandleStateAction: OException has occured. Exiting bootstrapper. %s

TryParseCommandLine::HandleStateAction: Failed to parse command line: %s

HandleCommandLineAction::HandleStateAction: OException has occured. Exiting bootstrapper. %s

TryGetElevation::HandleStateAction: OException has occured. Exiting bootstrapper. %s

BootStateMachine::ShowHelp: OException has occured. Exiting bootstrapper. %s

DownloadOffice::HandleStateAction: Failed to ensure Log Folder. Exception : %s

DownloadOffice::HandleStateAction: OException has occured. Exiting bootstrapper. %s

DownloadOffice::DownloadPackages: Getting Office lcid: %s

DownloadOffice::DownloadPackages:: Failed to download %s.

PackageOffice::HandleStateAction: OException has occured. Exiting bootstrapper. %s

BaseConfigure::TryGetConfiguration: Failed to ensure Log Folder. Exception : %s

BaseConfigure::TryGetConfiguration: Base Url %s is of type DVD

BaseConfigure::TryGetConfiguration: OException has occured. Exiting bootstrapper. %s

InstallationConfigure::HandleStateAction: OException has occured. Exiting bootstrapper. %s

AdminConfigure::HandleStateAction: OException has occured. Exiting bootstrapper. %s

Local\mutex_%s_%s_%d

OnDemandConfigure::HandleStateAction: Uninstall OOD Webcontrols.

OnDemandConfigure::HandleStateAction: Installing OOD Webcontrols.

OnDemandConfigure::HandleStateAction: OException has occured. Exiting bootstrapper. %s

OnDemandClearCache::HandleStateAction: Failed with OException: %s

OnDemandClearCache::HandleStateAction: Failed with unexpected exception. Last Error: %d

OnDemandClearCache::ClearCache: Roaming cleanup failed, launching might fail: %d

OnDemandClearCache::CacheStateHealthy: OException caught. Last Error: %d. %s

OnDemandClearCache::CacheStateHealthy: std::exception caught: %s Last Error: %d

OnDemandClearCache::CacheStateHealthy: Unknown exception caught while checking cache state: LastError: %d

OnDemandClearCache::Terminate: TerminateRoamingOfficeProcesses: Found: %d - %s.

OnDemandClearCache::Terminate: Terminating %d.

OnDemandClearCache::Terminate: Terminating %d failed.

OnDemandClearCache::Terminate: Terminating %d failed, most likely process is not running any more. %s

OnDemandClearCache::CheckRoamingUserChanged: CheckRoamingUserChanged: New puididentifier=%s is different from existing one %s.

OnDemandUninstallWebControl::HandleStateAction: Uninstlling the web controls and cleaning up.

OnDemandUninstallWebControl::HandleStateAction: Finished uninstall web controls.

%userprofile%

OnDemandUninstallWebControl::HandleStateAction: Delete client files located at: %s

OnDemandUninstallWebControl::HandleStateAction: Delete office files located at: %s

OnDemandUninstallWebControl::HandleStateAction: Unable to delete files.

OnDemandUninstallWebControl::HandleStateAction: OException has occured. Exiting bootstrapper. %s

OnDemandUninstallWebControl::HandleStateAction: Failed to show help to the user.

OnDemandInstallWebControl::HandleStateAction: installing the web controls.

Software\Microsoft\Windows\CurrentVersion\Ext\Settings\%s

Main: PERF: Done setting up roaming webcontrol

OnDemandInstallWebControl::HandleStateAction: OException has occured. Exiting bootstrapper. %s

OnDemandInstallWebControl::HandleStateAction: Failed to show help to the user.

RunPrereqs::HandleStateAction: OException has occured. Exiting bootstrapper. %s

RunPrereqs::HandleStateAction: Failed determine if prereqs have passed or not.

HandlePrereqFailure::HandleStateAction: Failure has occured with unknown action: %d

errorCode||%d,,errorSource||%d

TryShowUI::HandleStateAction - url is: %s. %s

errorCode||%d,,errorSource||%s

TryGetVersionDescriptor::HandleStateAction: Failed to succesfully get the cab file. %s

TryGetVersionDescriptor::HandleStateAction: Determined version to install {'Ver':'%s'}

TryGetVersionDescriptor::HandleStateAction: OException has occured. Exiting bootstrapper. %s

TryGetClient::HandleStateAction: Found C2R Client at: %s

TryGetClient::HandleStateAction: Found Firefly Client at: %s

TryGetClient::HandleStateAction : Creating InstallPath with ProtectedView Permissions: %s

TryGetClient::HandleStateAction: OException has occured. Exiting bootstrapper. %s

TryGetClient::HandleStateAction: Failed to download and extract the client cab: %s

TryGetClient::HandleStateAction: Getting Cab: %s

TryGetClient::HandleStateAction: Failed to succesfully get the cab file. %s

%s outputpath="%s"

%s firstrun="%s"

scenariosubtype=onlinerepair %s

scenariosubtype=odt %s

scenariosubtype=odt%s %s

scenariosubtype=%s %s

%sscenario=unknown %s

TryConfigureClient::HandleStateAction: OException has occured. Exiting bootstrapper. %s

TryConfigureClient::HandleStateAction: Failed to build command line. command: %s parameters: %s

TryConfigureClient::HandleStateAction: Platform to be removed: %s

TryConfigureClient::HandleStateAction: removing: %s

scenario=install %s

TryLaunchClient::HandleStateAction: C2R Client Install Process returned code %d

TryLaunchClient::HandleStateAction: C2R Client returned failing error code %d

TryLaunchClient::HandleStateAction: Failed to find the C2R Client located at %s. %s

TryLaunchClient::HandleStateAction: OException has occured while trying to launch installation %s.

TryHandleClientError::HandleStateAction: OException has occured while trying to launch installation %s

HandleCabExtractionFailures::TryHandleExctractionFailure: Invalid signature exception. OnDemand: %d

HandleCabExtractionFailures::TryHandleExctractionFailure: Download failed. OnDemand: %d

scenario=CLIENTUPDATE %s

TryConfigureClient::HandleStateAction: Unable to find %s . Found Firefly client %s

TryConfigureClient::HandleStateAction: No client found at %s

TryCheckNetworkCost::HandleStateAction: OException has occured %s. Assuming low cost and proceeding

%s="%s"

productstoadd="%s"

%s productstoremove="%s"

%s trackedduration=%s

%s:%s

%s;%s

%s%s%s%s%s

TryLaunchFireflyUpgrade::HandleStateAction: Copying new client from: %s to: %s

baseurl="%s" culture=%s platform=%s version=%s productstoadd=%s migratingproducts="%s" cdnbaseurl="%s" installid=%s

updatesenabled=%s

updatesfromadminsource=%s

updatetoversion=%s

displaylevel=%s

forceappshutdown=%s

scenario=clientupgrade %s

TryLaunchFireflyUpgrade::HandleStateAction: Launching %s with parameters: %s

TryLaunchFireflyUpgrade::HandleStateAction: C2R Client returned failing error code %d

TryLaunchFireflyUpgrade::HandleStateAction: Unable to find: %s.

TryLaunchFireflyUpgrade::HandleStateAction: OException has occured while trying to launch installation %s.

TryLaunchFirefly:: No config file. Using default values for bootstrapper: %s

TryLaunchFirefly:: About to check the base url to see if it needs updating.

TryLaunchFirefly:: Need to add relative path to base url. Updating to: %s

TryLaunchFirefly:: Setting %s: %s

%s %s %s "%s" %s root\office15\firstrun.exe

operation

%s %s %s %s %s %s %s %s %s %s %s root\office15\firstrun.exe

TryLaunchFirefly::HandleStateAction: Launching %s with parameters: %s

TryLaunchFirefly::HandleStateAction: C2R Client returned failing error code %d

TryLaunchFirefly::HandleStateAction: OException has occured while trying to launch installation %s.

TryLaunchFireflyUninstall::HandleStateAction: Setting force app shutdown to %s

%s %s %s "%s"

TryLaunchFireflyUninstall::HandleStateAction: Launching %s with parameters: %s

TryLaunchFireflyUninstall::HandleStateAction: C2R Client returned failing error code %d

TryLaunchFireflyUninstall::HandleStateAction: OException has occured while trying to launch uninstallation %s.

ConfigureUpdatesSettings::HandleStateAction: OException has occured while trying to launch uninstallation %s.

BlockVolumeInstall::HandleStateAction: OException has occured while displaying error to user %s.

GMonitoredScope::ExecuteUnderStopWatch: %s. Approximate duration: %d milliseconds.

Prereq::PrereqsFailed returned %d

Prereq::PrereqsFailed: OException has occured. Exiting bootstrapper. %s

%s_%s_x-none

Args::Load: Saw protocol handler: %s And Have removed it

Args::Load: Saw protocol handler : %s And Have removed it from front of baseurl

Failed to get current process exe name

IFailed to create event %s

WebControl::Init: IsWow64Process failed; are we running under pre WinXP SP2? Assuming native.

WebControl::WriteUpdateKey: writing %s to registry as bootstrapper's version descriptor.

RoamingOfficeActiveX.32.dll

RoamingOfficeActiveX.64.dll

npofficeondemand.dll

bootstrapper.exe

.CONFLICT.%d

Copying %s to %s

WebControl::TryCopyFiles: Exception caught copying activex to %s

WebControl::TryCopyFiles: OException has occured %s.

WebControl::TryCopyFiles: Failed to copy activex to install dir after %d tries; giving up.

WebControl::RunDll: RunDll: calling %s in dll: %s

%windir%\system32\rundll32.exe

%windir%\Sysnative\rundll32.exe

%s,%s

Software\Microsoft\Windows\CurrentVersion\Ext\PreApproved\%s

Software\Microsoft\Windows\CurrentVersion\Ext\Stats\%s\iexplore\AllowedDomains\*

Software\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\%s

%s:Zone.Identifier

SOFTWARE\Classes\CLSID\%s

MarkSafeForScripting: We are running under WoW, setting WoW keys for safe scripting and initialization.

SOFTWARE\Classes\Wow6432Node\CLSID\%s

MarkSafeForScripting: We are running native (non-WoW), setting native keys for safe scripting and initialization.

Implemented Categories\{7DD95801-9882-11CF-9FA9-00AA006C42C4}

Implemented Categories\{7DD95802-9882-11CF-9FA9-00AA006C42C4}

URL Protocol

Software\Microsoft\Internet Explorer\ProtocolExecute\

%s\MimeTypes\application/x-vnd.officeondemand.1

ieframe.dll

WebControl::Load: IERefreshElevationPolicies succeeded.

WebControl::Load: IERefreshElevationPolicies failed: hresult 0x%x.

WebControl::RemoveAll: Unable to delete %s . Will do so on reboot.

WebControl::RemoveAll: Cleaning up registry entries.

Software\Classes\CLSID\%s\InProcServer32

Software\Classes\Wow6432Node\CLSID\%s\InProcServer32

WebControl::FindActiveXDll: Couldnt open key, maybe AX is not registered? Nothing to do.

WebControl::FindActiveXDll: Dllpath is %s

hXXp://office.microsoft.com

URLInfoAbout

c2rui.dll

RoamingApps_CloseWebcontrolInstallDialog

BKernel32.dll

RobustFileOps::MoveFileToBackup: Shutdown event set, abandoning MoveFileEx of existing fileToMoveToBackupPath "%s" to bakPath "%s".

RobustFileOps::MoveFileToBackup: Moving existing fileToMoveToBackupPath "%s" to bakPath "%s": Attempt %d of %d.

RobustFileOps::MoveFileToBackup: MoveFileEx failed to move existing fileToMoveToBackupPath "%s" to bakPath "%s": LastError: %d

RobustFileOps::MoveFileToBackup: Shutdown event set, abandoning MoveFileEx of existing fileToMoveToBackupPath "%s" to bakPath "%s" (after failure)

RobustFileOps::MoveFileToBackup: FAILED! MoveFileEx failed to move existing fileToMoveToBackupPath "%s" to bakPath "%s". All %d of %d attempts exhausted!

RobustFileOps::MoveFile: [F] "%s" -> "%s"

RobustFileOps::MoveFile: Shutdown event set, abandoning MoveFileEx of new sourceFilePath "%s" to destinationFilePath "%s".

RobustFileOps::MoveFile: Moving new sourceFilePath "%s" to destinationFilePath "%s": Attempt %d of %d.

RobustFileOps::MoveFile: MoveFileEx failed to move new sourceFilePath "%s" to destinationFilePath "%s": LastError: %d

RobustFileOps::MoveFile: Shutdown event set, abandoning MoveFileEx of new sourceFilePath "%s" to destinationFilePath "%s" (after failure)

RobustFileOps::MoveFile: FAILED! MoveFileEx failed to move new sourceFilePath "%s" to destinationFilePath "%s". All %d of %d attempts exhausted!

StreamFile::MoveFile: Failed to replace existing file: "%s" with "%s":

RobustFileOps::RollbackFiles: ROLLBACK of move from "%s" to "%s".

RobustFileOps::RollbackFiles: FAILED ROLLBACK of move from "%s" to "%s"!

BHKEY_CURRENT_USER

Failed to retrieve version information about the current operation system.

%s is signed, validating signer

Error: %s is not trusted.

ORegistryKey.DeleteSubKey failure: The key is not opened

ORegistryKey.DeleteSubKey failure:The specified subkey "%s" is not a valid reference to a registry key

ORegistryKey.DeleteValue failure: Cannot delete registry value from Registry Key %s. The Registry value is null

ORegistryKey.DeleteValue failure: Cannot delete registry value from Registry Key %s.

Failed to start process (as user) for file: %s arguments: %s

::OpenProcess failed to retrieve process handle for ProcessId=%d (DesiredAccess=%d, fInheritHandle=%d).

::EnumWindows() failed to enumerate the list of windows for processId: %d

::GetWindowTextLength() failed to get the length of window title for window-handle: %d

::GetWindowTextW() failed to get window title for window-handle: %d

::GetWindowThreadProcessId() failed to get the ProcessId for window with handle: %d.

%d, %p

JFailed to Open Win Http session

Passport.Net\*

http session not initialized

CFailed to copy string '%S' to buffer.

Configuration::AdjustBaseUrlForOEMSource: Found OEM source registry keys. Redirecting base url: %s

Configuration::GetProductSource: Adjusted base url: %s

CabManager::Extract: Extraction Failed for "%s". Size:%u, MD5 hash:%s. %s

CabManager::CultureFromLCID: Could not find culture for LCID %d

CabErrorDetection::Validate: hash file not found for "%s"

GFileDownload::Download: Downloading %s -> %s

FileDownload::Download: Download failed for "%s", try %d. %s

ORegistryKey.GetValue failure: Cannot get String value. The registry key is closed or not set

IsNativeValidator::CheckPreReq: OException has occured %s. Failing test

SXSValidator::CheckPreReq: Has has unknown C2R Client platform installed: %s

SXSValidator::CheckPreReq: Has has unknown Firefly platform installed: %s. %s

SXSValidator::BlockSetup: Found Blocking application %s.

GrooveMSIValidator::BlockSetup: Found Blocking application %s.

GrooveMSIValidator::CheckPreReq: Has preexisting blocking MSI products: %s.

GrooveMSIValidator::CheckPreReq: Existing MSI product test passed.

ClientValidator::CheckPreReq: C2R Client located here %s is version %s

ClientValidator::CheckPreReq: Comparison result: %d

ClientValidator::CheckPreReq: Version of client too low to install with: Have: %s Need: %s

ClientValidator::CheckPreReq: Firefly Client located here %s is version %s

ClientValidator::CheckPreReq: returning: %d.

O15BetaValidator::CheckPreReq: OException has occured %s. Failing test

O15BetaValidator::GetErrorMessageBodyParam: ILanguage value used: %d

O15BetaValidator::GetErrorMessageBodyParam: OException has occured %s. Using default value

MSIxC2RBlockValidator::CheckPreReq: OException has occured %s.

ConfigFile::ProcessExcludeAppNodes: Illegal app specified for exclude %s

Download failed for "%s", try %d. %s

XML Attribute %s is not found

LParseProductCode failed for %s

FhXXp://officecdn.microsoft.com/pr/39168D7E-077B-48E7-872C-B232C3E72675K_scenario_admin_culture_en-us_lcid_1033_platform_x86_productreleaseid_none_

Microsoft Office5The Office on Demand webcontrols have been installed.'Office needs a newer version of Windows

You can try again in a moment, we recommend using a new web browser window.

We're sorry, we can't stream your Office program on demand for you on this computer because it's not running a modern Windows operating system.

Microsoft Windows 7 (or newer) is required to stream Office on Demand programs.

You can try editing this document in your web browser instead.

We're done uninstalling!7Office on Demand web browser add-ons have been removed.*Microsoft Office on Demand Browser Add-ons

You can try launching again in a moment or try using the Office Web Apps for now if this problem continues.

%s-Office on Demand needs to close some programs

Client update needed.QWe are sorry, but we could not complete the installation. Please try again later.

You're all set.<OneDrive for Business is already installed on your computer.B%s

We're sorry, Office Click-to-Run installer encountered a problem because you have these Windows Installer based Office programs installed on your computer:

Click-to-Run and Windows Installer editions of Office programs don't get along for this version, so you can only have one type installed at a time. Please try installing the Windows Installer edition of Office instead, or uninstall your other Windows Installer based Office programs and try this installation again.

