Worm.Win32.AutoItGen_8412d14e43

by malwarelabrobot on July 3rd, 2014 in Malware Descriptions.

Trojan.Win32.Swrort.3.FD, Worm.Win32.AutoIt.FD, mzpefinder_pcap_file.YR, WormAutoItGen.YR, BankerGeneric.YR (Lavasoft MAS)
Behaviour: Banker, Trojan, Worm


The description has been automatically generated by Lavasoft Malware Analysis System and it may contain incomplete or inaccurate information.

Requires JavaScript enabled!

Summary
Dynamic Analysis
Static Analysis
Network Activity
Map
Strings from Dumps
Removals

MD5: 8412d14e43b056cf323e9e853a48e22f
SHA1: 9fe5f78190714ddcf4c8433a646f2546100215c7
SHA256: 268be272ea80aadd57e8263c5e2503992ebdcc8ceec6bda6a4a28745fb535c13
SSDeep: 49152:ZTm3wr1iRscP3h6JnTxpb7N9/i7L7SAvJqeN:ZiAr8slJnlBrKeHu
Size: 1674832 bytes
File type: EXE
Platform: WIN32
Entropy: Packed
PEID: UPolyXv05_v6
Company: BitTorrent Inc.
Created at: 2014-05-05 20:39:29
Analyzed on: Windows7Ada SP1 64-bit


Summary:

Worm. A program that is primarily replicating on networks or removable drives.

Payload

No specific payload has been found.

Process activity

The Worm creates the following process(es):

TPAutoConnSvc.exe:1620
aff_setup.exe:1428
install.exe:3692
CloudBackup404.exe:1692
makecab.exe:4060
utt5372.tmp.exe:1808
rundll32.exe:1728
TrustedInstaller.exe:3868
vcredist_x64.exe:3660
RunDll32.exe:2568
SearchProtocolHost.exe:2868
%original file name%.exe:1224
MyPC Backup.exe:4084

The Worm injects its code into the following process(es):

uTorrent.exe:300
PUPautoinsaller_v1.exe:2688

Mutexes

The following mutexes were created/opened:
No objects were found.

File activity

The process aff_setup.exe:1428 makes changes in the file system.
The Worm creates and/or writes to the following file(s):

C:\Users\"%CurrentUserName%"\AppData\Local\Temp\CloudBackup404.exe (467810 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\aff.conf (379 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\nsx5B78.tmp (3344 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\nsx5B79.tmp\nsJSON.dll (15 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\nsx5B79.tmp\NSISdl.dll (30 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\nsx5B79.tmp\LogEx.dll (1597 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\log.txt (384 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\nsx5B79.tmp\nsRandom.dll (808 bytes)

The process install.exe:3692 makes changes in the file system.
The Worm creates and/or writes to the following file(s):

C:\Users\"%CurrentUserName%"\AppData\Local\Temp\dd_vcredistUI1104.txt (130934 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\dd_vcredistMSI1104.txt (203315 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\VWLC80F.tmp (392 bytes)
C:\54383a505f02045ba70726cebb\install.res.1033.dll (94 bytes)

The process CloudBackup404.exe:1692 makes changes in the file system.
The Worm creates and/or writes to the following file(s):

C:\Users\"%CurrentUserName%"\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\MyPC Backup\Uninstall.lnk (858 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\nsx9AD9.tmp\NSISdl.dll (30 bytes)
%Program Files% (x86)\MyPC Backup\syncing.ico (12088 bytes)
%Program Files% (x86)\MyPC Backup\Database\mpcb_file_cache.db (7 bytes)
%Program Files% (x86)\MyPC Backup\Service Start.exe (14 bytes)
%Program Files% (x86)\MyPC Backup\es_ES.mo (1856 bytes)
%Program Files% (x86)\MyPC Backup\pt_PT.mo (1856 bytes)
%Program Files% (x86)\MyPC Backup\Database\mpcb_backup_conf.db (16 bytes)
%Program Files% (x86)\MyPC Backup\AlphaVSS.60.x64.dll (6360 bytes)
%Program Files% (x86)\MyPC Backup\AlphaVSS.52.x86.dll (5064 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\nsx9AD9.tmp\AccessControl.dll (20 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MyPC Backup.lnk (1 bytes)
%Program Files% (x86)\MyPC Backup\Crypto64.dll (1856 bytes)
%Program Files% (x86)\MyPC Backup\diffstack.dll (1552 bytes)
%Program Files% (x86)\MyPC Backup\Shared Stack.dll (89498 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\mpbtrk.log (8 bytes)
%Program Files% (x86)\MyPC Backup\ObjectListView.dll (13584 bytes)
%Program Files% (x86)\MyPC Backup\Database\mpcb_queues.db (13 bytes)
%Program Files% (x86)\MyPC Backup\BackupStack.exe (1552 bytes)
%Program Files% (x86)\MyPC Backup\GetText.dll (12 bytes)
%Program Files% (x86)\MyPC Backup\AWSSDK.dll (106386 bytes)
%Program Files% (x86)\MyPC Backup\Configuration Updater.exe (784 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\nsx9AD9.tmp\nsSCM.dll (13 bytes)
%Program Files% (x86)\MyPC Backup\Database\mpcb_sig_cache.db (6 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\nsx9AD9.tmp\DotNetChecker.dll (1597 bytes)
C:\Users\"%CurrentUserName%"\Desktop\MyPC Backup.lnk (1 bytes)
%Program Files% (x86)\MyPC Backup\AlphaVSS.60.x86.dll (5520 bytes)
%Program Files% (x86)\MyPC Backup\tick.ico (12088 bytes)
%Program Files% (x86)\MyPC Backup\Updater.exe (31856 bytes)
%Program Files% (x86)\MyPC Backup\MyPC Backup.exe (93176 bytes)
%Program Files% (x86)\MyPC Backup\RegisterExtensionDotNet20_x86.exe (784 bytes)
%Program Files% (x86)\MyPC Backup\mypcbackup.ico (13368 bytes)
%Program Files% (x86)\MyPC Backup\fr_FR.mo (1856 bytes)
%Program Files% (x86)\MyPC Backup\LogicNP.EZShellExtensions.dll (8560 bytes)
%Program Files% (x86)\MyPC Backup\uninst.exe (1546 bytes)
%Program Files% (x86)\MyPC Backup\x64\System.Data.SQLite.dll (33633 bytes)
%Program Files% (x86)\MyPC Backup\AlphaVSS.52.x64.dll (5520 bytes)
%Program Files% (x86)\MyPC Backup\MPCBContextMenu.dll (217172 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\nsx9AD9.tmp\System.dll (23 bytes)
%Program Files% (x86)\MyPC Backup\syncicon.ico (1856 bytes)
%Program Files% (x86)\MyPC Backup\MPCBIconOverlays.dll (124204 bytes)
%Program Files% (x86)\MyPC Backup\de_DE.mo (1856 bytes)
%Program Files% (x86)\MyPC Backup\it_IT.mo (1856 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\nsx9AD9.tmp\nsExec.dll (14 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\MyPC Backup\MyPC Backup.lnk (1 bytes)
%Program Files% (x86)\MyPC Backup\Database\mpcb_settings.db (9 bytes)
%Program Files% (x86)\MyPC Backup\AlphaVSS.51.x86.dll (4992 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\nsi9AC9.tmp (604687 bytes)
%Program Files% (x86)\MyPC Backup\MPCBClient.dll (39329 bytes)
%Program Files% (x86)\MyPC Backup\RegisterExtensionDotNet20_x64.exe (16 bytes)
%Program Files% (x86)\MyPC Backup\RestartExplorer.exe (16 bytes)
%Program Files% (x86)\MyPC Backup\AlphaVSS.Common.dll (2392 bytes)
%Program Files% (x86)\MyPC Backup\Crypto32.dll (1856 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\vcredist_x64.exe (424037 bytes)
%Program Files% (x86)\MyPC Backup\UnRegisterExtensions.exe (15 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\nsx9AD9.tmp\nsRandom.dll (808 bytes)
%Program Files% (x86)\MyPC Backup\Signup Wizard.exe (33877 bytes)
%Program Files% (x86)\MyPC Backup\x86\System.Data.SQLite.dll (30464 bytes)