15.0.4825.1000

' Name: OffScrubC2R.vbs

' Author: Microsoft Customer Support Services

Const SCRIPTFILE = "OffScrubC2R.vbs"

Const RETVALFILE = "ScrubRetValFile.txt"

Const REG_ARP = "SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\"

Const ERROR_STAGE1 = 8 'Bit #4. Informational. Msiexec based install was not possible

Const ERROR_STAGE2 = 16 'Bit #5. Critical. Not all of the intended cleanup operations could be applied

Const ERROR_USER_ABORT = &HC000013A 'RESERVED. Dec -1073741510. Critical error. Returned when user aborts with <Ctrl> <Break> or closes the cmd window

Dim ComputerItem, Key, Item, LogStream, TmpKey

Dim dictionaryKeepLis, dicApps, dictionaryKeepFolder, dicDelRegKey, dictionaryKeepReg

Dim sOSinfo, sDefault, sTemp, sTmp, sCmd, sLogDir, sPrompt, sProfilesDirectory

Dim f64, fLogInitialized, fNoCancel, fRemoveOse, fDetectOnly, fQuiet, fForce

ParseCmdLine

Log "Ensure Windows Installer metadata integrity " & " (" & Time & ")"

EnsureValidWIMetadata HKLM,"SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Products", COMPRESSED

EnsureValidWIMetadata HKLM,"SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components", COMPRESSED

If dicC2RSuite.Count > 0 Then

For Each Key In dicC2RSuite.Keys

Log " - " & Key & " - " & dicC2RSuite.Item(Key)

Next 'Key

' For Each Item in dicC2RSuite.Items

If oFso.FolderExists(oWShell.ExpandEnvironmentStrings("%programfiles%") & "\Microsoft Office 15") Then

sPackageFolder = oWShell.ExpandEnvironmentStrings("%programfiles%") & "\Microsoft Office 15"

ElseIf oFso.FolderExists(oWShell.ExpandEnvironmentStrings("%programfiles%") & "\Microsoft Office 16") Then

sPackageFolder = oWShell.ExpandEnvironmentStrings("%programfiles%") & "\Microsoft Office 16"

ElseIf oFso.FolderExists(oWShell.ExpandEnvironmentStrings("%programfiles%") & "\Microsoft Office\PackageManifests") Then

sPackageFolder = oWShell.ExpandEnvironmentStrings("%programfiles%") & "\Microsoft Office"

ElseIf oFso.FolderExists(oWShell.ExpandEnvironmentStrings("%programfiles(x86)%") & "\Microsoft Office\PackageManifests") Then

sPackageFolder = oWShell.ExpandEnvironmentStrings("%programfiles(x86)%") & "\Microsoft Office"

If CBool(iError AND ERROR_STAGE1) Then Log " - Msiexec failed"

If MsgBox(sPrompt, vbYesNo, SCRIPTNAME & " - Reboot Required") = VB_YES Then

Set oWmiReboot = GetObject("winmgmts:{impersonationLevel=impersonate,(Shutdown)}!\\.\root\cimv2")

Set colOS = oWmiReboot.ExecQuery ("Select * from Win32_OperatingSystem")

oOS.Reboot()

wscript.quit iError

fLogInitialized = False

Set oWmiLocal = GetObject("winmgmts:\\.\root\cimv2")

Set oWShell = CreateObject("Wscript.Shell")

Set oShellApp = CreateObject("Shell.Application")

Set oFso = CreateObject("Scripting.FileSystemObject")

Set oMsi = CreateObject("WindowsInstaller.Installer")

Set oReg = GetObject("winmgmts:\\.\root\default:StdRegProv")

sAppData = oWShell.ExpandEnvironmentStrings("%appdata%")

sLocalAppData = oWShell.ExpandEnvironmentStrings("%localappdata%")

sTemp = oWShell.ExpandEnvironmentStrings("%temp%")

sAllUsersProfile = oWShell.ExpandEnvironmentStrings("%allusersprofile%")

RegReadValue HKLM, "SOFTWARE\Microsoft\Windows NT\CurrentVersion\ProfileList", "ProfilesDirectory", sProfilesDirectory, "REG_EXPAND_SZ"

If NOT oFso.FolderExists(sProfilesDirectory) Then

sProfilesDirectory = oFso.GetParentFolderName(oWShell.ExpandEnvironmentStrings("%userprofile%"))

sProgramFiles = oWShell.ExpandEnvironmentStrings("%programfiles%")

'sProgramFilesX86 = deferred. Depends on operating system architecture check

sCommonProgramFiles = oWShell.ExpandEnvironmentStrings("%commonprogramfiles%")

'sCommonProgramFilesX86 = deferred. Depends on operating system architecture check

sProgramData = oWSHell.ExpandEnvironmentStrings("%programdata%")

sWinDir = oWShell.ExpandEnvironmentStrings("%windir%")

sScriptDir = wscript.ScriptFullName

If InStr(LCase(wscript.path), "syswow64") > 0 Then RelaunchAs64Host

If Not oFso.FolderExists(sScrubDir) Then oFso.CreateFolder sScrubDir

' detect bitness of the operating system

Set ComputerItem = oWmiLocal.ExecQuery("Select * from Win32_ComputerSystem")

f64 = Instr(Left(Item.SystemType, 3), "64") > 0

If f64 Then sProgramFilesX86 = oWShell.ExpandEnvironmentStrings("%programfiles(x86)%")

If f64 Then sCommonProgramFilesX86 = oWShell.ExpandEnvironmentStrings("%CommonProgramFiles(x86)%")

' get Win32_OperatingSystem details

Set ComputerItem = oWmiLocal.ExecQuery("Select * from Win32_OperatingSystem")

sOSinfo = sOSinfo & Item.Caption

sOSinfo = sOSinfo & Item.OtherTypeDescription

sOSinfo = sOSinfo & ", " & "SP " & Item.ServicePackMajorVersion

sOSinfo = sOSinfo & ", " & "Version: " & Item.Version

sOsVersion = Item.Version

sOSinfo = sOSinfo & ", " & "Codepage: " & Item.CodeSet

sOSinfo = sOSinfo & ", " & "Country Code: " & Item.CountryCode

sOSinfo = sOSinfo & ", " & "Language: " & Item.OSLanguage

If UCase(Mid(Wscript.FullName, Len(Wscript.Path)   2, 1)) = "C" Then

If Not fLogInitialized Then CreateLog

wscript.quit iError

fCScript = UCase(Mid(Wscript.FullName, Len(Wscript.Path)   2, 1)) = "C"

Set dicInstalledSku = CreateObject("Scripting.Dictionary")

Set dicRemoveSku = CreateObject("Scripting.Dictionary")

Set dictionaryKeepSku = CreateObject("Scripting.Dictionary")

Set dictionaryKeepLis = CreateObject("Scripting.Dictionary")

Set dictionaryKeepFolder = CreateObject("Scripting.Dictionary")

Set dicApps = CreateObject("Scripting.Dictionary")

Set dicDelRegKey = CreateObject("Scripting.Dictionary")

Set dictionaryKeepReg = CreateObject("Scripting.Dictionary")

Set dicC2RSuite = CreateObject("Scripting.Dictionary")

Set dicDelInUse = CreateObject("Scripting.Dictionary")

Set dicDelFolder = CreateObject("Scripting.Dictionary")

' add initial known .exe files that need to be closed

dicApps.Add "appvshnotify.exe", "appvshnotify.exe"

dicApps.Add "integratedoffice.exe", "integratedoffice.exe"

dicApps.Add "integrator.exe", "integrator.exe"

dicApps.Add "firstrun.exe", "firstrun.exe"

dicApps.Add "setup.exe", "setup.exe"

dicApps.Add "communicator.exe", "communicator.exe"

dicApps.Add "msosync.exe", "msosync.exe"

dicApps.Add "OneNoteM.exe", "OneNoteM.exe"

dicApps.Add "iexplore.exe", "iexplore.exe"

dicApps.Add "mavinject32.exe", "mavinject32.exe"

dicApps.Add "werfault.exe", "werfault.exe"

dicApps.Add "perfboost.exe", "perfboost.exe"

dicApps.Add "roamingoffice.exe", "roamingoffice.exe"

dicApps.Add "officeclicktorun.exe", "officeclicktorun.exe"

dicApps.Add "officeondemand.exe", "officeondemand.exe"

dicApps.Add "OfficeC2RClient.exe", "OfficeC2RClient.exe"

' ParseCmdLine

Sub ParseCmdLine

iArgCnt = Wscript.Arguments.Count

If wscript.Arguments(0) = "UAC" Then

If wscript.arguments.count = 1 Then iArgCnt = 0

Select Case UCase(wscript.ScriptName)

arrArguments(iCnt) = UCase(Wscript.Arguments(iCnt))

fLogInitialized = False

If oFso.FolderExists(arrArguments(iCnt   1)) Then

oFso.CreateFolder(arrArguments(iCnt   1))

If Not fLogInitialized Then CreateLog

End Sub 'ParseCmdLine

Wscript.Echo sErr & vbCrLf & _

Wscript.Quit

' name in the "Uninstall" key.

Dim sCurKey, sValue, sConfigName, sCulture, sDisplayVersion, sProd

Dim arrKeys, arrProducts, arrCultures

Const REG_ARP = "SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\"

If dicInstalledSku.Count > 0 Then Exit Sub 'Already done from command line parser

' Check O15 Configuration key

Err.Clear

If NOT dicInstalledSku.Exists(LCase(prod)) Then

dicInstalledSku.Add LCase(prod), sDisplayVersion

' Check O15 PropertyBag key

' Check Office Configuration key

If RegEnumKey(HKLM, REG_C2RPRODUCTIDS & sActiveConfiguration & "\culture", arrCultures) Then

If RegEnumKey(HKLM, REG_C2RPRODUCTIDS & sActiveConfiguration, arrProducts) Then

If NOT dicInstalledSku.Exists(sProd) Then

dicInstalledSku.Add sProd, sDisplayVersion

Err.Clear

If NOT dicInstalledSku.Exists(LCase(prod)) Then

' Check O16 Configuration key

RegEnumKey HKLM, REG_ARP, arrKeys

If IsArray(arrKeys) Then

For Each ArpItem in arrKeys

sCurKey = REG_ARP & ArpItem & "\"

fUninstallString = RegReadValue(HKLM, sCurKey, "UninstallString", sValue, "REG_SZ")

If (fUninstallString And( (InStr(UCase(sValue), UCase("Microsoft Office 1")) > 0) Or (InStr(UCase(sValue), UCase("OfficeClickToRun.exe")) > 0) )) Then

fDisplayVersion = RegReadValue(HKLM, sCurKey, "DisplayVersion", sDisplayVersion, "REG_SZ")

If NOT dicC2RSuite.Exists(ArpItem) Then dicC2RSuite.Add ArpItem, prod & " - " & sDisplayVersion

fSystemComponent0 = NOT (RegReadValue(HKLM, sCurKey, "SystemComponent", sValue, "REG_DWORD") AND (sValue = "1"))

fDisplayVersion = RegReadValue(HKLM, sCurKey, "DisplayVersion", sValue, "REG_SZ")

If Not Err <> 0 Then Err.Clear

fUninstallString = RegReadValue(HKLM, sCurKey, "UninstallString", sUninstallString, "REG_SZ")

If (fUninstallString And( (InStr(UCase(sUninstallString), UCase("Microsoft Office 1")) > 0) Or (InStr(UCase(sUninstallString), UCase("OfficeClickToRun.exe")) > 0) )) Then

If NOT dicInstalledSku.Exists(LCase(sConfigName)) Then

dicInstalledSku.Add LCase(sConfigName), sDisplayVersion

If NOT dicC2RSuite.Exists(ArpItem) Then dicC2RSuite.Add ArpItem, sConfigName & " - " & sDisplayVersion

' classic .msi install SKU

If NOT dictionaryKeepSku.Exists(ArpItem) Then dictionaryKeepSku.Add ArpItem, sConfigName & " - " & sDisplayVersion

RegReadValue HKLM, sCurKey, "DisplayName", sConfigName, "REG_SZ"

If NOT dicInstalledSku.Exists(LCase(ArpItem)) Then

dicInstalledSku.Add LCase(ArpItem), sDisplayVersion

If NOT dicC2RSuite.Exists(ArpItem) Then dicC2RSuite.Add ArpItem, sConfigName & " - " & sDisplayVersion

sConfigName = "MSOIDLOGIN"

If NOT dictionaryKeepSku.Exists(ArpItem) Then dictionaryKeepSku.Add ArpItem, ArpItem

Sub EnsureValidWIMetadata(hDefKey, sKey, iValidLength)

Dim arrKeys

Dim SubKey

If Len(sKey) > 1 Then

If Right(sKey, 1) = "\" Then sKey = Left(sKey, Len(sKey) - 1)

If RegEnumKey(hDefKey, sKey, arrKeys) Then

For Each SubKey in arrKeys

If NOT Len(SubKey) = iValidLength Then

RegDeleteKey hDefKey, sKey & "\" & SubKey & "\"

Next 'SubKey

Dim sCleanOSPP, sCmd, sRetVal

CONST OfficeAppId = "0ff1ce15-a989-479d-af46-f275c6370663" 'Office 2013

sCleanOSPP = "x64\CleanOSPP.exe"

If Not f64 Then sCleanOSPP = "x86\CleanOSPP.exe"

If oFso.FileExists(sScriptDir & sCleanOSPP) Then

sCmd = """" & sScriptDir & sCleanOSPP & """"

' sCmd = sScriptDir & sCleanOSPP

Log " Running: " & sCmd

sRetVal = oWShell.Run(sCmd, 0, True)

If NOT (dicC2RSuite.Count > 0 OR dictionaryKeepSku.Count > 0) Then

Set oProductInstances = oWmiLocal.ExecQuery("SELECT ID, ApplicationId, PartialProductKey, Name, ProductKeyID FROM SoftwareLicensingProduct WHERE ApplicationId = '" & OfficeAppId & "' " & "AND PartialProductKey <> NULL")

Set oProductInstances = oWmiLocal.ExecQuery("SELECT ID, ApplicationId, PartialProductKey, Name, ProductKeyID FROM OfficeSoftwareProtectionProduct WHERE ApplicationId = '" & OfficeAppId & "' " & "AND PartialProductKey <> NULL")

pi.UninstallProductKey( pi.ProductKeyID)

Dim sCmd

oWShell.Run "SCHTASKS /Delete /TN FF_INTEGRATEDstreamSchedule /F", 0, False

wscript.sleep 500

oWShell.Run "SCHTASKS /Delete /TN FF_INTEGRATEDUPDATEDETECTION /F", 0, False

oWShell.Run "SCHTASKS /Delete /TN C2RAppVLoggingStart /F", 0, False

sCmd = "SCHTASKS /Delete /TN " & Chr(34) & "Office 15 Subscription Heartbeat" & Chr(34) & " /F"

oWShell.Run sCmd, 0, False

sCmd = "SCHTASKS /Delete /TN " & Chr(34) & "Microsoft Office 15 Sync Maintenance for {d068b555-9700-40b8-992c-f866287b06c1}" & Chr(34) & " /F"

sCmd = "SCHTASKS /Delete /TN " & Chr(34) & "\Microsoft\Office\OfficeInventoryAgentFallBack" & Chr(34) & " /F"

sCmd = "SCHTASKS /Delete /TN " & Chr(34) & "\Microsoft\Office\OfficeTelemetryAgentFallBack" & Chr(34) & " /F"

sCmd = "SCHTASKS /Delete /TN " & Chr(34) & "\Microsoft\Office\OfficeInventoryAgentLogOn" & Chr(34) & " /F"

sCmd = "SCHTASKS /Delete /TN " & Chr(34) & "\Microsoft\Office\OfficeTelemetryAgentLogOn" & Chr(34) & " /F"

sCmd = "SCHTASKS /Delete /TN " & Chr(34) & "Office Background Streaming" & Chr(34) & " /F"

sCmd = "SCHTASKS /Delete /TN " & Chr(34) & "\Microsoft\Office\Office Automatic Updates" & Chr(34) & " /F"

sCmd = "SCHTASKS /Delete /TN " & Chr(34) & "\Microsoft\Office\Office ClickToRun Service Monitor" & Chr(34) & " /F"

sCmd = "SCHTASKS /Delete /TN " & Chr(34) & "Office Subscription Maintenance" & Chr(34) & " /F"

sUserWarn = "Please save all open documents and close all Office, IE and Windows Explorer applications before proceeding." & vbCrLf & _

"When you click OK this removal process will terminate all running Office, IE and Windows Explorer processes and applications." & vbCrLf & vbCrLf & _

For Each app in dicApps.Keys

Set Processes = oWmiLocal.ExecQuery("Select * From Win32_Process Where Name like '" & sAppName & "'")

If NOT InStr(sUserWarn, Process.Name) > 0 Then sUserWarn = sUserWarn & vbCrLf & " - " & Process.Name

Set Processes = oWmiLocal.ExecQuery("Select * From Win32_Process")

For Each prop in Process.Properties_

If prop.Name = "ExecutablePath" Then

If IsC2R(prop.Value) Then sUserWarn = sUserWarn & vbCrLf & " - " & Process.Name

iRet = MsgBox(sUserWarn, 49, "Save your unsaved work now!")

For Each app in dicApps.Keys

Set Processes = oWmiLocal.ExecQuery("Select * From Win32_Process Where Name like '" & sAppName & "'")

If Not InStr(Process.Name, "OInstall") > 0 Then

sOut = "End process '" & Process.Name

iRet = Process.Terminate()

CheckError "CloseOfficeApps: " & "Process.Name"

Set Processes = oWmiLocal.ExecQuery("Select * From Win32_Process")

For Each prop in Process.Properties_

If prop.Name = "ExecutablePath" Then

If IsC2R(prop.Value) Then

If Not InStr(Process.Name, "OInstall") > 0 Then

sOut = "End process '" & Process.Name

iRet = Process.Terminate()

CheckError "CloseOfficeApps: " & "Process.Name"

If fWait Then wscript.sleep 5000

Dim hDefKey, sSubKeyName, sValue, Name, arrNames, arrTypes

Dim sku, prod, sUninstallCmd, sReturn, sMsiProp, sCmd

Set OseService = oWmiLocal.Execquery("Select * From Win32_Service Where Name like 'ose%'")

If (srvc.StartMode = "Disabled") AND (Not srvc.ChangeStartMode("Manual") = 0) Then _

If (Not srvc.StartName = "LocalSystem") AND (srvc.Change( , , , , , , "LocalSystem", "")) Then _

If NOT dicC2RSuite.Count > 0 Then

If oFso.FolderExists(sValue & "\root\Integration") Then

sCmd = "cmd.exe /c del " & chr(34) & sPkgFld & "\root\Integration\C2RManifest*.xml" & chr(34)

sReturn = oWShell.Run (sCmd, 0, True)

If oFso.FileExists(sPkgFld & "\root\Integration\integrator.exe") Then

sCmd = chr(34) & sPkgFld & "\root\Integration\integrator.exe" & chr(34) & " /U /Extension PackageRoot=" & chr(34) & sPkgFld & "\root" & chr(34) & " PackageGUID=" & sPkgGuid

Log " Running: " & sCmd

sReturn = oWShell.Run (sCmd, 0, True)

sCmd = chr(34) & sPkgFld & "\root\Integration\integrator.exe" & chr(34) & " /U"

If oFso.FileExists(sProgramData & "\Microsoft\ClickToRun\{" & sPkgGuid & "}\integrator.exe") Then

sCmd = chr(34) & sProgramData & "\Microsoft\ClickToRun\{" & sPkgGuid & "}\integrator.exe" & chr(34) & " /U /Extension PackageRoot=" & chr(34) & sPkgFld & "\root" & chr(34) & " PackageGUID=" & sPkgGuid

' delete potential blocking registry keys for msiexec based tasks

For Each sku in dicC2RSuite.Keys

RegDeleteKey HKLM, REG_ARP & sku

RegDeleteKey HKCU, "SOFTWARE\Microsoft\Office\15.0\ClickToRun"

RegDeleteKey HKLM, "SOFTWARE\Microsoft\Office\15.0\ClickToRun"

RegDeleteKey HKCU, "SOFTWARE\Microsoft\Office\16.0\ClickToRun"

RegDeleteKey HKLM, "SOFTWARE\Microsoft\Office\16.0\ClickToRun"

RegDeleteKey HKCU, "SOFTWARE\Microsoft\Office\ClickToRun"

RegDeleteKey HKLM, "SOFTWARE\Microsoft\Office\ClickToRun"

' AppV keys

hDefKey = HKCU

sSubKeyName = "SOFTWARE\Microsoft\AppV\ISV"

If RegEnumValues(hDefKey, sSubKeyName, arrNames, arrTypes) Then

If IsC2R(Name) Then RegDeleteValue hDefKey, sSubKeyName, Name, False

If hDefKey = HKLM Then Exit Do

hDefKey = HKLM

' msiexec based uninstall

For Each prod in oMsi.Products

Log "Calling msiexec.exe to remove " & prod

sUninstallCmd = "msiexec.exe /x" & prod & sMsiProp

sUninstallCmd = sUninstallCmd & " /q"

sUninstallCmd = sUninstallCmd & " /qb-!"

sUninstallCmd = sUninstallCmd & " /l*v " & chr(34) & sLogDir & "\Uninstall_" & prod & ".log" & chr(34)

LogOnly "Calling msiexec with '" & sUninstallCmd & "'"

sReturn = oWShell.Run(sUninstallCmd, 0, True)

Log "msiexec returned: " & SetupRetVal(sReturn) & " (" & sReturn & ")" & vbCrLf

oWShell.Run "cmd.exe /c net stop msiserver", 0, False

Dim hDefKey, item, name, value, RetVal

Dim sGuid, sSubKeyName, sValue, sCmd

Dim arrKeys, arrNames, arrTypes, arrTestNames, arrTestTypes

RegDeleteKey HKCU, "Software\Microsoft\Office\15.0\Registration"

RegDeleteKey HKCU, "Software\Microsoft\Office\16.0\Registration"

RegDeleteKey HKCU, "Software\Microsoft\Office\Registration"

' AppV key "SOFTWARE\Microsoft\AppV" has already been cleared in uninstall stage

RegDeleteKey HKLM, "SOFTWARE\Microsoft\Office\15.0\Common\InstallRoot\Virtual"

RegDeleteKey HKLM, "SOFTWARE\Microsoft\Office\16.0\Common\InstallRoot\Virtual"

RegDeleteKey HKLM, "SOFTWARE\Microsoft\Office\Common\InstallRoot\Virtual"

If NOT dictionaryKeepSku.Count > 0 Then RegDeleteKey HKLM, "SOFTWARE\Classes\CLSID\{2027FC3B-CF9D-4ec7-A823-38BA308625CC}"

' C2R keys

RegDeleteKey HKLM, "SOFTWARE\Microsoft\Office\15.0\ClickToRunStore"

RegDeleteKey HKLM, "SOFTWARE\Microsoft\Office\16.0\ClickToRunStore"

RegDeleteKey HKLM, "SOFTWARE\Microsoft\Office\ClickToRunStore"

' Office key in HKLM

If Not dictionaryKeepSku.Count > 0 Then

RegDeleteKey HKLM, "Software\Microsoft\Office\15.0"

RegDeleteKey HKLM, "Software\Microsoft\Office\16.0"

' Run key

sSubKeyName = "SOFTWARE\Microsoft\Windows\CurrentVersion\Run"

If RegEnumValues (HKLM, sSubKeyName, arrNames, arrTypes) Then

If RegReadValue(HKLM, sSubKeyName, name, sValue, "REG_SZ") Then

If IsC2R(sValue) Then RegDeleteValue HKLM, sSubKeyName, name, False

RegDeleteValue HKLM, "SOFTWARE\Microsoft\Windows\CurrentVersion\Run", "Lync15", False

RegDeleteValue HKLM, "SOFTWARE\Microsoft\Windows\CurrentVersion\Run", "Lync16", False

If NOT dictionaryKeepSku.Count > 0 Then

RegDeleteKey HKLM, "SOFTWARE\Classes\Protocols\Handler\osf"

RegDeleteKey HKLM, "SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\ShellIconOverlayIdentifiers\Microsoft SPFS Icon Overlay 1 (ErrorConflict)"

RegDeleteKey HKLM, "SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\ShellIconOverlayIdentifiers\Microsoft SPFS Icon Overlay 2 (SyncInProgress)"

RegDeleteKey HKLM, "SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\ShellIconOverlayIdentifiers\Microsoft SPFS Icon Overlay 3 (InSync)"

RegDeleteKey HKLM, "SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Explorer\ShellIconOverlayIdentifiers\Microsoft SPFS Icon Overlay 1 (ErrorConflict)"

RegDeleteKey HKLM, "SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Explorer\ShellIconOverlayIdentifiers\Microsoft SPFS Icon Overlay 2 (SyncInProgress)"

RegDeleteKey HKLM, "SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Explorer\ShellIconOverlayIdentifiers\Microsoft SPFS Icon Overlay 3 (InSync)"

RegDeleteValue HKLM, "SOFTWARE\Microsoft\Windows\CurrentVersion\Shell Extensions\Approved\", "{B28AA736-876B-46DA-B3A8-84C5E30BA492}", False

RegDeleteValue HKLM, "SOFTWARE\Microsoft\Windows\CurrentVersion\Shell Extensions\Approved\", "{8B02D659-EBBB-43D7-9BBA-52CF22C5B025}", False

RegDeleteValue HKLM, "SOFTWARE\Microsoft\Windows\CurrentVersion\Shell Extensions\Approved\", "{0875DCB6-C686-4243-9432-ADCCF0B9F2D7}", False

RegDeleteValue HKLM, "SOFTWARE\Microsoft\Windows\CurrentVersion\Shell Extensions\Approved\", "{42042206-2D85-11D3-8CFF-005004838597}", False

RegDeleteValue HKLM, "SOFTWARE\Microsoft\Windows\CurrentVersion\Shell Extensions\Approved\", "{993BE281-6695-4BA5-8A2A-7AACBFAAB69E}", False

RegDeleteValue HKLM, "SOFTWARE\Microsoft\Windows\CurrentVersion\Shell Extensions\Approved\", "{C41662BB-1FA0-4CE0-8DC5-9B7F8279FF97}", False

RegDeleteValue HKLM, "SOFTWARE\Microsoft\Windows\CurrentVersion\Shell Extensions\Approved\", "{506F4668-F13E-4AA1-BB04-B43203AB3CC0}", False

RegDeleteValue HKLM, "SOFTWARE\Microsoft\Windows\CurrentVersion\Shell Extensions\Approved\", "{D66DC78C-4F61-447F-942B-3FB6980118CF}", False

RegDeleteValue HKLM, "SOFTWARE\Microsoft\Windows\CurrentVersion\Shell Extensions\Approved\", "{46137B78-0EC3-426D-8B89-FF7C3A458B5E}", False

RegDeleteKey HKLM, "SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{31D09BA0-12F5-4CCE-BE8A-2923E76605DA}"

RegDeleteKey HKLM, "SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{B4F3A835-0E21-4959-BA22-42B3008E02FF}"

RegDeleteKey HKLM, "SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{D0498E0A-45B7-42AE-A9AA-ABA463DBD3BF}"

RegDeleteKey HKLM, "SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{31D09BA0-12F5-4CCE-BE8A-2923E76605DA}"

RegDeleteKey HKLM, "SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{B4F3A835-0E21-4959-BA22-42B3008E02FF}"

RegDeleteKey HKLM, "SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{D0498E0A-45B7-42AE-A9AA-ABA463DBD3BF}"

RegDeleteKey HKLM, "SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Desktop\NameSpace\{0875DCB6-C686-4243-9432-ADCCF0B9F2D7}"

' Web Sites

RegDeleteKey HKLM, "SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Desktop\Namespace\{B28AA736-876B-46DA-B3A8-84C5E30BA492}"

RegDeleteKey HKLM, "SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\NetworkNeighborhood\Namespace\{46137B78-0EC3-426D-8B89-FF7C3A458B5E}"

RegDeleteKey HKLM, "SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\VolumeCaches\Microsoft Office Temp Files"

End If 'NOT dictionaryKeepSku.Count > 0

If RegEnumKey(HKLM, REG_ARP, arrKeys) Then

For Each item in arrKeys

If CheckDelete(sGuid) Then RegDeleteKey HKLM, REG_ARP & item & "\"

LogH2 "Scanning Windows Installer metadata for removeable UpgradeCodes"

sSubKeyName = "SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UpgradeCodes\"

hDefKey = HKLM

sSubKeyName = "Installer\UpgradeCodes\"

hDefKey = HKCR

sSubKeyName = "SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Products\"

sSubKeyName = "Installer\Features\"

sSubKeyName = "Installer\Products\"

If RegEnumKey(hDefKey, sSubKeyName, arrKeys) Then

For Each item in arrKeys

' check if it's an Office key

RegEnumValues hDefKey, sSubKeyName & item, arrNames, arrTypes

If CheckDelete(sGuid) Then RegDeleteValue hDefKey, sSubKeyName & item & "\", name, True

RegDeleteValue hDefKey, sSubKeyName & item & "\", name, True

' if all entries were removed - delete the key

If NOT RegEnumValues(hDefKey, sSubKeyName & item, arrNames, arrTypes) Then RegDeleteKey hDefKey, sSubKeyName & item & "\"

RegDeleteKey hDefKey, sSubKeyName & item & "\"

End If 'RegEnumKey

LogH2 "Scanning Windows Installer Global Components metadata"

sSubKeyName = "SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\"

hDefKey = HKLM

If RegEnumKey(hDefKey, sSubKeyName, arrKeys) Then

If RegEnumValues(hDefKey, sSubKeyName & item, arrNames, arrTypes) Then

RegDeleteValue hDefKey, sSubKeyName & item & "\", name, False

' if all entries were removed - delete the key

If NOT RegEnumValues(hDefKey, sSubKeyName & item, arrTestNames, arrTestTypes) Then RegDeleteKey hDefKey, sSubKeyName & item & "\"

End If 'RegEnumKey

LogH2 "Scanning Windows Installer Published Components metadata"

sSubKeyName = "Installer\Components\"

hDefKey = HKCR

If RegReadValue (hDefKey, sSubKeyName & item, name, sValue, "REG_MULTI_SZ") Then

If NOT UBound(arrMultiSzValues) = i Then oReg.SetMultiStringValue hDefKey, sSubKeyName & item, name,arrMultiSzNewValues

' if all entries were removed - delete the key

If NOT RegEnumValues(hDefKey, sSubKeyName & item, arrTestNames, arrTestTypes) Then RegDeleteKey hDefKey, sSubKeyName & item & "\"

dicApps.Add "explorer.exe", "explorer.exe"

dicApps.Add "msiexec.exe", "msiexec.exe"

dicApps.Add "ose.exe", "ose.exe"

If oFso.FolderExists(sProgramFiles & "\Microsoft Office 15") _

Or oFso.FolderExists(sProgramFiles & "\Microsoft Office 16") _

Or oFso.FolderExists(oWShell.ExpandEnvironmentStrings("%programfiles%") & "\Microsoft Office\PackageManifests") _

Or oFso.FolderExists(oWShell.ExpandEnvironmentStrings("%programfiles(x86)%") & "\Microsoft Office\PackageManifests") Then

Log " Attention: Now closing Explorer.exe for file delete operations"

wscript.sleep 2000

DeleteFile sProgramFiles & "\Microsoft Office\AppXManifest.xml"

DeleteFile sProgramFiles & "\Microsoft Office\FileSystemMetadata.xml"

If Not dictionaryKeepSku.Count > 0 Then

DeleteFile sProgramFilesX86 & "\Microsoft Office\AppXManifest.xml"

DeleteFile sProgramFilesX86 & "\Microsoft Office\FileSystemMetadata.xml"

If oFso.FileExists(sProgramData & "\Microsoft\office\FFPackageLocker") Then DeleteFile sProgramData & "\Microsoft\office\FFPackageLocker"

If oFso.FileExists(sProgramData & "\Microsoft\office\FFStatePBLocker") Then DeleteFile sProgramData & "\Microsoft\office\FFStatePBLocker"

If NOT dictionaryKeepSku.Count > 0 Then DeleteFolder sProgramData & "\Microsoft\office\Heartbeat"

DeleteFolder oWShell.ExpandEnvironmentStrings("%userprofile%") & "\Microsoft Office"

DeleteFolder oWShell.ExpandEnvironmentStrings("%userprofile%") & "\Microsoft Office 15"

DeleteFolder oWShell.ExpandEnvironmentStrings("%userprofile%") & "\Microsoft Office 16"

' restore explorer.exe if needed

If dicDelFolder.Count > 0 Then

If dicDelInUse.Count > 0 Then ScheduleDeleteEx

Set oFolder = oFso.GetFolder(sFolder)

If CBool(oFolder.Attributes AND 1024) Then Exit Sub

For Each fld In oFolder.SubFolders

CleanShortcuts fld.Path, fDelete, fUnPin

For Each file In oFolder.Files

If LCase(Right(file.Path, 4)) = ".lnk" Then

LogOnly " check file: " & file.Path

set sc = oWShell.CreateShortcut(file.Path)

'Compare if the shortcut target is in the list of executables that will be removed

'LogOnly " - SC.TargetPath: " & sc.TargetPath

If Len(sc.TargetPath) > 0 Then

If InStr(sc.TargetPath,"{") > 0 Then

'Handle Windows Installer shortcuts

If Len(sc.TargetPath) >= InStr(sc.TargetPath,"{")   37 Then

If CheckDelete(Mid(sc.TargetPath, InStr(sc.TargetPath,"{"), 38)) Then fDeleteSC = True

If IsC2R(sc.TargetPath) Then fDeleteSC = True

If NOT oFso.FileExists(sc.TargetPath) Then

If IsC2R(sc.TargetPath) Then

LogOnly "removing Office shortcut with non-existent target: " & file.Path & " - " & sc.TargetPath

'LogOnly " - keep orphaned SC as target is not in scope: " & sc.TargetPath

'LogOnly " - keep SC as shortcut target does still exist: " & sc.TargetPath

If NOT dicDelFolder.Exists(sFolder) Then dicDelFolder.Add sFolder, sFolder

DeleteFile file.Path

Set fldItem = oShellApp.NameSpace(file.ParentFolder.Path).ParseName(file.Name)

For Each verb in fldItem.Verbs

verb.DoIt

If iVersionNT > 600 Then verb.DoIt

' Recursively search and clear the HKLM Office key from references in scope

Sub ClearOfficeHKLM (sSubKeyName)

Dim key, name

Dim arrKeys, arrNames, arrTypes

Dim arrTestNames, arrTestTypes, arrTestKeys

If RegEnumKey(HKLM, sSubKeyName, arrKeys) Then

For Each key in arrKeys

ClearOfficeHKLM sSubKeyName & "\" & key

Next 'key

If RegEnumValues(HKLM, sSubKeyName, arrNames, arrTypes) Then

' clear out empty keys

If (NOT RegEnumValues(HKLM, sSubKeyName, arrNames, arrTypes)) AND _

(NOT RegEnumKey(HKLM, sSubKeyName, arrKeys)) AND _

(NOT dictionaryKeepSku.Count > 0) Then _

RegDeleteKey HKLM, sSubKeyName

' Check if the passed in string is related to C2R

' Test the permissions on some key registry locations to determine if

Const KEY_QUERY_VALUE = &H0001

Const KEY_SET_VALUE = &H0002

Const KEY_CREATE_SUB_KEY = &H0004

Dim sSubKeyName

sSubKeyName = "Software\Microsoft\Windows\"

oReg.CheckAccess HKLM, sSubKeyName, KEY_QUERY_VALUE, fReturn

oReg.CheckAccess HKLM, sSubKeyName, KEY_SET_VALUE, fReturn

oReg.CheckAccess HKLM, sSubKeyName, KEY_CREATE_SUB_KEY, fReturn

oReg.CheckAccess HKLM, sSubKeyName, DELETE, fReturn

iParentProcessId = GetObject("winmgmts:root\cimv2").Get("Win32_Process.Handle='" & oWShell.Exec("cscript.exe").ProcessId & "'").ParentProcessId

Err.Clear

Set Processes = oWmiLocal.ExecQuery("Select * From Win32_Process WHERE Name='cscript.exe' AND CommandLine like '%" & SCRIPTNAME & "%'")

iParentProcessId = Process.ProcessId

' Returns the delimiter for a passed in string

Dim Argument, sCmd

sCmd = Replace(LCase(wscript.Path), "syswow64", "sysnative") & "\cscript.exe " & Chr(34) & WScript.scriptFullName & Chr(34)

If Wscript.Arguments.Count > 0 Then

For Each Argument in Wscript.Arguments

sCmd = sCmd & " " & chr(34) & Argument & chr(34)

Wscript.Quit CLng(oWShell.Run(sCmd, 1, True))

Dim sCmdLine, sRetValFile, sValue

Set oShell = CreateObject("Shell.Application")

sCmdLine = Chr(34) & WScript.ScriptFullName & Chr(34)

sCmdLine = sCmdLine & " " & chr(34) & Argument & chr(34)

' oWShell.Popup "System reboot complete. OffScrub will now prompt for elevation!", 10, SCRIPTNAME & " - NOTE!"

oShell.ShellExecute "cscript.exe", sCmdLine & " /NoElevate UAC", "", "runas", 1

WScript.Sleep 500

Set Processes = oWmiLocal.ExecQuery("Select * From Win32_Process WHERE ParentProcessId='" & iParentProcessId & "'")

If Processes.Count > 0 Then

iSpawnedProcessId = Process.ProcessId

While oWmiLocal.ExecQuery("Select * From Win32_Process WHERE ProcessId='" & iSpawnedProcessId & "'").Count > 0

WScript.Sleep 3000

Wscript.Quit GetRetValFromFile

Dim sCmdLine

sCmdLine = "cmd.exe /c " & WScript.Path & "\cscript.exe //NOLOGO " & Chr(34) & WScript.scriptFullName & Chr(34)

sCmdLine = sCmdLine & " " & chr(34) & Argument & chr(34)

Wscript.Quit CLng(oWShell.Run(sCmdLine, 1, True))

'don't fail script execution if writing the return value to file fails

Set RetValFileStream = oFso.createTextFile(sScrubDir & "\" & RETVALFILE, True, True)

RetValFileStream.Write iError

RetValFileStream.Close

On Error Resume Next 'don't fail script execution when getting the return value from file fails

If oFso.FileExists(sScrubDir & "\" & RETVALFILE) Then

Set RetValFileStream = oFso.OpenTextFile(sScrubDir & "\" & RETVALFILE, 1, False, -2)

GetRetValFromFile = RetValFileStream.ReadAll

RetValFileStream.Close

Set DateTime = CreateObject("WbemScripting.SWbemDateTime")

DateTime.SetVarDate Now, True

sLogName = sLogDir & "\" & oWShell.ExpandEnvironmentStrings("%COMPUTERNAME%")

sLogName = sLogName & "_" & Left(DateTime.Value, 14)

sLogName = sLogName & "_ScrubLog.txt"

Set LogStream = oFso.CreateTextFile(sLogName, True, True)

sLogName = sLogDir & "\" & oWShell.ExpandEnvironmentStrings("%COMPUTERNAME%")

sLogName = sLogName & "_" & Left(DateTime.Value, 14)

sLogName = sLogName & "_ScrubLog.txt"

Set LogStream = oFso.CreateTextFile(sLogName, True, True)

Log "Microsoft Customer Support Services - " & ONAME & " Removal Utility" & vbCrLf &_

fLogInitialized = True

Function HiveString(hDefKey)

Select Case hDefKey

Case HKCR : HiveString = "HKEY_CLASSES_ROOT"

Case HKCU : HiveString = "HKEY_CURRENT_USER"

Case HKLM : HiveString = "HKEY_LOCAL_MACHINE"

Case HKU : HiveString = "HKEY_USERS"

Case Else : HiveString = hDefKey

' RegKeyExists

' Returns a boolean for the test on existence of a given registry key

Function RegKeyExists(hDefKey, sSubKeyName)

RegKeyExists = False

If oReg.EnumKey(hDefKey, sSubKeyName, arrKeys) = 0 Then RegKeyExists = True

Function RegValExists(hDefKey,sSubKeyName,sName)