The process makecab.exe:4060 makes changes in the file system.
The Worm creates and/or writes to the following file(s):

C:\Windows\Temp\cab_4060_2 (564989 bytes)
C:\Windows\Temp\cab_4060_3 (76 bytes)
C:\Windows\Logs\CBS\CbsPersist_20140702083402.cab (11744 bytes)
C:\Windows\Temp\cab_4060_4 (564989 bytes)
C:\Windows\Temp\cab_4060_5 (76 bytes)
C:\Windows\Temp\cab_4060_6 (8 bytes)

The process utt5372.tmp.exe:1808 makes changes in the file system.
The Worm creates and/or writes to the following file(s):

C:\ProgramData\APN\APN-Stub\BTR-V7\Setup.ini (5 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\3Y5KZMDN\Setup[1].ini (1436 bytes)
C:\ProgramData\APN\APN-Stub\BTR-V7\ApnSetup.exe (3073 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\APN-Stub\BTR-V7\Stb226aaf9d-7a1e-4eed-92b1-6a2c8500b37f.log (6715 bytes)

The process rundll32.exe:1728 makes changes in the file system.
The Worm creates and/or writes to the following file(s):

C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\YL7ROG0G\impression[2].png (109 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\i_temp.temp (109 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\3Y5KZMDN\impression[1].png (109 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\WBDJL3LL\impression[2].png (109 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\WBDJL3LL\impression[3].png (109 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\mypcbackup_ww.temp (327 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\aff_setup.exe (18277 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\RM4KMRI1\aff_setup[1].exe (20065 bytes)

The process TrustedInstaller.exe:3868 makes changes in the file system.
The Worm creates and/or writes to the following file(s):