If Not RegKeyExists(hDefKey,sSubKeyName) Then Exit Function

If oReg.EnumValues(hDefKey,sSubKeyName,arrValueNames,arrValueTypes) = 0 AND IsArray(arrValueNames) Then

End If 'oReg.EnumValues

' The correct type has to be passed in as argument

Function RegReadValue(hDefKey, sSubKeyName, sName, sValue, sType)

RetVal = oReg.GetStringValue(hDefKey, sSubKeyName, sName, sValue)

If Not RetVal = 0 AND f64 Then RetVal = oReg.GetStringValue(hDefKey, Wow64Key(hDefKey, sSubKeyName), sName, sValue)

RetVal = oReg.GetExpandedStringValue(hDefKey, sSubKeyName, sName, sValue)

If NOT RetVal = 0 AND f64 Then RetVal = oReg.GetExpandedStringValue(hDefKey, Wow64Key(hDefKey, sSubKeyName), sName, sValue)

RetVal = oReg.GetBinaryValue(hDefKey, sSubKeyName, sName, sValue)

If NOT RetVal = 0 AND f64 Then RetVal = oReg.GetBinaryValue(hDefKey, Wow64Key(hDefKey, sSubKeyName), sName, sValue)

RetVal = oReg.GetDWORDValue(hDefKey, sSubKeyName, sName, sValue)

If NOT RetVal = 0 AND f64 Then RetVal = oReg.GetDWORDValue(hDefKey, Wow64Key(hDefKey, sSubKeyName), sName, sValue)

RetVal = oReg.GetMultiStringValue(hDefKey, sSubKeyName, sName, arrValues)

If NOT RetVal = 0 AND f64 Then RetVal = oReg.GetMultiStringValue(hDefKey, Wow64Key(hDefKey, sSubKeyName), sName, arrValues)

If RetVal = 0 Then sValue = Join(arrValues, chr(13))

' Enumerate a registry key to return all values

Function RegEnumValues(hDefKey, sSubKeyName, arrNames, arrTypes)

RetVal = oReg.EnumValues(hDefKey, sSubKeyName, arrNames32, arrTypes32)

RetVal64 = oReg.EnumValues(hDefKey, Wow64Key(hDefKey, sSubKeyName), arrNames64, arrTypes64)

arrNames = RemoveDuplicates(Split((Join(arrNames32, "\") & "\" & Join(arrNames64, "\")), "\"))

arrTypes = RemoveDuplicates(Split((Join(arrTypes32, "\") & "\" & Join(arrTypes64, "\")), "\"))

RetVal = oReg.EnumValues(hDefKey, sSubKeyName, arrNames, arrTypes)

' RegEnumKey

' Enumerate a registry key to return all subkeys

Function RegEnumKey(hDefKey, sSubKeyName, arrKeys)

Dim arrKeys32, arrKeys64

RetVal = oReg.EnumKey(hDefKey, sSubKeyName, arrKeys32)

RetVal64 = oReg.EnumKey(hDefKey, Wow64Key(hDefKey, sSubKeyName), arrKeys64)

If (RetVal = 0) AND (NOT RetVal64 = 0) AND IsArray(arrKeys32) Then arrKeys = arrKeys32

If (Not RetVal = 0) AND (RetVal64 = 0) AND IsArray(arrKeys64) Then arrKeys = arrKeys64

If IsArray(arrKeys32) AND IsArray (arrKeys64) Then

arrKeys = RemoveDuplicates(Split((Join(arrKeys32, "\") & "\" & Join(arrKeys64, "\")), "\"))

ElseIf IsArray(arrKeys64) Then

arrKeys = arrKeys64

arrKeys = arrKeys32

RetVal = oReg.EnumKey(hDefKey, sSubKeyName, arrKeys)

RegEnumKey = ((RetVal = 0) OR (RetVal64 = 0)) AND IsArray(arrKeys)

End Function 'RegEnumKey

' Wrapper around oReg.DeleteValue to handle 64 bit

Sub RegDeleteValue(hDefKey, sSubKeyName, sName, fRegMultiSZ)

Dim sDelKeyName, sValue

sSubKeyName = sSubKeyName & "\"

While InStr(sSubKeyName, "\\") > 0

sSubKeyName = Replace(sSubKeyName, "\\", "\")

fKeep = dictionaryKeepReg.Exists(LCase(sSubKeyName & sName))

If (NOT fKeep AND f64) Then fKeep = dictionaryKeepReg.Exists(LCase(Wow64Key(hDefKey, sSubKeyName) & sName))

LogOnly "Disallowing the delete of still required keypath element: " & HiveString(hDefKey) & "\" & sSubKeyName & sName

LogOnly "Enforced delete of still required keypath element: " & HiveString(hDefKey) & "\" & sSubKeyName & sName

If RegValExists(hDefKey, sSubKeyName, sName) Then

sDelKeyName = sSubKeyName

ElseIf RegValExists(hDefKey, Wow64Key(hDefKey, sSubKeyName), sName) Then

sDelKeyName = Wow64Key(hDefKey, sSubKeyName)

LogOnly "Value not found. Cannot delete value: " & HiveString(hDefKey) & "\" & sSubKeyName & sName

If RegReadValue(hDefKey, sDelKeyName, sName, sValue, "REG_MULTI_SZ") AND NOT fRegMultiSZ Then

LogOnly "Disallowing unsafe delete of REG_MULTI_SZ: " & HiveString(hDefKey) & "\" & sDelKeyName & sName

' execute delete operation

LogOnly "Delete registry value: " & HiveString(hDefKey) & "\" & sDelKeyName & " -> " & sName

iRetVal = oReg.DeleteValue(hDefKey, sDelKeyName, sName)

LogOnly "Preview mode. Disallowing delete registry value: " & HiveString(hDefKey) & "\" & sDelKeyName & " -> " & sName

' RegDeleteKey

' Wrappper around RegDeleteKeyEx to handle 64bit

Sub RegDeleteKey(hDefKey, sSubKeyName)

Dim sDelKeyName

fKeep = dictionaryKeepReg.Exists(LCase(sSubKeyName))

If (NOT fKeep AND f64) Then fKeep = dictionaryKeepReg.Exists(LCase(Wow64Key(hDefKey, sSubKeyName)))

LogOnly "Disallowing the delete of still required keypath element: " & HiveString(hDefKey) & "\" & sSubKeyName

LogOnly "Enforced delete of still required keypath element: " & HiveString(hDefKey) & "\" & sSubKeyName

If Len(sSubKeyName) > 1 Then

sSubKeyName = Left(sSubKeyName, Len(sSubKeyName) - 1)

' ensure key exists

If RegKeyExists(hDefKey, sSubKeyName) Then

ElseIf f64 AND RegKeyExists(hDefKey, Wow64Key(hDefKey, sSubKeyName)) Then

sDelKeyName = Wow64Key(hDefKey, sSubKeyName)

LogOnly "Key not found. Cannot delete key: " & HiveString(hDefKey) & "\" & sSubKeyName

' execute delete

LogOnly "Delete registry key: " & HiveString(hDefKey) & "\" & sDelKeyName

RegDeleteKeyEx hDefKey, sDelKeyName

LogOnly "Preview mode. Disallowing delete of registry key: " & HiveString(hDefKey) & "\" & sSubKeyName

End Sub 'RegDeleteKey

' RegDeleteKeyEx

Sub RegDeleteKeyEx(hDefKey, sSubKeyName)

Dim arrSubkeys

Dim sSubkey

If Right(sSubKeyName, 1) = "\" Then sSubKeyName = Left(sSubKeyName, Len(sSubKeyName) - 1)

If (hDefKey = HKLM) AND (sSubKeyName = "SOFTWARE\Microsoft\Office\15.0\ClickToRun") Then

iRetVal = oWShell.Run("reg delete HKLM\SOFTWARE\Microsoft\Office\15.0\ClickToRun /f", 0, True)

oReg.EnumKey hDefKey, sSubKeyName, arrSubkeys

If IsArray(arrSubkeys) Then

For Each sSubkey In arrSubkeys

RegDeleteKeyEx hDefKey, sSubKeyName & "\" & sSubkey

iRetVal = oReg.DeleteKey(hDefKey, sSubKeyName)

End Sub 'RegDeleteKeyEx

' Wow64Key

' Return the 32bit regkey location on a 64bit environment

Function Wow64Key(hDefKey, sSubKeyName)

If Left(sSubKeyName, 17) = "Software\Classes\" Then

Wow64Key = Left(sSubKeyName, 17) & "Wow6432Node\" & Right(sSubKeyName, Len(sSubKeyName) - 17)

iPos = InStr(sSubKeyName, "\")

Wow64Key = Left(sSubKeyName, iPos) & "Wow6432Node\" & Right(sSubKeyName, Len(sSubKeyName) - iPos)

Wow64Key = "Wow6432Node\" & sSubKeyName

End Select 'hDefKey

End Function 'Wow64Key

Set dicNoDupes = CreateObject("Scripting.Dictionary")

If Not dicNoDupes.Exists(Item) Then dicNoDupes.Add Item,Item

RemoveDuplicates = dicNoDupes.Keys

LogOnly " Error: " & sModule & " - Source: " & Err.Source & "; Err# (Hex): " & Hex( Err ) & _

"; Err# (Dec): " & Err & "; Description : " & Err.Description

LogStream.WriteLine ""

If NOT fQuiet AND fCScript Then wscript.echo ""

If NOT fQuiet AND fCScript Then wscript.echo sLog

LogStream.WriteLine sLog

' Write w/o indent Cmd window and the log file

' Echos the log string to the Cmd window and the log file

wscript.echo sLog

LogStream.WriteLine " " & Time & ": " & sLog

Err.Clear

If sProd = "{6C1ADE97-24E1-4AE4-AEDD-86D3A209CE60}" Then fInScope = True

If sProd = "{9520DDEB-237A-41DB-AA20-F2EF2360DCEB}" Then fInScope = True

If sProd = UCase("{9AC08E99-230B-47e8-9721-4577B7F124EA}") Then fInScope = True

If dictionaryKeepSku.Exists(UCase(sProductCode)) Then Exit Function

Dim sQuery, sStates, sProcessName, sCmd

Set Services = oWmiLocal.Execquery(sQuery)

Log " Found service " & sName & " (" & srvc.DisplayName & ") in state " & srvc.State

sProcessName = Trim(Replace(Mid(srvc.PathName, InStrRev(srvc.PathName,"\")   1), chr(34), ""))

If InStr(sStates, UCase(srvc.State)) > 0 Then

iRet = srvc.StopService()

Set Processes = oWmiLocal.ExecQuery("Select * From Win32_Process Where Name='" & sProcessName & "'")

If Not InStr(process.Name, "OInstall") > 0 Then

iRet = process.Terminate()

iRet = srvc.Delete()

sCmd = "sc delete " & sName

iRet = oWShell.Run(sCmd, 0, True)

'msiexec return values

Case 1623 : SetupRetVal = "INSTALL_LANGUAGE_UNSUPPORTED"

Case 1630 : SetupRetVal = "UNSUPPORTED_TYPE"

Case 1633 : SetupRetVal = "INSTALL_PLATFORM_UNSUPPORTED"

Case 1637 : SetupRetVal = "PATCH_PACKAGE_UNSUPPORTED"

Case 1646 : SetupRetVal = "PATCH_REMOVAL_UNSUPPORTED"

fKeep = dictionaryKeepFolder.Exists(LCase(sFile))

If (NOT fKeep AND f64) Then fKeep = dictionaryKeepFolder.Exists(LCase(Wow64Folder(sFile)))

LogOnly "Disallowing the delete of still required keypath element: " & sFile

LogOnly "Enforced delete of still required keypath element: " & sFile

If oFso.FileExists(sFile) Then

ElseIf f64 AND oFso.FileExists(Wow64Folder(sFile)) Then

Set File = oFso.GetFile(sDelFile)

attr = File.Attributes

If CBool(attr AND 1) Then File.Attributes = attr AND (attr - 1)

If NOT dicDelFolder.Exists(File.ParentFolder.Path) Then dicDelFolder.Add File.ParentFolder.Path, File.ParentFolder.Path

sFile = File.Path

File.Delete True

Dim sDelFolder, sFolderName, sNewPath, sCmd

fKeep = dictionaryKeepFolder.Exists(LCase(sFolder))

If (NOT fKeep AND f64) Then fKeep = dictionaryKeepFolder.Exists(LCase(Wow64Folder(sFolder)))

LogOnly "Disallowing the delete of still required keypath element: " & sFolder

LogOnly "Enforced delete of still required keypath element: " & sFolder

If oFso.FolderExists(sFolder) Then

ElseIf f64 AND oFso.FolderExists(Wow64Folder(sFolder)) Then

Set Folder = oFso.GetFolder(sDelFolder)

attr = Folder.Attributes

If CBool(attr AND 1) Then Folder.Attributes = attr AND (attr - 1)

If NOT dicDelFolder.Exists(Folder.Path) Then dicDelFolder.Add Folder.Path, Folder.Path

sCmd = "cmd.exe /c rd /s " & chr(34) & sDelFolder & chr(34) & " /q"

oWShell.Run sCmd, 0, True

If NOT oFso.FolderExists(sDelFolder) Then Exit Sub

Folder.Delete True

sCmd = "cmd.exe /c rd /s " & chr(34) & sDelFolder & chr(34) & " /q"

oWShell.Run sCmd, 0, True

If NOT oFso.FolderExists(sDelFolder) Then Exit Sub

sCmd = "cmd.exe /c rd /s " & chr(34) & sDelFolder & chr(34) & " /q"

oWShell.Run sCmd, 0, True

If NOT oFso.FolderExists(sDelFolder) Then Exit Sub

Set Folder = oFso.GetFolder(sDelFolder)

For Each fld in Folder.Subfolders

sCmd = "cmd.exe /c rd /s " & chr(34) & fld.Path & chr(34) & " /q"

sCmd = "cmd.exe /c del " & chr(34) & fld.Path & "\*.*" & chr(34)

oWShell.Run sCmd, 0, True

Set Folders = oWmiLocal.ExecQuery ("Select * from Win32_Directory where name = '" & sWqlFolder & "'")

iRet = Folder.Delete

' Returns the WOW folder structure to handle folder-path operations on

If NOT dicDelInUse.Exists(sFile) Then dicDelInUse.Add sFile, sFile Else Exit Sub

attr = oFolder.Attributes

For Each fld In oFolder.SubFolders

DeleteFolder fld.Path

For Each file In oFolder.Files

DeleteFile file.Path

If NOT dicDelInUse.Exists(oFolder.Path) Then dicDelInUse.Add oFolder.Path, "" Else Exit Sub

LogOnly "Adding folder for delete on reboot: " & oFolder.Path

' affected files/folders to the PendingFileRenameOperations registry entry

Dim key, hDefKey, sKeyName, sValueName

sKeyName = "SYSTEM\CurrentControlSet\Control\Session Manager"

sValueName = "PendingFileRenameOperations"

LogH2 "Adding " & dicDelInUse.Count & " PendingFileRenameOperations"

If NOT RegValExists(hDefKey, sKeyName, sValueName) Then

oReg.GetMultiStringValue hDefKey, sKeyName, sValueName, arrData

ReDim Preserve arrData(UBound(arrData)   (dicDelInUse.Count * 2))

For Each key in dicDelInUse.Keys

LogOnly " " & key

arrData(i) = "\??\" & key

Next 'key

oReg.SetMultiStringValue hDefKey, sKeyName, sValueName, arrData

If oFso.FolderExists(sFolder) Then

Set Folder = oFso.GetFolder(sFolder)

If (Folder.Subfolders.Count = 0) AND (Folder.Files.Count = 0) Then

For Each sFolder in dicDelFolder.Keys

If oFso.FolderExists(sFolder) Then

Set Folder = oFso.GetFolder(sFolder)

If (Folder.Subfolders.Count = 0) AND (Folder.Files.Count = 0) Then

ElseIf f64 AND oFso.FolderExists(Wow64Folder(sFolder)) Then

' Executes the folder delete operation(s)

Set Folder = oFso.GetFolder(oFso.GetParentFolderName(sFolder))

If (Folder.Subfolders.Count = 0) AND (Folder.Files.Count = 0) Then SmartDeleteFolderEx(Folder.Path)

' Ensure Windows Explorer is restarted if needed

wscript.sleep 1000

Set Processes = oWmiLocal.ExecQuery("Select * From Win32_Process Where Name='explorer.exe'")

If Processes.Count < 1 Then

oWShell.Run "explorer.exe"

oWShell.Run "SCHTASKS /Create /TN OffScrEx /TR explorer /SC ONCE /ST 12:00 /IT", 0, True

oWShell.Run "SCHTASKS /Run /TN OffScrEx", 0, True

oWShell.Run "SCHTASKS /Delete /TN OffScrEx /F", 0, False

' MyJoin

' Replacement function to the internal Join function to prevent failures

Function MyJoin(arrToJoin, sSeparator)

Dim sJoined

sJoined = ""

If IsArray(arrToJoin) Then

For i = 0 To UBound(arrToJoin)

sJoined = sJoined & arrToJoin(i) & sSeparator

If Len(sJoined) > 1 Then sJoined = Left(sJoined, Len(sJoined) - 1)

MyJoin = sJoined

oFso.CopyFile WScript.scriptFullName, sScrubDir & "\" & SCRIPTFILE

oReg.CreateKey HKLM, "SOFTWARE"

oReg.CreateKey HKLM, "SOFTWARE\Microsoft"

oReg.CreateKey HKLM, "SOFTWARE\Microsoft\Office"

oReg.CreateKey HKLM, "SOFTWARE\Microsoft\Office\15.0"

oReg.CreateKey HKLM, "SOFTWARE\Microsoft\Office\15.0\CleanC2R"

oReg.SetDWordValue HKLM, "SOFTWARE\Microsoft\Office\15.0\CleanC2R", "Rerun", 1

' oReg.CreateKey HKCU, "SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce"

' oReg.SetStringValue HKCU, "SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce", "CleanC2R", "cscript.exe " & chr(34) & sScrubDir & "\" & SCRIPTFILE & chr(34)

oReg.CreateKey HKLM, "SOFTWARE\Microsoft\Windows\CurrentVersion"

oReg.CreateKey HKLM, "SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce"

sValue = "cscript.exe " & chr(34) & sScrubDir & "\" & SCRIPTFILE & chr(34) & " /NoElevate /Relaunched"

oReg.SetStringValue HKLM, "SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce", "O15CleanUp", sValue

' Name: OffScrub_O15msi.vbs

Const SCRIPTFILE = "OffScrub_O15msi.vbs"

Const REG_ARP = "SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\"