C:\Windows\winsxs\Temp\bffed561d095cf011e0000001c0fc80f\bffed561d095cf01210000001c0fc80f_mfc90u.dll (38780 bytes)
C:\Windows\System32\config\TxR\{016888cc-6c6f-11de-8d1d-001e0bcde3ec}.TxR.0.regtrans-ms (20440 bytes)
C:\Windows\winsxs\Temp\eb593c62d095cf013f0000001c0fc80f\eb593c62d095cf01400000001c0fc80f_manifest (766 bytes)
C:\Windows\winsxs\Temp\38589361d095cf01090000001c0fc80f\38589361d095cf010a0000001c0fc80f_manifest (760 bytes)
C:\Windows\System32\config\SOFTWARE (55139 bytes)
C:\Windows\winsxs\Temp\3a63a661d095cf010f0000001c0fc80f\9ac4a861d095cf01120000001c0fc80f_msvcp90.dll (7701 bytes)
C:\Windows\winsxs\Temp\2da24a62d095cf01450000001c0fc80f (4 bytes)
C:\Windows\winsxs\Temp\a7061b62d095cf012e0000001c0fc80f\07681d62d095cf01340000001c0fc80f_mfc90deu.dll (670 bytes)
C:\Windows\System32\config\COMPONENTS{15e3db1a-917a-11e2-9ef7-000c29a8bd90}.TMContainer00000000000000000002.regtrans-ms (28680 bytes)
C:\Windows\winsxs\Temp\b0b15061d095cf01020000001c0fc80f\10135361d095cf01050000001c0fc80f_catalog (21 bytes)
C:\Windows\winsxs\Temp\3a63a661d095cf010f0000001c0fc80f\9ac4a861d095cf01130000001c0fc80f_msvcm90.dll (1526 bytes)
C:\Windows\winsxs\Temp\2da24a62d095cf01450000001c0fc80f\2da24a62d095cf01480000001c0fc80f_catalog (22 bytes)
C:\Windows\winsxs\Temp\3a63a661d095cf010f0000001c0fc80f (4 bytes)
C:\Windows\winsxs\Temp\bffed561d095cf011e0000001c0fc80f\bffed561d095cf01200000001c0fc80f_mfcm90.dll (670 bytes)
C:\Windows\winsxs\Temp\b0b15061d095cf01020000001c0fc80f (4 bytes)
C:\Windows\System32 (824 bytes)
C:\Windows\winsxs\Temp\a7061b62d095cf012e0000001c0fc80f\07681d62d095cf01360000001c0fc80f_mfc90fra.dll (670 bytes)
C:\Windows\winsxs\Temp\a7061b62d095cf012e0000001c0fc80f\07681d62d095cf01350000001c0fc80f_mfc90enu.dll (113 bytes)
C:\Windows\winsxs\Temp\a7061b62d095cf012e0000001c0fc80f\07681d62d095cf01390000001c0fc80f_mfc90kor.dll (95 bytes)
C:\Windows\winsxs\Temp\a7061b62d095cf012e0000001c0fc80f\07681d62d095cf01380000001c0fc80f_mfc90jpn.dll (95 bytes)
C:\Windows\winsxs\Temp\a7061b62d095cf012e0000001c0fc80f\07681d62d095cf01310000001c0fc80f_mfc90cht.dll (79 bytes)
C:\Windows\winsxs\Temp\3a63a661d095cf010f0000001c0fc80f\9ac4a861d095cf01100000001c0fc80f_manifest (5 bytes)
C:\Windows\System32\config\COMPONENTS (203596 bytes)
C:\Windows\winsxs\Temp\bdf3c261d095cf01180000001c0fc80f\bdf3c261d095cf01190000001c0fc80f_manifest (760 bytes)
C:\Windows\winsxs\Temp\b0b15061d095cf01020000001c0fc80f\b0b15061d095cf01030000001c0fc80f_manifest (859 bytes)
C:\Windows\winsxs\Temp\65be0c62d095cf01280000001c0fc80f\65be0c62d095cf012a0000001c0fc80f_catalog (21 bytes)
C:\Windows\System32\config\COMPONENTS{15e3db19-917a-11e2-9ef7-000c29a8bd90}.TxR.2.regtrans-ms (856 bytes)
C:\Windows\winsxs\Temp\a7061b62d095cf012e0000001c0fc80f\a7061b62d095cf01300000001c0fc80f_mfc90chs.dll (78 bytes)
C:\Windows\winsxs\Temp\65be0c62d095cf01280000001c0fc80f (4 bytes)
C:\Windows\winsxs\Temp\cf4b5b62d095cf014c0000001c0fc80f\cf4b5b62d095cf014d0000001c0fc80f_manifest (676 bytes)
C:\Windows\Logs\CBS\CBS.log (87992 bytes)
C:\Windows\winsxs\Temp\a7061b62d095cf012e0000001c0fc80f (4 bytes)
C:\Windows\winsxs\ManifestCache\a786a517e28d5687_blobs.bin (4409 bytes)
C:\Windows\winsxs\Temp\bffed561d095cf011e0000001c0fc80f\bffed561d095cf011f0000001c0fc80f_manifest (6 bytes)
C:\Windows\winsxs\Temp\a7061b62d095cf012e0000001c0fc80f\07681d62d095cf013b0000001c0fc80f_catalog (21 bytes)
C:\Windows\winsxs\Temp\3a63a661d095cf010f0000001c0fc80f\9ac4a861d095cf01110000001c0fc80f_msvcr90.dll (4811 bytes)
C:\Windows\System32\config\COMPONENTS{15e3db19-917a-11e2-9ef7-000c29a8bd90}.TxR.0.regtrans-ms (76489 bytes)
C:\Windows\System32\config\COMPONENTS{15e3db19-917a-11e2-9ef7-000c29a8bd90}.TxR.1.regtrans-ms (856 bytes)
C:\Windows\winsxs\Temp\38589361d095cf01090000001c0fc80f (4 bytes)
C:\Windows\winsxs\Temp\a7061b62d095cf012e0000001c0fc80f\a7061b62d095cf012f0000001c0fc80f_manifest (13 bytes)
C:\Windows\winsxs\Temp\bffed561d095cf011e0000001c0fc80f (4 bytes)
C:\Windows\winsxs\Temp\eb593c62d095cf013f0000001c0fc80f\eb593c62d095cf01410000001c0fc80f_catalog (21 bytes)
C:\Windows\winsxs\Temp\a7061b62d095cf012e0000001c0fc80f\07681d62d095cf013a0000001c0fc80f_mfc90rus.dll (127 bytes)
C:\Windows\winsxs\Temp\2da24a62d095cf01450000001c0fc80f\2da24a62d095cf01460000001c0fc80f_manifest (864 bytes)
C:\Windows\winsxs\Temp\3a63a661d095cf010f0000001c0fc80f\9ac4a861d095cf01140000001c0fc80f_catalog (21 bytes)
C:\Windows\System32\config\TxR\{016888cc-6c6f-11de-8d1d-001e0bcde3ec}.TxR.blf (1640 bytes)
C:\Windows\winsxs\Temp\b0b15061d095cf01020000001c0fc80f\b0b15061d095cf01040000001c0fc80f_atl90.dll (853 bytes)
C:\Windows\System32\config\SYSTEM.LOG1 (4395 bytes)
C:\Windows\winsxs\Temp\65be0c62d095cf01280000001c0fc80f\65be0c62d095cf01290000001c0fc80f_manifest (760 bytes)
C:\Windows\winsxs\Temp\a7061b62d095cf012e0000001c0fc80f\07681d62d095cf01320000001c0fc80f_mfc90esn.dll (130 bytes)
C:\Windows\System32\config\SOFTWARE.LOG1 (58998 bytes)
C:\Windows\System32\config\TxR\{016888cd-6c6f-11de-8d1d-001e0bcde3ec}.TMContainer00000000000000000002.regtrans-ms (14808 bytes)
C:\Windows\winsxs\Temp\bffed561d095cf011e0000001c0fc80f\80c1da61d095cf01230000001c0fc80f_mfcm90u.dll (670 bytes)
C:\Windows\winsxs\Temp\a7061b62d095cf012e0000001c0fc80f\07681d62d095cf01370000001c0fc80f_mfc90ita.dll (129 bytes)
C:\Windows\winsxs\Temp\cf4b5b62d095cf014c0000001c0fc80f (4 bytes)
C:\Windows\System32\config\SYSTEM (3631 bytes)
C:\Windows\System32\config\COMPONENTS.LOG1 (195404 bytes)
C:\Windows\winsxs\Temp\bdf3c261d095cf01180000001c0fc80f (4 bytes)
C:\Windows\winsxs\Temp\bffed561d095cf011e0000001c0fc80f\80c1da61d095cf01240000001c0fc80f_catalog (21 bytes)
C:\Windows\winsxs\Temp\cf4b5b62d095cf014c0000001c0fc80f\cf4b5b62d095cf014e0000001c0fc80f_catalog (22 bytes)
C:\Windows\winsxs\Temp\bffed561d095cf011e0000001c0fc80f\1f60d861d095cf01220000001c0fc80f_mfc90.dll (38780 bytes)
C:\Windows\winsxs\Temp\bdf3c261d095cf01180000001c0fc80f\bdf3c261d095cf011a0000001c0fc80f_catalog (21 bytes)
C:\Windows\winsxs\Temp\eb593c62d095cf013f0000001c0fc80f (4 bytes)
C:\Windows (192 bytes)
C:\Windows\System32\config\COMPONENTS{15e3db19-917a-11e2-9ef7-000c29a8bd90}.TxR.blf (8230 bytes)
C:\Windows\System32\config (592 bytes)
C:\Windows\winsxs\Temp\2da24a62d095cf01450000001c0fc80f\2da24a62d095cf01470000001c0fc80f_vcomp90.dll (120 bytes)
C:\Windows\winsxs\Temp\a7061b62d095cf012e0000001c0fc80f\07681d62d095cf01330000001c0fc80f_mfc90esp.dll (130 bytes)
C:\Windows\winsxs\Temp\38589361d095cf01090000001c0fc80f\98b99561d095cf010b0000001c0fc80f_catalog (21 bytes)