Const LYNC_ALL = "{4A2C120F-307B-4400-B239-F29ADB54D3C6}{5CFD6599-10E5-4CF0-B6E1-BF39D30A64F8}{5CFD6599-10E5-4CF0-B6E1-BF39D30A64F8}{BF3AC8BA-1A0F-42AD-8B65-4250617AF682}{3475BF22-3564-4EF3-A633-C5F3F4582392}{263BA91B-7782-4EEB-A4FC-7BD554CAF1F3}{AA256AE1-6B6A-48E6-9957-B38F92CA614B}{D79732A1-BB17-4789-AE75-69D61261E305}{C7B887F2-07CA-4903-93A2-9B4E16E4EABD}{81BE0B17-563B-45D4-B198-5721E6C665CD}{11298539-8073-4D54-B6A0-88D4FA512E5C}{C192041D-2861-4E02-9F43-4041858A58F1}{7023C711-0E65-471E-8048-12C455968841}{58A013B1-1613-4978-881A-FCA43710C84A}{7FD6C049-9777-4B51-91FF-B19D79ADF439}{D3001D99-675B-44DF-A8EB-A7BB6F864DB7}{0C5EA724-8649-47FA-B505-75B35390378D}{13DE0C92-2AE4-48D0-8CC8-58D5E327BDCB}{E7EC16E6-C220-41C0-9C91-5E7702B8EC86}{1B10C75C-70E1-460E-B07B-D7DFF365D80F}{331977BC-B246-46B4-8829-1D52F41C8C7B}{D8255EF2-0BB2-4AF1-A662-5EBACD179475}{DD069437-C92B-4C1C-A992-14F6C7E12C2C}{E9E30DB3-8D72-43A0-B1B8-A6F8261D20D6}{545B7E32-E254-40E1-8935-91C61E3D02C2}{70409E9E-AFAE-4C05-AE57-F83B89819434}{1D6E3225-753D-41AD-A2C4-68684700F592}{217AA75D-82C0-4C49-9252-A0E6F9661688}{5AB81CD4-7C78-420C-AAAC-855C4BADBDDD}{AA595672-6515-4961-B81F-485F86627C76}{C9F2C38C-21F0-4687-8C7D-51AA02CE8C98}{DD80DED6-700D-4CC5-B2A9-C64A1AD155B9}{88257193-EC61-4152-8AB1-A5FB4BE638D7}{7D9109C3-58A9-4AFD-A1D3-47E7D811726E}{71C6D199-5B8E-41E7-BA36-D99F66E0072E}{1CFE7869-777D-4563-8161-2C75ED95B621}{FE25DDB2-5766-4A9E-86D2-2B709CC8F65D}{621F7793-1C51-45BA-899F-41557946B0E3}{B31017AA-FBF8-4003-8785-EC789C2AE0C2}{11849FBC-C416-4742-8279-17C3A2C85F72}{4F380D4B-A84D-45C7-AF58-59EA2AEDF35A}{81BE0B17-563B-45D4-B198-5721E6C665CD}"

Dim ComputerItem, Item, LogStream, TmpKey

Dim KeepProd, KeepLis, dicApps, KeepFolder, dicDelRegKey, KeepReg

Dim fPassive : fPassive = True

Dim fLogInitialized : fLogInitialized = False

Dim fBypass_Stage1 : fBypass_Stage1 = True 'Component Detection

Dim fBypass_Stage2 : fBypass_Stage2 = False 'Setup

Dim fBypass_Stage3 : fBypass_Stage3 = False 'Msiexec

Dim fBypass_Stage4 : fBypass_Stage4 = False 'CleanUp

Set oWmiLocal = GetObject("winmgmts:{(Debug)}\\.\root\cimv2")

Set oWShell = CreateObject("Wscript.Shell")

Set oShellApp = CreateObject("Shell.Application")

Set oFso = CreateObject("Scripting.FileSystemObject")

Set oMsi = CreateObject("WindowsInstaller.Installer")

Set oReg = GetObject("winmgmts:\\.\root\default:StdRegProv")

sAppData = oWShell.ExpandEnvironmentStrings("%appdata%")

sLocalAppData = oWShell.ExpandEnvironmentStrings("%localappdata%")

sTemp = oWShell.ExpandEnvironmentStrings("%temp%")

sAllUsersProfile = oWShell.ExpandEnvironmentStrings("%allusersprofile%")

RegReadValue HKLM, "SOFTWARE\Microsoft\Windows NT\CurrentVersion\ProfileList", "ProfilesDirectory", sProfilesDirectory, "REG_EXPAND_SZ"

If NOT oFso.FolderExists(sProfilesDirectory) Then

sProfilesDirectory = oFso.GetParentFolderName(oWShell.ExpandEnvironmentStrings("%userprofile%"))

sProgramFiles = oWShell.ExpandEnvironmentStrings("%programfiles%")

'sProgramFilesX86 = oWShell.ExpandEnvironmentStrings("%programfiles(x86)%")

sCommonProgramFiles = oWShell.ExpandEnvironmentStrings("%commonprogramfiles%")

'sCommonProgramFilesX86 = oWShell.ExpandEnvironmentStrings("%CommonProgramFiles(x86)%")

sProgramData = oWSHell.ExpandEnvironmentStrings("%programdata%")

sWinDir = oWShell.ExpandEnvironmentStrings("%windir%")

sScriptDir = wscript.ScriptFullName

fCScript = UCase(Mid(Wscript.FullName, Len(Wscript.Path)   2, 1)) = "C"

Set ComputerItem = oWmiLocal.ExecQuery("Select * from Win32_ComputerSystem")

f64 = Instr(Left(Item.SystemType,3),"64") > 0

If f64 Then sProgramFilesX86 = oWShell.ExpandEnvironmentStrings("%programfiles(x86)%")

If f64 Then sCommonProgramFilesX86 = oWShell.ExpandEnvironmentStrings("%CommonProgramFiles(x86)%")

Set ComputerItem = oWmiLocal.ExecQuery("Select * from Win32_OperatingSystem")

sOSinfo = sOSinfo & Item.Caption

sOSinfo = sOSinfo & Item.OtherTypeDescription

sOSinfo = sOSinfo & ", " & "SP " & Item.ServicePackMajorVersion

sOSinfo = sOSinfo & ", " & "Version: " & Item.Version

sOsVersion = Item.Version

sOSinfo = sOSinfo & ", " & "Codepage: " & Item.CodeSet

sOSinfo = sOSinfo & ", " & "Country Code: " & Item.CountryCode

sOSinfo = sOSinfo & ", " & "Language: " & Item.OSLanguage

If InStr(LCase(wscript.path), "syswow64") > 0 Then RelaunchAs64Host

If UCase(Mid(Wscript.FullName, Len(Wscript.Path)   2, 1)) = "C" Then

If Not fLogInitialized Then CreateLog

TmpKeyCleanUp

wscript.quit 3

Set KeepProd = CreateObject("Scripting.Dictionary")

Set dicInstalledSku = CreateObject("Scripting.Dictionary")

Set dicRemoveSku = CreateObject("Scripting.Dictionary")

Set KeepSku = CreateObject("Scripting.Dictionary")

Set KeepLis = CreateObject("Scripting.Dictionary")

Set KeepFolder = CreateObject("Scripting.Dictionary")

Set dicApps = CreateObject("Scripting.Dictionary")

Set dicDelRegKey = CreateObject("Scripting.Dictionary")

Set KeepReg = CreateObject("Scripting.Dictionary")

Set dicSrv = CreateObject("Scripting.Dictionary")

Set dicCSuite = CreateObject("Scripting.Dictionary")

Set dicCSingle = CreateObject("Scripting.Dictionary")

If Not oFso.FolderExists(sScrubDir) Then oFso.CreateFolder sScrubDir

EnsureValidWIMetadata HKLM,"SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Products",COMPRESSED

EnsureValidWIMetadata HKLM,"SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components",COMPRESSED

'Add initial known .exe files that might need to be closed

dicApps.Add "communicator.exe", "communicator.exe"

dicApps.Add "setup.exe", "setup.exe"

dicApps.Add "bcssync.exe","bcssync.exe"

dicApps.Add "officesas.exe","officesas.exe"

dicApps.Add "officesasscheduler.exe","officesasscheduler.exe"

dicApps.Add "msosync.exe","msosync.exe"

dicApps.Add "onenotem.exe","onenotem.exe"

If dicInstalledSku.Count > 0 Then Log "Found registered product(s): " & Join(RemoveDuplicates(dicInstalledSku.Items),",") &vbCrLf

If dicRemoveSku.Count > 0 Then Log "Product(s) to be removed: " & Join(RemoveDuplicates(dicRemoveSku.Items),",")

If NOT dicRemoveSku.Count > 0 Then sMode = "Orphaned " & ONAME & " products"

If fDetectOnly Then Log "* All uninstall and delete operations will only be logged not executed! *"

'Cache .msi files

If dicRemoveSku.Count > 0 Then CacheMsiFiles

If NOT fSkipSD AND dicRemoveSku.Count > 0 Then

If Not fBypass_Stage1 OR fForce Then

If fForce OR fQuiet OR fPassive Then CloseOfficeApps

'Stage # 2 - Setup.exe |

sTmp = "Stage # 2 " & chr(34) & "Setup.exe" & chr(34) & " (" & Time & ")"

If Not fBypass_Stage2 Then

SetupExeRemoval

Log "Skipping Setup.exe because bypass was requested."

'Stage # 3 - Msiexec.exe |

sTmp = "Stage # 3 " & chr(34) & "Msiexec.exe" & chr(34) & " (" & Time & ")"

If Not fBypass_Stage3 Then

MsiexecRemoval

Log "Skipping Msiexec.exe because bypass was requested."

If Not fBypass_Stage4 Then

If fForce OR fQuiet OR fPassive Then RestoreExplorer

'Wipe orphaned files from Windows Installer cache

'Temporary .msi files in scrubcache

Log "Skipping CleanUp because bypass was requested."

Log vbCrLf & "A restart is required to complete the operation!"

If MsgBox("Do you want to reboot now?",vbYesNo,"Reboot Required") = VB_YES Then

Set oWmiReboot = GetObject("winmgmts:{impersonationLevel=impersonate,(Shutdown)}!\\.\root\cimv2")

Set colOS = oWmiReboot.ExecQuery ("Select * from Win32_OperatingSystem")

oOS.Reboot()

For Each Item in Wscript.Arguments

wscript.stdout.write "Press <Enter> to close this window"

sTemp = wscript.stdin.read(1)

'Office configuration products are listed with their configuration product name in the "Uninstall" key

Dim sCurKey, sValue, sConfigName, sProdC, sCVHValue

Dim arrKeys, arrMultiSzValues

If dicInstalledSku.Count > 0 Then Exit Sub 'Already done from InputBox prompt

For Each File in oFso.GetFolder(sWICacheDir).Files

If Len(File.Name)>3 Then

Select Case LCase(Right(File.Name,4))

Case ".msi"

sProductCode = GetMsiProductCode(File.Path)

If NOT RegKeyExists(HKLM,REG_ARP & sProductCode) Then

oFso.CopyFile File.Path,sScrubDir & "\" & sProductCode & ".msi",True

MsiRegisterProduct File.Path

If RegEnumKey(HKLM,REG_ARP,arrKeys) Then

sCurKey = REG_ARP & ArpItem & "\"

fSystemComponent0 = Not (RegReadValue(HKLM,sCurKey,"SystemComponent",sValue,"REG_DWORD") AND (sValue = "1"))

If (fSystemComponent0 AND (NOT RegReadValue(HKLM,sCurKey,"CVH",sCVHValue,"REG_DWORD"))) Then

RegReadValue HKLM,sCurKey,"DisplayVersion",sValue,"REG_SZ"

If NOT RegKeyExists(HKLM,REG_ARP&sConfigName) Then

oReg.CreateKey HKLM,REG_ARP & sConfigName

oReg.SetMultiStringValue HKLM,REG_ARP & sConfigName,OPACKAGE,arrMultiSzValues

oReg.SetStringValue HKLM, REG_ARP & sConfigName, "Comment", "Temporary OffScrub generated key. Please delete this key!"

oReg.SetMultiStringValue HKLM,REG_ARP & sConfigName,"ProductCodes",arrMultiSzValues

oReg.SetStringValue HKLM,REG_ARP & sConfigName,"DisplayVersion",sValue

oReg.SetStringValue HKLM,REG_ARP & sConfigName,"DisplayName",SCRIPTNAME & "_" & sConfigName

oReg.SetDWordValue HKLM,REG_ARP & sConfigName,"SystemComponent",0

oReg.SetMultiStringValue HKLM,REG_ARP & sConfigName,"ProductCodes",Split(sProdC,chr(34))

End If 'RegKeyExists

fSystemComponent0 = NOT (RegReadValue(HKLM,sCurKey,"SystemComponent",sValue,"REG_DWORD") AND (sValue = "1"))

fPackages = RegReadValue(HKLM,sCurKey,OPACKAGE,sValue,"REG_MULTI_SZ")

fDisplayVersion = RegReadValue(HKLM,sCurKey,"DisplayVersion",sValue,"REG_SZ")

If NOT dicInstalledSku.Exists(sConfigName) Then dicInstalledSku.Add sConfigName,sConfigName

If NOT dicSrv.Exists(UCase(sConfigName)) Then dicSrv.Add UCase(sConfigName),sConfigName

If NOT dicCSuite.Exists(UCase(sConfigName)) Then dicCSuite.Add UCase(sConfigName), sConfigName

If NOT KeepProd.Exists(sProductCode) Then KeepProd.Add sProductCode, sConfigName

If NOT dicCSingle.Exists(UCase(sConfigName)) Then dicCSingle.Add UCase(sConfigName),sConfigName

Const OLEGACY = "78E1-11D2-B60F-006097C998E7}.6000-11D3-8CFE-0050048383C9}.6000-11D3-8CFE-0150048383C9}.BDCA-11D1-B7AE-00C04FB92F3D}.6D54-11D4-BEE3-00C04F990354}"

For Each Product in oMsi.Products

Dim Sku, Key, sProductCode, sProductCodeList

For Each Key in dicInstalledSku.Keys

dicRemoveSku.Add Key,dicInstalledSku.Item(Key)

Next 'Key

KeepSku.Add Key,dicInstalledSku.Item(Key)

If KeepSku.Exists(Sku) Then

'A Sku to remove has been passed in

KeepSku.Remove(Sku)

If NOT dicRemoveSku.Exists(Sku) Then dicRemoveSku.Add Sku,Sku

For Each Key in dicInstalledSku.Keys

If dicCSuite.Exists(Key) Then

If KeepSku.Exists(Key) Then KeepSku.Remove(Key)

If NOT dicRemoveSku.Exists(Key) Then dicRemoveSku.Add Key,Key

Next 'Key

If dicCSingle.Exists(Key) Then

If dicSrv.Exists(Key) Then

If NOT KeepSku.Count > 0 Then fRemoveAll = True

For Each Sku in KeepSku.Keys

If NOT KeepProd.Exists(sProductCode) Then

KeepProd.Add sProductCode, Sku

If Not KeepProd.Exists(GetUpgradeCode(sProductCode)) Then KeepProd.Add GetUpgradeCode(sProductCode), Sku & "_UpgradeCode"

Const O11 = "6000-11D3-8CFE-0150048383C9}"

'Cache .msi files for products that will be removed in case they are needed for later file detection

'Errors will be logged but must not fail the execution

Log " Cache .msi files to temporary Scrub folder"

sMsiFile = oMsi.ProductInfo(Product,"LocalPackage") : CheckError "CacheMsiFiles"

LogOnly " - " & Product & ".msi"

If oFso.FileExists(sMsiFile) Then oFso.CopyFile sMsiFile,sScrubDir & "\" & Product & ".msi",True

Dim sQuery, sSubKeyName, sPath, sFile, sMsiFile, sCompClient, sComponent, sCompReg

Dim hDefKey

Set FileList = oFso.OpenTextFile(sScrubDir & "\FileList.txt",FOR_WRITING,True,True)

Set RegList = oFso.OpenTextFile(sScrubDir & "\RegList.txt",FOR_WRITING,True,True)

Set CompVerbose = oFso.OpenTextFile(sScrubDir & "\CompVerbose.txt",FOR_WRITING,True,True)

Set dicFLError = CreateObject("Scripting.Dictionary")

Set oDic = CreateObject("Scripting.Dictionary")

Set oFolderDic = CreateObject("Scripting.Dictionary")

Set dicCompPath = CreateObject("Scripting.Dictionary")

'Prevent that API errors fail script execution

iCompCnt = oMsi.Components.Count

For Each ComponentID In oMsi.Components

CompVerbose.WriteLine vbCrLf & "Checking Component: " & ComponentID

If fCScript Then wscript.stdout.write "." : LogStream.Write "."

dicCompPath.RemoveAll

For Each CompClient In oMsi.ComponentClients(ComponentID)

CompVerbose.Write " CompClient " & CompClient & "-> "

If fRemoveComponent OR (CompClient = "{00000000-0000-0000-0000-000000000000}") Then

sPath = LCase(oMsi.ComponentPath(CompClient,ComponentID))

If CompClient = "{00000000-0000-0000-0000-000000000000}" Then

CompVerbose.Write "CheckDelete: " & fRemoveComponent & "; "

'Since the scope remains within one Office family the keypath for the component

If NOT dicDelRegKey.Exists(sCompReg) Then

dicDelRegKey.Add sCompReg,HKCR

RegList.WriteLine HiveString(HKCR)&"\"&sCompReg

sCompReg = "SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\"&GetCompressedGuid(ComponentID)&"\"&GetCompressedGuid(CompClient)

dicDelRegKey.Add sCompReg,HKLM

If NOT dicCompPath.Exists(sPath) Then dicCompPath.Add sPath,CompClient

CompVerbose.WriteLine "AffectedComponent: " & fAffectedComponent

CompVerbose.WriteLine " CompClient now set to: " & sCompClient

CompVerbose.Write "InScope: " & fRemoveComponent & "; "

CompVerbose.WriteLine "Error: Invalid metadata"

If NOT dicFLError.Exists("Error: Invalid metadata found. ComponentID: "&ComponentID &", ComponentClient: "&CompClient) Then _

dicFLError.Add "Error: Invalid metadata found. ComponentID: "&ComponentID &", ComponentClient: "&CompClient, ComponentID

CompVerbose.WriteLine "Error: " & Err.number & " " & Err.Description

Err.Clear

fRemoveComponent = fAffectedComponent AND (iRemCnt = oMsi.ComponentClients(ComponentID).Count)

CompVerbose.WriteLine " Component goes away: " & fRemoveComponent

' 'Flag as removable if component has a unique keypath

' sPath = LCase(oMsi.ComponentPath(sCompClient,ComponentID))

' fRemoveComponent = NOT dicCompPath.Exists(sPath)

CompVerbose.WriteLine " msidbComponentAttributesPermanent: " & NOT fRemoveComponent

CompVerbose.WriteLine " RESULT: Component IN SCOPE for removal"

'Add the component registration key to ensure removal

If NOT dicDelRegKey.Exists(sCompReg) Then

dicDelRegKey.Add sCompReg,HKCR

RegList.WriteLine HiveString(HKCR)&"\"&sCompReg

sCompReg = "SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\"&GetCompressedGuid(ComponentID)&"\"

dicDelRegKey.Add sCompReg,HKLM

sPath = LCase(oMsi.ComponentPath(sCompClient,ComponentID))

CompVerbose.WriteLine " Path: " & sPath

'Registry keypath

hDefKey = HKCR

hDefKey = HKCU

hDefKey = HKLM

'compared to deleting the whole key

If NOT dicDelRegKey.Exists(sPath) Then

dicDelRegKey.Add sPath,hDefKey

RegList.WriteLine HiveString(hDefKey)&"\"&sPath

If oFso.FileExists(sPath) OR oFso.FolderExists(sPath) Then

CompVerbose.WriteLine " Folder check OK"

CompVerbose.WriteLine " File check OK"

If fIsFile Then sPath = oFso.GetFile(sPath).ParentFolder

If Not oFolderDic.Exists(sPath) Then

oFolderDic.Add sPath,sPath

FileList.WriteLine sPath & vbTab & "(FOLDER)"

'Get the .msi file

If oFso.FileExists(sScrubDir & "\" & sCompClient & ".msi") Then

sMsiFile = sScrubDir & "\" & sCompClient & ".msi"

sMsiFile = oMsi.ProductInfo(sCompClient,"LocalPackage")

CompVerbose.WriteLine " Set msi file to : " & sMsiFile

CompVerbose.WriteLine " Error: Failed to obtain .msi file for product " & sCompClient

If NOT dicFLError.Exists("Failed to obtain .msi file for product "&sCompClient) Then _

dicFLError.Add "Failed to obtain .msi file for product "&sCompClient, ComponentID

Err.Clear

CompVerbose.Write " Open .msi file for reading returned: "

Set MsiDb = oMsi.OpenDatabase(sMsiFile,MSIOPENDATABASEREADONLY)

CompVerbose.WriteLine " SUCCESS"

Set qView = MsiDb.OpenView(sQuery) : qView.Execute

Set Record = qView.Fetch()

If Not Record Is Nothing Then sComponent = Record.Stringdata(1)

CompVerbose.WriteLine " Obtained ComponentId as: " & sComponent

sFile = Record.StringData(2)

CompVerbose.WriteLine " File: " & sPath& "\" & sFile

If Not oDic.Exists(sPath & "\" & sFile) Then

Case "FPERSON.DLL"

'Catch exception caused by changed .msi keypath authoring logic for smart tags

For Each prod in oMsi.Products

If oMsi.FeatureState(prod, "MSTagPluginNamesFiles") = MSIINSTALLSTATE_LOCAL Then

CompVerbose.WriteLine " Added as new file to dictionary"

oDic.Add sPath & "\" & sFile,sFile

FileList.WriteLine sFile & vbTab & sPath & "\" & sFile

If Right(sFile,4) = ".exe" Then

If NOT dicApps.Exists(sFile) Then

Case "setup.exe","ose.exe","osppsvc.exe","explorer.exe"

dicApps.Add sFile,LCase(sPath) & "\" & sFile

CompVerbose.WriteLine " Added to the list of processes that need to be closed."