The process vcredist_x64.exe:3660 makes changes in the file system.
The Worm creates and/or writes to the following file(s):

C:\54383a505f02045ba70726cebb\eula.1042.txt (650 bytes)
C:\54383a505f02045ba70726cebb\install.ini (844 bytes)
C:\54383a505f02045ba70726cebb\eula.1033.txt (10 bytes)
C:\54383a505f02045ba70726cebb\Program Files(64)\Microsoft Visual Studio 9.0\Vc7\WinSXS\AMD64 catalogs\Microsoft.VC90.DebugCRT.cat (9 bytes)
C:\54383a505f02045ba70726cebb\Program Files(64)\Microsoft Visual Studio 9.0\Vc7\WinSXS\AMD64 catalogs\policy.9.00.Microsoft.VC90.CRT.cat (630 bytes)
C:\54383a505f02045ba70726cebb\eula.1040.txt (657 bytes)
C:\54383a505f02045ba70726cebb\install.res.2052.dll (1632 bytes)
C:\54383a505f02045ba70726cebb\install.res.1042.dll (1988 bytes)
C:\54383a505f02045ba70726cebb\Program Files(64)\Microsoft Visual Studio 9.0\Vc7\WinSXS\AMD64 catalogs\Microsoft.VC90.CRT.cat (9 bytes)
C:\54383a505f02045ba70726cebb\Program Files(64)\Microsoft Visual Studio 9.0\Vc7\WinSXS\AMD64 catalogs\policy.9.00.Microsoft.VC90.ATL.cat (9 bytes)
C:\54383a505f02045ba70726cebb\$shtdwn$.req (788 bytes)
C:\54383a505f02045ba70726cebb\eula.1036.txt (12 bytes)
C:\54383a505f02045ba70726cebb\eula.3082.txt (12 bytes)
C:\54383a505f02045ba70726cebb\Program Files(64)\Microsoft Visual Studio 9.0\Vc7\WinSXS\AMD64 catalogs\Microsoft.VC90.MFCLOC.cat (9 bytes)
C:\54383a505f02045ba70726cebb\install.res.1031.dll (1160 bytes)
C:\54383a505f02045ba70726cebb\eula.2052.txt (3 bytes)
C:\54383a505f02045ba70726cebb\install.res.1040.dll (2110 bytes)
C:\54383a505f02045ba70726cebb\vc_red.cab (65618 bytes)
C:\54383a505f02045ba70726cebb\Program Files(64)\Microsoft Visual Studio 9.0\Vc7\WinSXS\AMD64 catalogs\policy.9.00.Microsoft.VC90.MFC.cat (658 bytes)
C:\54383a505f02045ba70726cebb\Program Files(64)\Microsoft Visual Studio 9.0\Vc7\WinSXS\AMD64 catalogs\Microsoft.VC90.ATL.cat (155 bytes)
C:\54383a505f02045ba70726cebb\install.res.1049.dll (1720 bytes)
C:\54383a505f02045ba70726cebb\install.res.1033.dll (1452 bytes)
C:\54383a505f02045ba70726cebb (8 bytes)
C:\54383a505f02045ba70726cebb\Program Files(64)\Microsoft Visual Studio 9.0\Vc7\WinSXS\AMD64 catalogs\policy.9.00.Microsoft.VC90.OpenMP.cat (297 bytes)
C:\54383a505f02045ba70726cebb\Program Files(64)\Microsoft Visual Studio 9.0\Vc7\WinSXS\AMD64 catalogs\Microsoft.VC90.DebugMFC.cat (9 bytes)
C:\54383a505f02045ba70726cebb\eula.1049.txt (13 bytes)
C:\54383a505f02045ba70726cebb\install.res.1036.dll (1355 bytes)
C:\54383a505f02045ba70726cebb\vc_red.msi (3176 bytes)
C:\54383a505f02045ba70726cebb\Program Files(64)\Microsoft Visual Studio 9.0\Vc7\WinSXS\AMD64 catalogs\policy.9.00.Microsoft.VC90.DebugCRT.cat (9 bytes)
C:\54383a505f02045ba70726cebb\globdata.ini (1 bytes)
C:\54383a505f02045ba70726cebb\Program Files(64)\Microsoft Visual Studio 9.0\Vc7\WinSXS\AMD64 catalogs\Microsoft.VC90.DebugOpenMP.cat (9 bytes)
C:\54383a505f02045ba70726cebb\vcredist.bmp (5 bytes)
C:\54383a505f02045ba70726cebb\eula.1041.txt (5 bytes)
C:\54383a505f02045ba70726cebb\Program Files(64)\Microsoft Visual Studio 9.0\Vc7\WinSXS\AMD64 catalogs\policy.9.00.Microsoft.VC90.DebugMFC.cat (236 bytes)
C:\54383a505f02045ba70726cebb\Program Files(64)\Microsoft Visual Studio 9.0\Vc7\WinSXS\AMD64 catalogs\Microsoft.VC90.MFC.cat (9 bytes)
C:\54383a505f02045ba70726cebb\install.exe (13918 bytes)
C:\54383a505f02045ba70726cebb\Program Files(64)\Microsoft Visual Studio 9.0\Vc7\WinSXS\AMD64 catalogs (8 bytes)
C:\54383a505f02045ba70726cebb\install.res.3082.dll (989 bytes)
C:\54383a505f02045ba70726cebb\eula.1028.txt (3 bytes)
C:\54383a505f02045ba70726cebb\install.res.1028.dll (1130 bytes)
C:\54383a505f02045ba70726cebb\Program Files(64)\Microsoft Visual Studio 9.0\Vc7\WinSXS\AMD64 catalogs\Microsoft.VC90.OpenMP.cat (9 bytes)
C:\54383a505f02045ba70726cebb\Program Files(64)\Microsoft Visual Studio 9.0\Vc7\WinSXS\AMD64 catalogs\policy.9.00.Microsoft.VC90.DebugOpenMP.cat (9 bytes)
C:\54383a505f02045ba70726cebb\eula.1031.txt (229 bytes)
C:\54383a505f02045ba70726cebb\install.res.1041.dll (1126 bytes)
C:\54383a505f02045ba70726cebb\Program Files(64)\Microsoft Visual Studio 9.0\Vc7\WinSXS\AMD64 catalogs\policy.9.00.Microsoft.VC90.MFCLOC.cat (9 bytes)

The process uTorrent.exe:300 makes changes in the file system.
The Worm creates and/or writes to the following file(s):

C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\3Y5KZMDN\btappCAOTAHKC.js (673 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\YL7ROG0G\collect[2].gif (35 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\YL7ROG0G\gui[3].js (599 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\RM4KMRI1\btappCACMKZ4X.js (693 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\YL7ROG0G\btappCAN3LJEL.js (25 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\RM4KMRI1\logo.2c586cc7a3f8c7e684be335d22b13d8d[1].png (988 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\YL7ROG0G\btappCA9487S3.js (44 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\YL7ROG0G\btapp[4].js (44 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\uTorrent\apps\72F0D3E2141065DACF6134D07A06A2DF20590748 (4 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\WBDJL3LL\btappCAJLQGA4.js (434 bytes)
C:\Users\"%CurrentUserName%"\Downloads\Somewhere Else\01 - Zeds Dead (feat. Twin Shadow) - Lost You (Official Music Video).mp4 (45687 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\WBDJL3LL\btapp[10].js (44 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\YL7ROG0G\btappCAJB4CG5.js (44 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\YL7ROG0G\btappCABSFWYL.js (556 bytes)
C:\Users\"%CurrentUserName%"\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\7D266D9E1E69FA1EEFB9699B009B34C8_0A9BFDD75B598C2110CBF610C078E6E6 (1 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\WBDJL3LL\btappCAIHVX1F.js (44 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\WBDJL3LL\btappCA4U6SRR.js (44 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\RM4KMRI1\guiCA21OWJN.js (601 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\WBDJL3LL\btappCAYE1AA4.js (44 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\3Y5KZMDN\__utm[1].gif (35 bytes)
C:\Users\"%CurrentUserName%"\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\23B523C9E7746F715D33C6527C18EB9D (1 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\RM4KMRI1\btappCAIP1IYS.js (44 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\3Y5KZMDN\btappCA778LC6.js (44 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\YL7ROG0G\btappCAXR4HNZ.js (676 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\WBDJL3LL\btappCAASGOOL.js (235 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\3Y5KZMDN\gui[3].js (587 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\uTorrent\apps\plus.btapp.new (796 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\YL7ROG0G\version[1].json (511 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\3Y5KZMDN\btapp[10].js (44 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\3Y5KZMDN\gui[4].js (644 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Microsoft\Windows\Cookies\3MXDA1LM.txt (93 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\RM4KMRI1\gui[1].js (580 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\RM4KMRI1\mobile-payment[1].png (1601 bytes)
C:\Users\"%CurrentUserName%"\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\C46E7B0F942663A1EDC8D9D6D7869173_42820CDFEA41DC84AAB89A6B63561873 (1496 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\RM4KMRI1\btappCAMY9X6B.js (524 bytes)
C:\Users\"%CurrentUserName%"\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\1060B7ADDE0FF6DE85637BF89FC4CEBC_49ED5C6881BAA22BDB94D2786FA54449 (1480 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\YL7ROG0G\btappCALM4ZI7.js (44 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\WBDJL3LL\fontawesome-webfont.8b27bc96115c2d24350f0d09e6a9433f[1].eot (23601 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\WBDJL3LL\btappCAYX2SIW.js (618 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\RM4KMRI1\btappCA5AL4HI.js (434 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\3Y5KZMDN\btappCARLJ5L7.js (44 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\YL7ROG0G\btappCANSH0L2.js (76 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\RM4KMRI1\btappCA1XXCQY.js (434 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\YL7ROG0G\btappCANHU5TD.js (44 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\YL7ROG0G\btappCAX40LOW.js (44 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\YL7ROG0G\btappCANDH1UE.js (561 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\3Y5KZMDN\btapp[6].js (44 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\WBDJL3LL\btappCAP9X0YK.js (44 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\utt6BA3.tmp (9760 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\3Y5KZMDN\btappCAI1SEDV.js (912 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\WBDJL3LL\btappCAK62SP0.js (44 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\WBDJL3LL\guiCAV1ZLRH.js (645 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\YL7ROG0G\e[2].htm (63 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\YL7ROG0G\btappCA963F70.js (44 bytes)
C:\Users\"%CurrentUserName%"\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\7B8944BA8AD0EFDF0E01A43EF62BECD0_251DAA28139FC527316726DEB16CC0E9 (1 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\RM4KMRI1\btappCAZ7TZ21.js (25 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\3Y5KZMDN\icon[2].ico (200 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\3Y5KZMDN\gui[7].js (599 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\uTorrent\apps\72F0D3E2141065DACF6134D07A06A2DF20590748\btapp (196 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\WBDJL3LL\btappCABEADLJ.js (44 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\YL7ROG0G\jquery.min[1].js (53489 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\RM4KMRI1\btappCAZ6PAOM.js (25 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\RM4KMRI1\btappCAHO2WZM.js (44 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\3Y5KZMDN\btappCAB6S9W0.js (878 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\RM4KMRI1\gui[4].js (644 bytes)
C:\Users\"%CurrentUserName%"\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\0D6ED27B76F0582A8D2120DF24D1E180_B52DB0DD355A2D437E4D65686FF6F4AD (1448 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\WBDJL3LL\btappCA0MBQNV.js (44 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\YL7ROG0G\other[1].png (1213 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\WBDJL3LL\btapp[8].js (44 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\3Y5KZMDN\btappCAWCJC1T.js (25 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\WBDJL3LL\btappCA5OHO0O.js (526 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\RM4KMRI1\btappCAH68RE4.js (44 bytes)
C:\Users\"%CurrentUserName%"\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\8059E9A0D314877E40FE93D8CCFB3C69_631D72ECDAF6CA83C992AE241849F034 (1432 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\YL7ROG0G\btappCAFGFLHM.js (434 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\RM4KMRI1\gui[3].js (644 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\WBDJL3LL\btappCAACE0LB.js (44 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\WBDJL3LL\btapp[2].js (431 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\3Y5KZMDN\btappCA210BHZ.js (556 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\uTorrent\dlimagecache\1B484B7F8E392004E0C4152F6E4FF038101F7EDE (5821 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\WBDJL3LL\btappCAWRJFH4.js (434 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\3Y5KZMDN\btapp[2].js (145 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\RM4KMRI1\fileserve[1].js (42281 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\uTorrent\utorrent.lng (1 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\3Y5KZMDN\btappCALXCXAG.js (815 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\WBDJL3LL\guiCAV65NEG.js (598 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\3Y5KZMDN\icon[3].ico (200 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\YL7ROG0G\nr-411.min[1].js (5834 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\YL7ROG0G\ut-premium-logo[1].png (2529 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\RM4KMRI1\btappCA2YAXJ4.js (44 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\WBDJL3LL\gui[5].js (588 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\3Y5KZMDN\btappCAX1X2DB.js (44 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\RM4KMRI1\btappCAFQXV1H.js (44 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\3Y5KZMDN\btappCA96VO2K.js (528 bytes)