End If 'dicApps.Exists

End If '.exe

End If 'oDic.Exists

Set Record = qView.Fetch()

qView.Close

CompVerbose.WriteLine " Error: Could not read from .msi file"

If NOT dicFLError.Exists("Error: Could not read from .msi file: "&sMsiFile) Then _

dicFLError.Add "Error: Could not read from .msi file: "&sMsiFile, ComponentID

CompVerbose.WriteLine " Error: File check FAILED"

CompVerbose.WriteLine " RESULT: Component NOT in scope for removal"

For Each CompClient In oMsi.ComponentClients(ComponentID)

sPath = "" : sPath = LCase(oMsi.ComponentPath(CompClient,ComponentID))

'Registry keypath

hDefKey = HKCR

hDefKey = HKCU

hDefKey = HKLM

If NOT KeepReg.Exists(LCase(sPath)) Then

KeepReg.Add LCase(sPath),hDefKey

'File keypath

If oFso.FileExists(sPath) Then

If NOT KeepFolder.Exists(LCase(sPath)) Then KeepFolder.Add LCase(sPath)

sPath = LCase(oFso.GetFile(sPath).ParentFolder) & "\"

If NOT KeepFolder.Exists(sPath) Then AddKeepFolder sPath

'Folder keypath

If oFso.FolderExists(sPath) Then AddKeepFolder sPath

If dicFLError.Count > 0 Then LogOnly Join(dicFLError.Keys,vbCrLf)

If Not oFolderDic.Count = 0 Then arrDeleteFolders = oFolderDic.Keys Else Set arrDeleteFolders = Nothing

If Not oDic.Count = 0 Then arrDeleteFiles = oDic.Keys Else Set arrDeleteFiles = Nothing

'Try to remove the products by calling setup.exe

Sub SetupExeRemoval

Dim Sku, sConfigFile, sUninstallCmd, sCatalyst, sDll, sDisplayLevel, sNoCancel

If Not dicRemoveSku.Count > 0 Then

Log " Nothing to remove for Setup.exe"

If OseService.Count = 0 Then Exit Sub

If (Service.StartMode = "Disabled") AND (Not Service.ChangeStartMode("Manual")=0) Then Exit Sub

If (Not Service.StartName = "LocalSystem") AND (Service.Change( , , , , , , "LocalSystem", "")) Then Exit Sub

For Each Sku in dicRemoveSku.Keys

'Create an "unattended" config.xml file for uninstall

Set TextStream = oFso.OpenTextFile(sScrubDir & "\config.xml",FOR_WRITING,True,True)

TextStream.Writeline "<Configuration Product=""" & Sku & """>"

TextStream.Writeline "<Display Level=""" & sDisplayLevel & """ CompletionNotice=""No"" SuppressModal=""Yes"" NoCancel=""" & sNoCancel & """ AcceptEula=""Yes"" />"

TextStream.Writeline "<Logging Type=""Verbose"" Path=""" & sLogDir & """ Template=""Microsoft Office " & Sku & " Setup(*).txt"" />"

TextStream.Writeline "<Setting Id=""MSIRESTARTMANAGERCONTROL"" Value=""Disable"" />"

TextStream.Writeline "<Setting Id=""SETUP_REBOOT"" Value=""Never"" />"

TextStream.Writeline "</Configuration>"

TextStream.Close

'Ensure path to setup.exe is valid to prevent errors

If NOT oFso.FileExists(sCatalyst) Then

sCatalyst = sCommonProgramFiles & "\" & OREF & "\Office Setup Controller\setup.exe"

If NOT oFso.FileExists(sCatalyst) AND f64 Then

sCatalyst = sCommonProgramFilesX86 & "" & OREF & "\Office Setup Controller\setup.exe"

If oFso.FileExists(sCatalyst) Then

sUninstallCmd = Chr(34) & sCatalyst & Chr(34) & " /uninstall " & Sku & " /config " & Chr(34) & sScrubDir & "\config.xml" & Chr(34) & sDll

Log " - Calling Setup.exe to remove " & Sku '& vbCrLf & sUninstallCmd

RetVal = oWShell.Run(sUninstallCmd,0,True) : CheckError "SetupExeRemoval"

Log " - Setup.exe returned: " & SetupRetVal(Retval) & " (" & RetVal & ")" & vbCrLf

Log " Error: Office setup.exe appears to be missing"

End If 'RetVal = 0) AND oFso.FileExists

End Sub 'SetupExeRemoval

'Invoke msiexec to remove individual .MSI packages

Sub MsiexecRemoval

Dim sCmd, sReturn, sMsiProp

'Office System does only support per machine installation so it's sufficient to use Installer.Products

Log " Calling msiexec.exe to remove " & Product

sCmd = "msiexec.exe /x" & Product & sMsiProp

sCmd = sCmd & " /q"

sCmd = sCmd & " /qb-"

sCmd = sCmd & " /l*v  "&chr(34)&sLogDir&"\Uninstall_"&Product&".log"&chr(34)

'Execute the uninstall

LogOnly " - Calling msiexec with '"&sCmd&"'"

sReturn = oWShell.Run(sCmd, 0, True)

Log " - msiexec returned: " & SetupRetVal(sReturn) & " (" & sReturn & ")" & vbCrLf

LogOnly " -> Command: "&sCmd

If i = 0 Then Log " Nothing to remove for msiexec"

End Sub 'MsiexecRemoval

RegDeleteKey HKLM,"SYSTEM\CurrentControlSet\Services\ose\"

'File cleanup operations for the Local Installation Source (MSOCache)

Set LogicalDisks = oWmiLocal.ExecQuery("Select * From Win32_LogicalDisk WHERE DriveType=3")

If oFso.FolderExists(Disk.DeviceID & "\" & LISROOT) Then

Set Folder = oFso.GetFolder(Disk.DeviceID & "\" & LISROOT)

For Each Subfolder in Folder.Subfolders

If (Mid(Subfolder.Name,27,PRODLEN) = OFFICEID AND Mid(SubFolder.Name,4,2)=OVERSIONMAJOR) OR _

LCase(Right(Subfolder.Name,7)) = OVERSIONMAJOR &".data" Then DeleteFolder Subfolder.Path

If (Mid(Subfolder.Name,27,PRODLEN) = OFFICEID AND Mid(SubFolder.Name,4,2)=OVERSIONMAJOR) AND _

CheckDelete(UCase(Left(Subfolder.Name,38))) AND _

UCase(Right(Subfolder,1))= UCase(Left(Disk.DeviceID,1))Then DeleteFolder Subfolder.Path

sFolder = Folder.Path

End If 'oFso.FolderExists

Set Folder = oFso.GetFolder(SubFolder)

If oFso.FolderExists(MseFolder) Then

Set Folder = oFso.GetFolder(MseFolder)

Set Files = Folder.Files

If (LCase(Right(File.Name,4))=".msi") Then

If CheckDelete(ProductCode(File.Path)) Then

End If 'oFso.FolderExists(MseFolder)

End If 'oFso.FolderExists

If fForce OR fQuiet OR fPassive Then CloseOfficeApps

CopyAndDeleteFile sAppdata & "\Microsoft\Templates\Normal.dotm"

CopyAndDeleteFile sAppdata & "\Microsoft\Templates\Normalemail.dotm"

If oFso.FolderExists(sFolder) Then

For Each Subfolder In Folder.Subfolders

If oFso.FileExists(Subfolder & "\blocks.dotx") Then CopyAndDeleteFile Subfolder & "\blocks.dotx"

End If 'oFso.FolderExists(sFolder)

DeleteFile sAllUsersProfile & "\Application Data\Microsoft\Office\Data\opa"&OVERSIONMAJOR&".dat"

DeleteFile sAllUsersProfile & "\Application Data\Microsoft\Office\Data\opa"&OVERSIONMAJOR&".bak"

DeleteFile sAllUsersProfile & "\Microsoft\Office\Data\opa"&OVERSIONMAJOR&".dat"

DeleteFile sAllUsersProfile & "\Microsoft\Office\Data\opa"&OVERSIONMAJOR&".bak"

DeleteFile oWShell.SpecialFolders("AllUsersStartup")&"\OfficeSAS.lnk"

DeleteFile oWShell.SpecialFolders("Startup")&"\OneNote 2010 Screen Clipper and Launcher.lnk"

Set Processes = oWmiLocal.ExecQuery("Select * From Win32_Process Where Name like 'ose%.exe'")

If Not InStr(Process.Name, "OInstall") > 0 Then

LogOnly " - Running process : " & Process.Name

Log " -> Ending process: " & Process.Name

iRet = Process.Terminate()

If oFso.FileExists(sFile) Then DeleteFile sFile

Set Folder = oFso.GetFolder(sPath)

Set Files = Folder.Files

If Len(File.Name)>3 Then

If (LCase(Right(File.Name,4))=".xml") Then

If Len(File.Name) >= Len(sConfigName) Then

If (UCase(Left(File.Name,Len(sConfigName)))=sConfigName) Then

Set XmlFile = oFso.OpenTextFile(File,1)

sContents = XmlFile.ReadAll

If CheckDelete(sProductCode) Then DeleteFile File.Path Else fKeepFolder = True

End If '.xml

End If 'Len(File.Name)>3

If NOT fBypass_Stage1 Then

For Each item in dicApps.Items

If LCase(sc.TargetPath) = item Then

LogOnly " - removing shortcut per match from component detection: " & file.Path

If InStr (sc.TargetPath, OREF) > 0 Then

LogOnly " - removing Office shortcut with non-existent target: " & file.Path & " - " & sc.TargetPath

sFolder = file.Drive & file.Path

If fBypass_Stage1 Then UnPin file

If iVersionNT = 601 Then verb.DoIt

If oFso.FolderExists(sScrubDir & "\ScrubTmp") Then oFso.DeleteFolder sScrubDir & "\ScrubTmp",True

'Ensure there are no unexpected .msi files in the scrub folder

Set Folder = oFso.GetFolder(sScrubDir) : CheckError "DeleteMsiScrubCache"

Set Files = Folder.Files

If LCase(Right(File.Name,4))=".msi" Then

DeleteFile File.Path : CheckError "DeleteMsiScrubCache"

Set Folder = oFso.GetFolder(sWinDir & "\Installer")

Log vbCrLf & "Windows Installer cache CleanUp"

Set AllPatches = oMsi.PatchesEx("",USERSIDEVERYONE,MSIINSTALLCONTEXT_ALL,MSIPATCHSTATE_ALL)

'Fill a comma separated stringlist with all .msp patchfiles

sLocalMsp = "" : sLocalMsp = LCase(Patch.Patchproperty("LocalPackage")) : CheckError "MsiClearOrphanedFiles (msp)"

'Delete all non referenced .msp files from %windir%\installer

sFName = "" : sFName = LCase(File.Path)

If LCase(Right(sFName,4)) = ".msp" Then

If InStr(UCase(MspTargets(File.Path)),OFFICEID)>0 Then DeleteFile File.Path

Set AllProducts = oMsi.ProductsEx("",USERSIDEVERYONE,MSIINSTALLCONTEXT_ALL)

'Fill a comma separated stringlist with all .msi files

sLocalMsi = "" : sLocalMsi = LCase(Product.InstallProperty("LocalPackage")) : CheckError "MsiClearOrphanedFiles (msi)"

'Delete all non referenced .msi files from %windir%\installer

If LCase(Right(sFName,4)) = ".msi" Then

If UCase(Right(ProductCode(File.Path),PRODLEN))=OFFICEID Then DeleteFile File.Path

End If 'LCase(Right(sFName,4)) = ".msi"

Dim Item, Name, Sku, key

Dim hDefKey, sSubKeyName, sCurKey, value, sValue, sGuid

Dim arrKeys, arrNames, arrTypes, arrMultiSzValues, arrMultiSzNewValues

RegDeleteKey HKCU,"Software\Policies\Microsoft\Office\" & OVERSION & "\"

RegDeleteKey HKCU,"Software\Microsoft\Office\" & OVERSION & "\"

RegDeleteKey HKLM,"SOFTWARE\Microsoft\Office\" & OVERSION & "\"

RegDeleteKey HKLM,"SOFTWARE\Microsoft\Office Test\"

RegDeleteKey HKLM,"SOFTWARE\Microsoft\Office\Excel\Addins\Microsoft.PerformancePoint.Planning.Client.Excel\"

RegDeleteValue HKLM,"SOFTWARE\Microsoft\Office\InfoPath\Converters\Import\InfoPath.DesignerExcelImport\Versions\",OVERSION, False

RegDeleteValue HKLM,"SOFTWARE\Microsoft\Office\InfoPath\Converters\Import\InfoPath.DesignerWordImport\Versions\",OVERSION, False

RegDeleteKey HKLM,"SOFTWARE\Microsoft\Office\Outlook\"

RegDeleteKey HKLM,"SOFTWARE\Microsoft\Shared Tools\Text Converters\Export\MEWord12\"

RegDeleteKey HKLM,"SOFTWARE\Microsoft\Shared Tools\Text Converters\Export\Word12\"

RegDeleteKey HKLM,"SOFTWARE\Microsoft\Shared Tools\Text Converters\Export\Word97\"

RegDeleteKey HKLM,"SOFTWARE\Microsoft\Shared Tools\Text Converters\Import\MEWord12\"

RegDeleteKey HKLM,"SOFTWARE\Microsoft\Shared Tools\Text Converters\Import\Word12\"

RegDeleteKey HKLM,"SOFTWARE\Microsoft\Shared Tools\Text Converters\Import\Word97\"

RegDeleteValue HKLM,"SOFTWARE\Microsoft\Windows\CurrentVersion\Run\","GrooveMonitor", False

RegDeleteValue HKLM,"SOFTWARE\Microsoft\Windows\CurrentVersion\Run\","LobiServer", False

RegDeleteValue HKLM,"SOFTWARE\Microsoft\Windows\CurrentVersion\Run\","BCSSync", False

RegDeleteKey HKLM,"SYSTEM\CurrentControlSet\Services\Outlook\"

RegDeleteKey HKLM,"SOFTWARE\Microsoft\Windows NT\CurrentVersion\Terminal Server\Install\Software\Microsoft\Office\" & OVERSION & "\"

RegDeleteKey HKLM,"SOFTWARE\Microsoft\OfficeCustomizeWizard\" & OVERSION & "\"

RegDeleteKey HKLM,"SOFTWARE\Microsoft\Windows NT\CurrentVersion\Terminal Server\Install\SOFTWARE\Microsoft\OfficeCustomizeWizard\" & OVERSION & "\"

If RegReadValue(HKCR,"CLSID\{CC2C83A6-9BE4-11D0-98E7-00C04FC2CAF5}\InprocServer32","SystemDB",sValue,"REG_SZ") Then

If LCase(Left(sValue,Len(sOInstallRoot))) = LCase(sOInstallRoot) Then RegDeleteKey HKCR,"CLSID\{CC2C83A6-9BE4-11D0-98E7-00C04FC2CAF5}\InprocServer32\"

RegDeleteKey HKLM,"SOFTWARE\Microsoft\OfficeSoftwareProtectionPlatform\"

RegDeleteKey HKLM,"SOFTWARE\Microsoft\OfficeSoftwareProtectionPlatform_Test\"

RegDeleteKey HKLM,"SOFTWARE\Microsoft\Office\Common\ActiveX Compatibility\{00024512-0000-0000-C000-000000000046}\"

RegDeleteValue HKLM,"SOFTWARE\Microsoft\Office\OneNote\Adapters\","{456B0D0E-49DD-4C95-8DB6-175F54DE69A3}", False

RegDeleteValue HKLM,"SOFTWARE\Microsoft\Windows\CurrentVersion\Shell Extensions\Approved\","{42042206-2D85-11D3-8CFF-005004838597}", False

RegDeleteValue HKLM,"SOFTWARE\Microsoft\Windows\CurrentVersion\Shell Extensions\Approved\","{993BE281-6695-4BA5-8A2A-7AACBFAAB69E}", False

RegDeleteValue HKLM,"SOFTWARE\Microsoft\Windows\CurrentVersion\Shell Extensions\Approved\","{0006F045-0000-0000-C000-000000000046}", False

RegDeleteValue HKLM,"SOFTWARE\Microsoft\Windows\CurrentVersion\Shell Extensions\Approved\","{C41662BB-1FA0-4CE0-8DC5-9B7F8279FF97}", False

RegDeleteValue HKLM,"SOFTWARE\Microsoft\Windows\CurrentVersion\Shell Extensions\Approved\","{7CCA70DB-DE7A-4FB7-9B2B-52E2335A3B5A}", False

RegDeleteValue HKLM,"SOFTWARE\Microsoft\Windows\CurrentVersion\Shell Extensions\Approved\","{506F4668-F13E-4AA1-BB04-B43203AB3CC0}", False

RegDeleteValue HKLM,"SOFTWARE\Microsoft\Windows\CurrentVersion\Shell Extensions\Approved\","{D66DC78C-4F61-447F-942B-3FB6980118CF}", False

RegDeleteKey HKLM,"SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{B4F3A835-0E21-4959-BA22-42B3008E02FF}\"

RegDeleteValue HKLM,"SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\ShellExecuteHooks\","{B5A7F190-DDA6-4420-B3BA-52453494E6CD}", False

RegDeleteValue HKLM,"SOFTWARE\Microsoft\Windows\CurrentVersion\Shell Extensions\Approved\","{99FD978C-D287-4F50-827F-B2C658EDA8E7}", False

RegDeleteValue HKLM,"SOFTWARE\Microsoft\Windows\CurrentVersion\Shell Extensions\Approved\","{AB5C5600-7E6E-4B06-9197-9ECEF74D31CC}", False

RegDeleteValue HKLM,"SOFTWARE\Microsoft\Windows\CurrentVersion\Shell Extensions\Approved\","{920E6DB1-9907-4370-B3A0-BAFC03D81399}", False

RegDeleteValue HKLM,"SOFTWARE\Microsoft\Windows\CurrentVersion\Shell Extensions\Approved\","{16F3DD56-1AF5-4347-846D-7C10C4192619}", False

RegDeleteValue HKLM,"SOFTWARE\Microsoft\Windows\CurrentVersion\Shell Extensions\Approved\","{2916C86E-86A6-43FE-8112-43ABE6BF8DCC}", False

RegDeleteValue HKLM,"SOFTWARE\Microsoft\Windows\CurrentVersion\Shell Extensions\Approved\","{72853161-30C5-4D22-B7F9-0BBC1D38A37E}", False

RegDeleteValue HKLM,"SOFTWARE\Microsoft\Windows\CurrentVersion\Shell Extensions\Approved\","{6C467336-8281-4E60-8204-430CED96822D}", False

RegDeleteValue HKLM,"SOFTWARE\Microsoft\Windows\CurrentVersion\Shell Extensions\Approved\","{2A541AE1-5BF6-4665-A8A3-CFA9672E4291}", False

RegDeleteValue HKLM,"SOFTWARE\Microsoft\Windows\CurrentVersion\Shell Extensions\Approved\","{B5A7F190-DDA6-4420-B3BA-52453494E6CD}", False

RegDeleteValue HKLM,"SOFTWARE\Microsoft\Windows\CurrentVersion\Shell Extensions\Approved\","{A449600E-1DC6-4232-B948-9BD794D62056}", False

RegDeleteValue HKLM,"SOFTWARE\Microsoft\Windows\CurrentVersion\Shell Extensions\Approved\","{3D60EDA7-9AB4-4DA8-864C-D9B5F2E7281D}", False

RegDeleteValue HKLM,"SOFTWARE\Microsoft\Windows\CurrentVersion\Shell Extensions\Approved\","{387E725D-DC16-4D76-B310-2C93ED4752A0}", False

RegDeleteKey HKLM,"SOFTWARE\Classes\*\shellex\ContextMenuHandlers\XXX Groove GFS Context Menu Handler XXX\"

RegDeleteKey HKLM,"SOFTWARE\Classes\AllFilesystemObjects\shellex\ContextMenuHandlers\XXX Groove GFS Context Menu Handler XXX\"

RegDeleteKey HKLM,"SOFTWARE\Classes\Directory\shellex\ContextMenuHandlers\XXX Groove GFS Context Menu Handler XXX\"

RegDeleteKey HKLM,"SOFTWARE\Classes\Folder\ShellEx\ContextMenuHandlers\XXX Groove GFS Context Menu Handler XXX\"

RegDeleteKey HKLM,"SOFTWARE\Classes\Directory\Background\shellex\ContextMenuHandlers\XXX Groove GFS Context Menu Handler XXX\"

RegDeleteKey HKLM,"SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\ShellIconOverlayIdentifiers\Groove Explorer Icon Overlay 1 (GFS Unread Stub)\"

RegDeleteKey HKLM,"SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\ShellIconOverlayIdentifiers\Groove Explorer Icon Overlay 2 (GFS Stub)\"

RegDeleteKey HKLM,"SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\ShellIconOverlayIdentifiers\Groove Explorer Icon Overlay 2.5 (GFS Unread Folder)\"

RegDeleteKey HKLM,"SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\ShellIconOverlayIdentifiers\Groove Explorer Icon Overlay 3 (GFS Folder)\"

RegDeleteKey HKLM,"SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\ShellIconOverlayIdentifiers\Groove Explorer Icon Overlay 4 (GFS Unread Mark)\"

RegDeleteKey HKLM,"SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{72853161-30C5-4D22-B7F9-0BBC1D38A37E}\"

If RegEnumKey(HKCR,"Installer\Win32Assemblies\",arrKeys) Then

For Each Item in arrKeys

If InStr(UCase(Item),OREF)>0 Then RegDeleteKey HKCR,"Installer\Win32Assemblies\"&Item & "\"

'Groove blocks reinstall if it locates groove.exe over this key

If RegKeyExists(HKCR,"GrooveFile\Shell\Open\Command\") Then

If InStr(sValue,"\"&OREF&"\")>0 Then RegDeleteKey HKCR,"GrooveFile\"

End If 'RegKeyExists

sSubKeyName = "Software\Microsoft\OfficeCustomizeWizard\" & OVERSION & "\RegKeyPaths\"

hDefKey = HKCU

sSubKeyName = "SOFTWARE\Microsoft\OfficeCustomizeWizard\" & OVERSION & "\RegKeyPaths\"

hDefKey = HKLM

sSubKeyName = REG_ARP

If RegEnumKey(hDefKey,sSubKeyName,arrKeys) Then

For Each Item in arrKeys

RegDeleteKey hDefKey, sSubKeyName & Item & "\"

If RegEnumValues(hDefKey,sSubKeyName,arrNames,arrTypes) Then

If RegReadValue(hDefKey,sSubKeyName,Name,sValue,arrTypes(i)) Then

If sValue = sGuid Then RegDeleteValue hDefKey,sSubKeyName,Name, False

If NOT RegEnumKey(hDefKey,sSubKeyName,arrKeys) Then RegDeleteKey hDefKey,"Software\Microsoft\OfficeCustomizeWizard\11.0\"

If NOT RegEnumKey(hDefKey,"Software\Microsoft\OfficeCustomizeWizard\11.0\",arrKeys) Then RegDeleteKey hDefKey,"Software\Microsoft\OfficeCustomizeWizard\"

sSubKeyName = ""

hDefKey = ""

If RegEnumKey(hDefKey,sSubKeyName,arrKeys) Then

'Check if it's an Office key

RegDeleteKey hDefKey,sSubKeyName & Item & "\"

RegEnumValues hDefKey,sSubKeyName & Item,arrNames,arrTypes

If CheckDelete(sGuid) Then RegDeleteValue hDefKey, sSubKeyName & Item & "\", Name, True

RegDeleteValue hDefKey, sSubKeyName & Item & "\", Name, True

'If all entries were removed - delete the key

If Not IsArray(arrNames) Then RegDeleteKey hDefKey, sSubKeyName & Item & "\"

If CheckDelete(sGuid) Then RegDeleteKey hDefKey, sSubKeyName & Item & "\"

If RegEnumKey(HKLM,sSubKeyName,arrKeys) Then

For Each Item in arrKeys

If RegEnumValues(HKLM,sSubKeyName & Item,arrNames,arrTypes) Then

RegDeleteValue HKLM, sSubKeyName & Item & "\", Name, False

'Check if the key is now empty

If NOT RegEnumValues(HKLM,sSubKeyName & Item,arrTestNames,arrTestTypes) Then

If NOT dicDelRegKey.Exists(sSubKeyName&Item&"\") Then dicDelRegKey.Add sSubKeyName&Item&"\",HKCR

If RegEnumKey(HKCR,sSubKeyName,arrKeys) Then

If RegEnumValues(HKCR,sSubKeyName & Item,arrNames,arrTypes) Then

If RegReadValue (HKCR,sSubKeyName & Item, Name, sValue,"REG_MULTI_SZ") Then

If NOT UBound(arrMultiSzValues) = i Then oReg.SetMultiStringValue HKCR,sSubKeyName & Item,Name,arrMultiSzNewValues

RegDeleteValue HKCR,sSubKeyName & Item & "\", Name, False

'Check if the key is now empty

If NOT RegEnumValues(HKCR,sSubKeyName & Item,arrTestNames,arrTestTypes) Then

If NOT dicDelRegKey.Exists(sSubKeyName&Item&"\") Then dicDelRegKey.Add sSubKeyName&Item&"\",HKCR

sSubKeyName = "SOFTWARE\Microsoft\Office\Delivery\SourceEngine\Downloads\"

LCase(Right(Item,7))=OVERSIONMAJOR&".data" Then RegDeleteKey HKLM,sSubKeyName & Item & "\"

CheckDelete(UCase(Left(Item,38))) Then RegDeleteKey HKLM,sSubKeyName & Item & "\"

sSubKeyName = "SOFTWARE\Microsoft\Office\"&OVERSION&"\Registration\"

If CheckDelete(UCase(Left(Item,38))) Then RegDeleteKey HKLM,sSubKeyName & Item & "\"

sSubKeyName = "SOFTWARE\Microsoft\Office\"&OVERSION&"\User Settings\"

'Known Keypath settings

Log " - Detcted KeyPath settings"

For Each key in dicDelRegKey.Keys

If Right(key,1) = "\" Then

RegDeleteKey dicDelRegKey.Item(key),key

iPos = InStrRev(Key,"\")

If iPos > 0 Then RegDeleteValue dicDelRegKey.Item(key), Left(key,iPos - 1), Mid(key,iPos 1), False

Dim sSubKeyName, sCurKey, sValue, sGuid

sSubKeyName = REG_ARP

If CheckDeleteEx(sGuid) Then RegDeleteKey HKLM, sSubKeyName & Item

sCurKey = sSubKeyName & Item & "\"

fSystemComponent0 = Not (RegReadValue(HKLM,sCurKey,"SystemComponent",sValue,"REG_DWORD") AND (sValue = "1"))

For Each Sku in KeepSku.Keys

If Not fkeep Then RegDeleteKey HKLM, sSubKeyName & Item

'Clean up temporary registry keys

Sub TmpKeyCleanUp

Dim TmpKey

If fLogInitialized Then Log " - temporary OffScrub registry entries"

For Each TmpKey in arrTmpSKUs

oReg.DeleteKey HKLM, REG_ARP & TmpKey

End Sub 'TmpKeyCleanUp

Dim SkuLog, SkuKey , p

Set SkuLog = oFso.OpenTextFile(sScrubDir & "\SkuLog.txt",FOR_WRITING,True,True)

SkuLog.WriteLine "Installed SKUs (All):"

SkuLog.WriteLine "====================="

For Each SkuKey in dicInstalledSku.Keys

SkuLog.WriteLine " - " & SkuKey

SkuLog.WriteLine vbCrLf & "Server SKUs:"

SkuLog.WriteLine "============"

For Each SkuKey in dicSrv.Keys

SkuLog.WriteLine vbCrLf & "Client Suite SKUs:"

SkuLog.WriteLine "=================="

For Each SkuKey in dicCSuite.Keys

SkuLog.WriteLine vbCrLf & "Client Standalone SKUs:"

SkuLog.WriteLine "======================="

For Each SkuKey in dicCSingle.Keys

SkuLog.WriteLine vbCrLf & "Installed Products (All):"

SkuLog.WriteLine "========================="

For Each p in oMsi.Products

SkuLog.Write " - " & p & " - "

SkuLog.Write oMsi.ProductInfo(p, "ProductName")

SkuLog.WriteLine " "

SkuLog.WriteLine vbCrLf & "***************************************************************************************************" & vbCrLf

SkuLog.WriteLine vbCrLf & "SKUs to keep:"

SkuLog.WriteLine "============="

For Each SkuKey in KeepSku.Keys

SkuLog.WriteLine vbCrLf & "Products to keep:"

SkuLog.WriteLine "================="

For Each p in KeepProd.Keys

SkuLog.Write " - " & p & " - "

SkuLog.Write oMsi.ProductInfo(p, "ProductName")

SkuLog.WriteLine " "

SkuLog.WriteLine vbCrLf & "SKUs to remove:"

SkuLog.WriteLine "==============="

For Each SkuKey in dicRemoveSku.Keys

SkuLog.WriteLine vbCrLf & "Products to remove:"

SkuLog.WriteLine "==================="

SkuLog.Close

If dicApps.Exists(LCase(Process.Name)) Then

Log " - End process " & Process.Name

If InStr(UCase(prop.Value), UCase(sOInstallRoot)) > 0 Then

If Not InStr(Process.Name, "OInstall") > 0 Then

Log " - End process '" & Process.Name

iRet = Process.Terminate()

CheckError "CloseOfficeApps: " & "Process.Name"

wscript.sleep 10000

'Ensure Windows Explorer is restarted if needed

oWShell.Run "SCHTASKS /Create /TN OffScrEx /TR explorer /SC ONCE /ST 12:00 /IT",0,True

oWShell.Run "SCHTASKS /Run /TN OffScrEx", 0, True

oWShell.Run "SCHTASKS /Delete /TN OffScrEx /F", 0, False

Set oAT = oWmiLocal.Get("Win32_ScheduledJob")

Set DateTime = CreateObject("WbemScripting.SWbemDateTime")

DateTime.SetVarDate DateAdd("n",1,Now),True

Result = oAT.Create("explorer.exe", DateTime.Value, , , , True, JobID)

'Returns the delimiter for a passed in string

CheckDeleteEx = InScope(sProductCode) AND NOT KeepProd.Exists(UCase(sProductCode))

If KeepProd.Exists(UCase(sProductCode)) Then CheckDelete = False

'Register an orphaned .msi product as installed for MSI

Dim sDisplayVersion, sCurKey, sDisplayName, sLang, sProductCode, sTmpKey

'Create a temporary keys to simulate an installed product

sCurKey = REG_ARP & sProductCode

oReg.CreateKey HKLM,sCurKey

sCurKey = "SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Products\" & GetCompressedGuid(sProductCode)

oReg.CreateKey HKLM,sCurKey & "\Features"

oReg.CreateKey HKLM,sCurKey & "\InstallProperties"

oReg.CreateKey HKLM,sCurKey & "\Patches"

oReg.CreateKey HKLM,sCurKey & "\Usage"

sCurKey = sCurKey & "\InstallProperties"

oReg.SetStringValue HKLM,sCurKey,"LocalPackage",sMsiFile

sCurKey = "Installer\Products\" & GetCompressedGuid(sProductCode)

sTmpKey = sCurKey

oReg.CreateKey HKCR,sCurKey

oReg.SetDWordValue HKCR,sCurKey,"AdvertiseFlags",388

oReg.SetDWordValue HKCR,sCurKey,"Assignment",1

oReg.SetDWordValue HKCR,sCurKey,"AuthorizedLUAApp",0

oReg.SetStringValue HKCR,sCurKey,"Clients",":"

oReg.SetDWordValue HKCR,sCurKey,"DeploymentFlags",3

oReg.SetDWordValue HKCR,sCurKey,"InstanceType",0

oReg.SetDWordValue HKCR,sCurKey,"Language",sLang

oReg.SetStringValue HKCR,sCurKey,"PackageCode",GetMsiPackageCode(sMsiFile)

oReg.SetStringValue HKCR,sCurKey,"ProductName",sDisplayName

oReg.SetDWordValue HKCR,sCurKey,"VersionMinor",0

sCurKey = sTmpKey & "\SourceList"

oReg.SetExpandedStringValue HKCR,sCurKey,"LastUsedSource",sScrubDir

oReg.SetStringValue HKCR,sCurKey,"PackageName",Mid(sMsiFile,InstrRev(sMsiFile,"\") 1)

sCurKey = sTmpKey & "\SourceList\Media"

oReg.SetStringValue HKCR,sCurKey,"1",OREF & ";1"

oReg.SetStringValue HKCR,sCurKey,"DiskPrompt",sDisplayName

sCurKey = sTmpKey & "\SourceList\Net"

oReg.SetExpandedStringValue HKCR,sCurKey,"1",sScrubDir

oReg.SetStringValue HKLM,sCurKey,"Comments",""

oReg.SetStringValue HKLM,sCurKey,"Contact",""

oReg.SetStringValue HKLM,sCurKey,"DisplayName",sDisplayName

oReg.SetStringValue HKLM,sCurKey,"DisplayVersion",sDisplayVersion

oReg.SetDWordValue HKLM,sCurKey,"EstimatedSize",0

oReg.SetStringValue HKLM,sCurKey,"HelpLink",""

oReg.SetStringValue HKLM,sCurKey,"HelpTelephone",""

oReg.SetStringValue HKLM,sCurKey,"InstallDate","20100101"

oReg.SetStringValue HKLM,sCurKey,"InstallLocation",sProgramFilesX86

oReg.SetStringValue HKLM,sCurKey,"InstallLocation",sProgramFiles

oReg.SetStringValue HKLM,sCurKey,"InstallSource",sScrubDir

oReg.SetDWordValue HKLM,sCurKey,"Language",sLang

oReg.SetExpandedStringValue HKLM,sCurKey,"ModifyPath","MsiExec.exe /X" & sProductCode

oReg.SetDWordValue HKLM,sCurKey,"NoModify",1

oReg.SetStringValue HKLM,sCurKey,"Publisher","Microsoft Corporation"

oReg.SetStringValue HKLM,sCurKey,"Readme",""

oReg.SetStringValue HKLM,sCurKey,"Size",""

oReg.SetDWordValue HKLM,sCurKey,"SystemComponent",0

oReg.SetExpandedStringValue HKLM,sCurKey,"UninstallString","MsiExec.exe /X" & sProductCode

oReg.SetStringValue HKLM,sCurKey,"URLInfoAbout",""

oReg.SetStringValue HKLM,sCurKey,"URLUpdateInfo",""

oReg.SetDWordValue HKLM,sCurKey,"Version",0

oReg.SetDWordValue HKLM,sCurKey,"VersionMajor",OVERSIONMAJOR

oReg.SetDWordValue HKLM,sCurKey,"VersionMinor",0

oReg.SetDWordValue HKLM,sCurKey,"WindowsInstaller",1

'Obtain the ProductCode (GUID) from a .msi package

'The function will open the .msi database and query the 'Property' table to retrieve the ProductCode

Set MsiDb = oMsi.OpenDatabase(sMsiFile,MSIOPENDATABASEREADONLY)

Set qView = MsiDb.OpenView("SELECT `Value` FROM Property WHERE `Property` = 'ProductCode'")

qView.Execute

Set Record = qView.Fetch

GetMsiProductCode = Record.StringData(1)

qView.Close

'Obtain the ProductVersion from a .msi package

Set qView = MsiDb.OpenView("SELECT `Value` FROM Property WHERE `Property` = 'ProductVersion'")

GetMsiProductVersion = Record.StringData(1)

Set qView = MsiDb.OpenView("SELECT `Value` FROM Property WHERE `Property` = 'ProductName'")

GetMsiProductName = Record.StringData(1)

'Obtain the PackageCode (GUID) from a .msi package

'The function will the .msi'S SummaryInformation stream

GetMsiPackageCode = GetCompressedGuid(oMsi.SummaryInformation(sMsiFile,MSIOPENDATABASEREADONLY).Property(PID_REVNUMBER))

If oFso.FileExists(sMspFile) Then

Set Msp = Msi.OpenDatabase(WScript.Arguments(0),MSIOPENDATABASEMODE_PATCHFILE)

If Err = 0 Then MspTargets = Msp.SummaryInformation.Property(PID_TEMPLATE)

End If 'oFso.FileExists(sMspFile)

'Return the ProductCode {GUID} from a .MSI package

If oFso.FileExists(sMsi) Then

oMsi.UILevel = MSIUILEVELNONE

Set MsiSession = oMsi.OpenPackage(sMsi,1)

ProductCode = MsiSession.ProductProperty("ProductCode")

End If 'oFso.FileExists(sMsi)

Sub EnsureValidWIMetadata (hDefKey,sKey,iValidLength)

Dim arrKeys

Dim SubKey

If Len(sKey) > 1 Then

If Right(sKey,1) = "\" Then sKey = Left(sKey,Len(sKey)-1)

If RegEnumKey(hDefKey,sKey,arrKeys) Then

For Each SubKey in arrKeys

If NOT Len(SubKey) = iValidLength Then

RegDeleteKey hDefKey,sKey & "\" & SubKey & "\"

Next 'SubKey

' sCmd = sScriptDir & sCleanOSPP

Set File = oFso.GetFile(sFile)

If Not oFso.FolderExists(sScrubDir & "\" & File.ParentFolder.Name) Then oFso.CreateFolder sScrubDir & "\" & File.ParentFolder.Name

oFso.CopyFile sFile,sScrubDir & "\" & File.ParentFolder.Name & "\" & File.Name,True : CheckError "CopyAndDeleteFile"

End If 'oFso.FileExists

If KeepFolder.Exists(LCase(sFile)) Then

LogOnly " - Disallowing the delete of still required keypath element: " & sFile

LogOnly " - Enforced delete of still required keypath element: " & sFile

If KeepFolder.Exists(LCase(Wow64Folder(sFile))) Then

If Not fDetectOnly Then oFso.DeleteFile sFile,True

Set File = oFso.GetFile(sFile)

sFileName = File.Name

If Not oFso.FolderExists(sNewPath) Then oFso.CreateFolder(sNewPath)

oFso.MoveFile sFile,sNewPath & "\" & sFileName

If oFso.FolderExists(sPath) Then Exit Function

If f64 AND oFso.FolderExists(Wow64Folder(sPath)) Then

For Each Subfolder in Folder.Subfolders

sSubFolders = sSubFolders & Subfolder.Name & ","

If f64 AND oFso.FolderExists(Wow64Folder(sFolder)) Then

Set Folder = oFso.GetFolder(Wow64Folder(sFolder))

sSubFolders = sSubFolders & Subfolder.Path & ","

For Each SubFolder in Folder.SubFolders

arrMseFolders(UBound(arrMseFolders)) = SubFolder.Path

If KeepFolder.Exists(LCase(sFolder)) Then

LogOnly " - Disallowing the delete of still required keypath element: " & sFolder

LogOnly " - Enforced delete of still required keypath element: " & sFolder

If KeepFolder.Exists(LCase(Wow64Folder(sFolder))) Then

oFso.DeleteFolder sDelFolder,True

sFolderName = Folder.Name

If Not oFso.FolderExists(sNewPath) Then oFso.CreateFolder(sNewPath)

oFso.MoveFolder sFolder,sNewPath & "\" & sFolderName

If CBool(Folder.Attributes AND 1024) Then

If (Folder.Subfolders.Count = 0) AND (Folder.Files.Count = 0) Then

If CBool(Folder.Attributes AND 1024) Then

If f64 AND oFso.FolderExists(Wow64Folder(sFolder)) Then

'Executes the folder delete operation

If NOT KeepFolder.Exists (sPath) Then

KeepFolder.Add sPath,sPath

sPath = LCase(oFso.GetParentFolderName(sPath)) & "\"

If oFso.FolderExists(sPath) Then AddKeepFolder(sPath)

'Handles additional folder-path operations on 64 bit environments

Function RegKeyExists(hDefKey,sSubKeyName)

If oReg.EnumKey(hDefKey,sSubKeyName,arrKeys) = 0 Then RegKeyExists = True

RetVal = oReg.GetStringValue(hDefKey,sSubKeyName,sName,sValue)

If Not RetVal = 0 AND f64 Then RetVal = oReg.GetStringValue(hDefKey,Wow64Key(hDefKey, sSubKeyName),sName,sValue)

RetVal = oReg.GetExpandedStringValue(hDefKey,sSubKeyName,sName,sValue)

If Not RetVal = 0 AND f64 Then RetVal = oReg.GetExpandedStringValue(hDefKey,Wow64Key(hDefKey, sSubKeyName),sName,sValue)

RetVal = oReg.GetMultiStringValue(hDefKey,sSubKeyName,sName,arrValues)

If Not RetVal = 0 AND f64 Then RetVal = oReg.GetMultiStringValue(hDefKey,Wow64Key(hDefKey, sSubKeyName),sName,arrValues)

If RetVal = 0 Then sValue = Join(arrValues,chr(34))

RetVal = oReg.GetDWORDValue(hDefKey,sSubKeyName,sName,sValue)

RetVal = oReg.GetDWORDValue(hDefKey,Wow64Key(hDefKey, sSubKeyName),sName,sValue)

RetVal = oReg.GetBinaryValue(hDefKey,sSubKeyName,sName,sValue)

If Not RetVal = 0 AND f64 Then RetVal = oReg.GetBinaryValue(hDefKey,Wow64Key(hDefKey, sSubKeyName),sName,sValue)

RetVal = oReg.GetQWORDValue(hDefKey,sSubKeyName,sName,sValue)

If Not RetVal = 0 AND f64 Then RetVal = oReg.GetQWORDValue(hDefKey,Wow64Key(hDefKey, sSubKeyName),sName,sValue)

'Enumerate a registry key to return all values

Function RegEnumValues(hDefKey,sSubKeyName,arrNames, arrTypes)

RetVal = oReg.EnumValues(hDefKey,sSubKeyName,arrNames32,arrTypes32)

RetVal64 = oReg.EnumValues(hDefKey,Wow64Key(hDefKey, sSubKeyName),arrNames64,arrTypes64)

arrNames = RemoveDuplicates(Split((Join(arrNames32,"\") & "\" & Join(arrNames64,"\")),"\"))

arrTypes = RemoveDuplicates(Split((Join(arrTypes32,"\") & "\" & Join(arrTypes64,"\")),"\"))

RetVal = oReg.EnumValues(hDefKey,sSubKeyName,arrNames,arrTypes)

'Enumerate a registry key to return all subkeys

Function RegEnumKey(hDefKey,sSubKeyName,arrKeys)

RetVal = oReg.EnumKey(hDefKey,sSubKeyName,arrKeys32)

RetVal64 = oReg.EnumKey(hDefKey,Wow64Key(hDefKey, sSubKeyName),arrKeys64)

If (RetVal = 0) AND (Not RetVal64 = 0) AND IsArray(arrKeys32) Then arrKeys = arrKeys32

arrKeys = RemoveDuplicates(Split((Join(arrKeys32,"\") & "\" & Join(arrKeys64,"\")),"\"))

RetVal = oReg.EnumKey(hDefKey,sSubKeyName,arrKeys)

'Wrapper around oReg.DeleteValue to handle 64 bit

Dim sWow64Key,sRealName

If KeepReg.Exists(LCase(sSubKeyName & sName)) Then

LogOnly " - Disallowing the delete of still required keypath element: " & HiveString(hDefKey) & "\" & sSubKeyName & sName

LogOnly " - Enforced delete of still required keypath element. Remaining applications will need a repair!"

If KeepReg.Exists(LCase(Wow64Key(hDefKey, sSubKeyName) & sName)) Then

LogOnly " - Disallowing the delete of still required keypath element: " & HiveString(hDefKey) & "\" & sSubKeyName & sName

LogOnly " - Enforced delete of still required keypath element. Remaining applications will need a repair!"

If RegValExists(hDefKey,sSubKeyName,sRealName) Then

If RegReadValue(hDefKey,sSubKeyName,sName,sValue,"REG_MULTI_SZ") Then

LogOnly " - Disallowing unsafe delete of REG_MULTI_SZ: " & HiveString(hDefKey) & "\" & sSubKeyName & sName

LogOnly " - Delete registry value: " & HiveString(hDefKey) & "\" & sSubKeyName & " -> " & sName

iRetVal = oReg.DeleteValue(hDefKey, sSubKeyName, sRealName)

LogOnly " - Simulate delete registry value: " & HiveString(hDefKey) & "\" & sSubKeyName & " -> " & sName

sWow64Key = Wow64Key(hDefKey, sSubKeyName)

If RegValExists(hDefKey,sWow64Key,sRealName) Then

If RegReadValue(hDefKey,sSubKeyName,sName,sValue,"REG_MULTI_SZ") Then

LogOnly " - Disallowing unsafe delete of REG_MULTI_SZ: " & HiveString(hDefKey) & "\" & sSubKeyName & sName

LogOnly " - Delete registry value: " & HiveString(hDefKey) & "\" & sWow64Key & " -> " & sName

iRetVal = oReg.DeleteValue(hDefKey, sWow64Key, sRealName)

LogOnly " - Simulate delete registry value: " & HiveString(hDefKey) & "\" & sWow64Key & " -> " & sName

'Wrappper around RegDeleteKeyEx to handle 64bit scenrios

Dim sWow64Key

While InStr(sSubKeyName,"\\")>0

sSubKeyName = Replace(sSubKeyName,"\\","\")

If KeepReg.Exists(LCase(sSubKeyName)) Then

LogOnly " - Disallowing the delete of still required keypath element: " & HiveString(hDefKey) & "\" & sSubKeyName

If KeepReg.Exists(LCase(Wow64Key(hDefKey, sSubKeyName))) Then

LogOnly " - Disallowing the delete of still required keypath element: " & HiveString(hDefKey) & "\" & sSubKeyName

sSubKeyName = Left(sSubKeyName,Len(sSubKeyName)-1)

LogOnly " - Delete registry key: " & HiveString(hDefKey) & "\" & sSubKeyName

RegDeleteKeyEx hDefKey, sSubKeyName

LogOnly " - Simulate delete registry key: " & HiveString(hDefKey) & "\" & sSubKeyName

End If 'RegKeyExists

If RegKeyExists(hDefKey,sWow64Key) Then

LogOnly " - Delete registry key: " & HiveString(hDefKey) & "\" & sWow64Key

RegDeleteKeyEx hDefKey, sWow64Key

LogOnly " - Simulate delete registry key: " & HiveString(hDefKey) & "\" & sWow64Key

iRetVal = oReg.DeleteKey(hDefKey,sSubKeyName)

'Return the alternate regkey location on 64bit environment

If Left(sSubKeyName,17) = "Software\Classes\" Then

Wow64Key = Left(sSubKeyName,17) & "Wow6432Node\" & Right(sSubKeyName,Len(sSubKeyName)-17)

iPos = InStr(sSubKeyName,"\")

Wow64Key = Left(sSubKeyName,iPos) & "Wow6432Node\" & Right(sSubKeyName,Len(sSubKeyName)-iPos)

Wow64Key = "Wow6432Node\" & sSubKeyName

If Not oDic.Exists(Item) Then oDic.Add Item,Item

RemoveDuplicates = oDic.Keys

Set Processes = oWmiLocal.ExecQuery("Select * From Win32_Process Where Name like '%setup%' OR Name like '%install%'")

If Not InStr(Process.Name, "OInstall") > 0 Then

Log " - End process " & Process.Name

iRet = Process.Terminate()

CheckError "EndCurrentInstalls: " & "Process.Name"

If UCase(Service.State) = "STARTED" Then iRet = Service.StopService

If UCase(Service.State) = "RUNNING" Then iRet = Service.StopService

Log " Found service " & sService & " in state " & Service.State

If InStr(sStates,UCase(Service.State))>0 Then iRet = Service.StopService()

Set Processes = oWmiLocal.ExecQuery("Select * From Win32_Process Where Name='" & sService & ".exe'")

iRet = Service.Delete()

'Translation for setup.exe error codes

Case 30015,15 : SetupRetVal = "ErrorCodeOnly - Passthrough for Win32 error"

Case 30023,23 : SetupRetVal = "HResultOnly - Passthrough for HRESULT errors"

Case 30030,30 : SetupRetVal = "InvalidCDKey"

Case 30038,38 : SetupRetVal = "InvalidOperation"

Case 30054,54 : SetupRetVal = "NoSupportedCulture"

Case 30074,74 : SetupRetVal = "SQLAlreadyConnected"

Case 30075,75 : SetupRetVal = "SQLFailedToAllocateHandle"

Case 30076,76 : SetupRetVal = "SQLFailedToConnect"

Case 30077,77 : SetupRetVal = "SQLFailedToExecuteStatement"

Case 30078,78 : SetupRetVal = "SQLFailedToRetrieveData"

Case 30079,79 : SetupRetVal = "SQLFailedToSetAttribute"

Case "0010" : sReturn = "WEBFLDRS"

Case "0021" : sReturn = "VisualWebDeveloper"

Case "0026" : sReturn = "ExpressionWeb"

Case "0045" : sReturn = "XWEB"

Case "007D" : sReturn = "OSCWL" 'Outlook Social Connector for Windows Live Messenger

LogOnly " " & Now & " - " & sModule & " - Source: " & Err.Source & "; Err# (Hex): " & Hex( Err ) & _

If wscript.Arguments(1) = "UAC" Then

If wscript.arguments.count = 2 Then iArgCnt = 0

If dicInstalledSku.Count > 0 Then sDefault = Join(RemoveDuplicates(dicInstalledSku.Items),",") Else sDefault = "CLIENTALL"

TmpKeyCleanUp

wscript.quit 1602

Case "/B","/BYPASS"

If InStr(arrArguments(iCnt   1), "1") > 0 Then fBypass_Stage1 = True

If InStr(arrArguments(iCnt   1), "2") > 0 Then fBypass_Stage2 = True

If InStr(arrArguments(iCnt   1), "3") > 0 Then fBypass_Stage3 = True

If InStr(arrArguments(iCnt   1), "4") > 0 Then fBypass_Stage4 = True

fBypass_Stage1 = True

Case "/PASSIVE", "/QB-"

fPassive = True

fBypass_Stage2 = True

fBypass_Stage3 = True

fBypass_Stage1 = False

DateTime.SetVarDate Now,True

sLogName = sLogName & "_" & Left(DateTime.Value,14)

Set LogStream = oFso.CreateTextFile(sLogName,True,True)

sLogName = sLogName & "_" & Left(DateTime.Value,14)

Set LogStream = oFso.CreateTextFile(sLogName,True,True)

Log "Microsoft Customer Support Services - " & ONAME & " Removal Utility" & vbCrLf & vbCrLf & _

sCmd = Replace (LCase(wscript.Path), "syswow64", "sysnative") & "\cscript.exe " & Chr(34) & WScript.scriptFullName & Chr(34)

If fQuiet AND NOT fCScript Then sCmd = Replace (sCmd, "\cscript.exe", "\wscript.exe")

sCmd = sCmd & " " & chr(34) & Argument & chr(34)

If Not sDefault = "" Then sCmd = sCmd & " " & chr(34) & sDefault & chr(34)

sCmd = sCmd & " /ChangedHostBitness"

Wscript.Quit oWShell.Run(sCmd, 1, True)

Wscript.Quit oWShell.Run(sCmdLine, 1, True)

sCmdLine = Chr(34) & WScript.scriptFullName & Chr(34)

If Not sDefault = "" Then sCmdLine = sCmdLine & " " & chr(34) & sDefault & chr(34)

Wscript.Quit 5

vbTab & "/NoCancel ' Setup.exe and Msiexec.exe have no Cancel button" & vbCrLf &_

vbTab & "/Quiet ' Script, Setup.exe and Msiexec.exe run quiet with no UI" & vbCrLf &_

' Name: OffScrub_O16msi.vbs

Const SCRIPTFILE = "OffScrub_O16msi.vbs"

CONST OfficeAppId = "0ff1ce15-a989-479d-af46-f275c6370663" 'Office 2013/2016

sCmd = """" & sScriptDir & sCleanOSPP & """"

14.00.24210.0 built by: VCTOOLSREL

vcruntime140.dll

14.00.24210.0

jvcruntime140_d5f9ec2a-4034-436a-910f-d0d8d10e1dca.dl

msvcp140.dll

bmsvcp140_45e4bd63-eb35-43c5-b104-cb4d3cdf0494.dl

Remove it with Ad-Aware

1. Click (here) to download and install Ad-Aware Free Antivirus.
2. Update the definition files.
3. Run a full scan of your computer.

Manual removal*

1. Terminate malicious process(es) (How to End a Process With the Task Manager):
   

   setup.exe:2764
   files.dat:3800
   

2. Delete the original Trojan file.
   
3. Delete or disinfect the following files created/modified by the Trojan:
   

   C:\Users\"%CurrentUserName%"\AppData\Local\Temp\nss6B31.tmp\files\files.dat (1089 bytes)
   C:\Windows\System32\vcruntime140.dll (867 bytes)
   C:\Users\"%CurrentUserName%"\AppData\Local\Temp\nss6B31.tmp\files\setup16.exe (703 bytes)
   C:\Windows\System32\msvcp140.dll (560 bytes)
   C:\Users\"%CurrentUserName%"\AppData\Local\Temp\nss6B31.tmp\files\x86\msvcr100.dll (8468 bytes)
   C:\Users\"%CurrentUserName%"\AppData\Local\Temp\nss6B31.tmp\files\x64\msvcr100.dll (9120 bytes)
   C:\Users\"%CurrentUserName%"\AppData\Local\Temp\nss6B31.tmp\files\x64\cleanospp.exe (19 bytes)
   C:\Users\"%CurrentUserName%"\AppData\Local\Temp\nss6B31.tmp\files\x86\cleanospp.exe (17 bytes)
   C:\Users\"%CurrentUserName%"\AppData\Local\Temp\nss6B31.tmp\files\Uninstall.xml (59 bytes)
   C:\Users\"%CurrentUserName%"\AppData\Local\Temp\nss6B31.tmp\files\Configure.xml (366 bytes)
   C:\Users\"%CurrentUserName%"\AppData\Local\Temp\nss6B31.tmp\DOq7i5Iiwc (158 bytes)
   C:\Users\"%CurrentUserName%"\AppData\Local\Temp\nss6B31.tmp\B (149900 bytes)
   C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\8D93UTC3\launch_reb[1].htm (158 bytes)
   C:\Users\"%CurrentUserName%"\AppData\Local\Temp\nss6B31.tmp\inetc.dll (44 bytes)
   C:\Users\"%CurrentUserName%"\AppData\Local\Temp\nss6B31.tmp\System.dll (23 bytes)

4. Clean the Temporary Internet Files folder, which may contain infected files (How to clean Temporary Internet Files folder).
   
5. Find and delete all copies of the worm's file together with "autorun.inf" scripts on removable drives.
   
6. Reboot the computer.
   

*Manual removal may cause unexpected system behaviour and should be performed at your own risk.