C:\Users\"%CurrentUserName%"\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\7B8944BA8AD0EFDF0E01A43EF62BECD0_251DAA28139FC527316726DEB16CC0E9 (1504 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\3Y5KZMDN\btappCAD467JM.js (44 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\3Y5KZMDN\gui[6].js (645 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\WBDJL3LL\btapp[1].js (1585 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\YL7ROG0G\btappCAFU1UP5.js (25 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\WBDJL3LL\gui[9].js (594 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\WBDJL3LL\btappCAH4KFBG.js (44 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\YL7ROG0G\index[1].htm (3446 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\RM4KMRI1\btappCAUSRT22.js (518 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\3Y5KZMDN\collect[3].gif (35 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\3Y5KZMDN\icon[4].ico (200 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\WBDJL3LL\btapp[6].js (361 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\WBDJL3LL\MTP_ySUJH_bn48VBG8sNSnZ2MAKAc2x4R1uOSeegc5U[1].eot (14266 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\3Y5KZMDN\btappCA3FWYSL.js (1 bytes)
C:\Users\"%CurrentUserName%"\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\C46E7B0F942663A1EDC8D9D6D7869173_42820CDFEA41DC84AAB89A6B63561873 (1 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\RM4KMRI1\guiCAR17YG6.js (645 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\YL7ROG0G\btappCA3JEIHI.js (700 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\WBDJL3LL\btappCA1TJFK9.js (717 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\WBDJL3LL\btapp[4].js (383 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\3Y5KZMDN\btappCAALBUUU.js (527 bytes)
C:\Users\"%CurrentUserName%"\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\D47DBD2F9E3365FBBE008D71FB06716F_D33192D58AA9CA2B9097E848E9FE86DE (1 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\RM4KMRI1\btappCA39HSJF.js (44 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\WBDJL3LL\fileserve[1].js (917 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\WBDJL3LL\btappCA5R7NCY.js (25 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\YL7ROG0G\btappCAE7J16R.js (44 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\YL7ROG0G\btappCAQBQCRY.js (614 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\YL7ROG0G\btapp[10].js (521 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\RM4KMRI1\btappCA00E5GV.js (25 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\WBDJL3LL\oigklpHfR96yCGJVAjuK_Zeds Dead Press Photo 2014[1].jpg (93008 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\RM4KMRI1\btappCAKM05J7.js (890 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\3Y5KZMDN\btapp[7].js (44 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\3Y5KZMDN\btapp[9].js (352 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\YL7ROG0G\e[1].htm (63 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\WBDJL3LL\btapp[3].js (44 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\RM4KMRI1\btappCA7C4UE2.js (564 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\3Y5KZMDN\btappCA5CLTO0.js (44 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\YL7ROG0G\paypal[1].png (1345 bytes)
C:\Users\"%CurrentUserName%"\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\0D6ED27B76F0582A8D2120DF24D1E180_B52DB0DD355A2D437E4D65686FF6F4AD (1 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\YL7ROG0G\btapp[9].js (44 bytes)
C:\Users\"%CurrentUserName%"\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\23B523C9E7746F715D33C6527C18EB9D (876 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\RM4KMRI1\btappCAUX0ZW2.js (44 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\uTorrent\apps\D944B3378FAB35793B7951FA53E41B2AB9CC462B\empty_movie.gif (282 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\3Y5KZMDN\btappCAQX3FCF.js (44 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\uTorrent\apps\D944B3378FAB35793B7951FA53E41B2AB9CC462B\info_icon.png (250 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\RM4KMRI1\btappCAV6EYCH.js (44 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\YL7ROG0G\btapp[2].js (44 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\WBDJL3LL\btapp[9].js (44 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\RM4KMRI1\btappCA2XITXU.js (671 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\YL7ROG0G\btappCAPJ3ACS.js (500 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\WBDJL3LL\btappCA048LH9.js (44 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\WBDJL3LL\btapp[5].js (44 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\uTorrent\apps\72F0D3E2141065DACF6134D07A06A2DF20590748\index.js (1 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\YL7ROG0G\btappCAJHYB4S.js (44 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\YL7ROG0G\gui[4].js (645 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\RM4KMRI1\fontawesome-webfont.3293616ec0c605c7c2db25829a0a509e[1].woff (30247 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\uTorrent\apps\D944B3378FAB35793B7951FA53E41B2AB9CC462B\index.html (3 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\RM4KMRI1\btappCA5LHIR0.js (44 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\3Y5KZMDN\gui[8].js (645 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\uTorrent\apps\72F0D3E2141065DACF6134D07A06A2DF20590748\index.html (1 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\RM4KMRI1\gui[10].js (600 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\RM4KMRI1\jquery.min[1].js (62159 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Microsoft\Crypto\RSA\S-1-5-21-2858020935-2156992550-3658131804-1003\fa5cdd5fe742f2b4881510ea4f5e4af8_c0322acd-5e5d-42f0-b163-c591ee6ff5b9 (80 bytes)
C:\Users\"%CurrentUserName%"\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\D47DBD2F9E3365FBBE008D71FB06716F_D33192D58AA9CA2B9097E848E9FE86DE (1520 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\3Y5KZMDN\btappCAM5BHA1.js (703 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\YL7ROG0G\gui[1].js (588 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\uTorrent\updates\2ebed0.lng (1 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\uTorrent\apps\72F0D3E2141065DACF6134D07A06A2DF20590748\main.css (946 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\YL7ROG0G\btappCAHVY1OA.js (432 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\RM4KMRI1\btapp[1].js (64 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\RM4KMRI1\btappCAQS5F6O.js (587 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\3Y5KZMDN\btapp[5].js (331 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\YL7ROG0G\css[1].css (25 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\YL7ROG0G\btappCAIJXTHP.js (44 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\YL7ROG0G\ga[1].js (25856 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\RM4KMRI1\btapp[11].js (404 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\RM4KMRI1\streaming[1].js (489 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\3Y5KZMDN\btappCAD3XICN.js (44 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Microsoft\Windows\Cookies\NMVVK3JL.txt (146 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\YL7ROG0G\btapp[8].js (44 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\YL7ROG0G\btappCA4QWBF0.js (44 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\3Y5KZMDN\btappCASPOAP0.js (44 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\uTorrent\apps\welcome-upsell.btapp (28 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\YL7ROG0G\btappCA5TV6CN.js (44 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\WBDJL3LL\btappCA6EP25E.js (44 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\WBDJL3LL\btappCABZ84EW.js (775 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\YL7ROG0G\btappCAIXQKVD.js (1 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\YL7ROG0G\collect[1].gif (35 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\3Y5KZMDN\btappCAYR54VH.js (25 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\RM4KMRI1\btappCAUCRJ2V.js (44 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\WBDJL3LL\e[2].htm (63 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\3Y5KZMDN\collect[2].gif (35 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\uTorrent\dlimagecache\F70279A5F7D321E839A0873E003F124BD9C287BF (3615 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\uTorrent\updates\3.4.2_32176.exe (50 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\WBDJL3LL\btappCAVQQE14.js (44 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\3Y5KZMDN\client2[1].js (6611 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\WBDJL3LL\btappCAG3TACF.js (44 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\3Y5KZMDN\btappCAHLEACN.js (44 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\3Y5KZMDN\btappCAX9P68Z.js (405 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\uTorrent\dlimagecache\10E6FBE4D921B475FA5FEC6E9A535A540D6FEED1 (318 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\YL7ROG0G\btappCATG3807.js (44 bytes)
C:\Users\"%CurrentUserName%"\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\1060B7ADDE0FF6DE85637BF89FC4CEBC_49ED5C6881BAA22BDB94D2786FA54449 (1 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\3Y5KZMDN\btappCAS4LXX1.js (527 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\YL7ROG0G\btappCAKIQXE3.js (44 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\uTorrent\apps\player.btapp (3 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\3Y5KZMDN\btappCAOXC37A.js (1 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\YL7ROG0G\btappCARZB9ET.js (994 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\YL7ROG0G\DXI1ORHCpsQm3Vp6mXoaTXZ2MAKAc2x4R1uOSeegc5U[1].eot (11583 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\3Y5KZMDN\visa-mastercard[1].png (2207 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\uTorrent\trusted\bittorrent.crt (974 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\YL7ROG0G\btappCAU7PWD5.js (828 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\WBDJL3LL\btappCA90I9LP.js (523 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\3Y5KZMDN\btappCA4IC4EI.js (44 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\utt60D6.tmp (11855 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\RM4KMRI1\btapp[8].js (44 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\WBDJL3LL\btappCAWUHN3F.js (44 bytes)
C:\Users\"%CurrentUserName%"\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\49514950C94E8026A2B06312597DFF49_569BD946168DB279A65378F7D088CFD0 (1 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\YL7ROG0G\btappCA629LMC.js (44 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\WBDJL3LL\base.fcc9358c8aaae43d85b310d2804259c0.gz[1].js (112243 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\RM4KMRI1\btapp[5].js (44 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Microsoft\Windows\Cookies\9XQA70PW.txt (93 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Microsoft\Windows\Cookies\V21PO3O0.txt (91 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\RM4KMRI1\btapp[9].js (352 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\YL7ROG0G\8b9486d826[1].js (21 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\RM4KMRI1\btapp[2].js (63 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\WBDJL3LL\btappCARN147M.js (406 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\RM4KMRI1\btappCAIDRGA2.js (563 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\RM4KMRI1\btappCA80ANGI.js (528 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Microsoft\Windows\Cookies\OHD0ACBN.txt (133 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\RM4KMRI1\modernizr.gz[1].js (5898 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\RM4KMRI1\btapp[7].js (218 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\WBDJL3LL\gui[8].js (588 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\WBDJL3LL\btappCA0MI4SC.js (1 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\RM4KMRI1\btappCAQAHJIQ.js (526 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\WBDJL3LL\cJZKeOuBrn4kERxqtaUH3fY6323mHUZFJMgTvxaG2iE[1].eot (13365 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\RM4KMRI1\btappCA9PXKS9.js (44 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\RM4KMRI1\btapp[6].js (44 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\WBDJL3LL\gui[6].js (644 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\RM4KMRI1\btapp[3].js (111 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\RM4KMRI1\gui[9].js (599 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\YL7ROG0G\btappCABW9F69.js (406 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\RM4KMRI1\btappCACM5MQ5.js (716 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\YL7ROG0G\btappCA4PP5LM.js (25 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\3Y5KZMDN\btappCA87F6CC.js (982 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\WBDJL3LL\guiCABUB5LG.js (646 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\uTorrent\apps\72F0D3E2141065DACF6134D07A06A2DF20590748\icon.bmp (1 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Microsoft\Windows\Cookies\0PV85N9Z.txt (300 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\RM4KMRI1\styles[1].css (2314 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\YL7ROG0G\btappCAEM9EFW.js (44 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\3Y5KZMDN\btappCA0SHLHE.js (44 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\3Y5KZMDN\btappCAQWS4UB.js (44 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\uTorrent\updates.dat (4237 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\YL7ROG0G\btappCAJOTHEK.js (25 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\WBDJL3LL\btappCAQ9U81J.js (528 bytes)
C:\Users\"%CurrentUserName%"\Downloads\Somewhere Else\00_What's-Inside.html (3 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\YL7ROG0G\btappCAC9K4T3.js (44 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\RM4KMRI1\btappCAGNGETW.js (556 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\RM4KMRI1\btappCAK170RA.js (44 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\RM4KMRI1\btappCAQ6BBKW.js (44 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\3Y5KZMDN\btappCAS66QNZ.js (589 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\WBDJL3LL\gui[11].js (600 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\YL7ROG0G\btapp[7].js (44 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\YL7ROG0G\btappCA2JZ00R.js (44 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\3Y5KZMDN\social-sprite.3c63010ad741960298c76cf7aabd3627[1].png (1435 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\YL7ROG0G\btapp[3].js (44 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\YL7ROG0G\btappCAGT9B0L.js (674 bytes)
C:\Users\"%CurrentUserName%"\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\49514950C94E8026A2B06312597DFF49_F4692EBD578D04048E176E82BB8369BB (1 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\WBDJL3LL\bootstrap.min[1].css (34469 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\RM4KMRI1\btappCASQ65XP.js (434 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\RM4KMRI1\public.6e99eab4adc332040f74e65e06c4942b.gz[1].css (64379 bytes)
C:\Users\"%CurrentUserName%"\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\8059E9A0D314877E40FE93D8CCFB3C69_631D72ECDAF6CA83C992AE241849F034 (463 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\YL7ROG0G\btappCAYM14ER.js (704 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\3Y5KZMDN\btappCA9M4812.js (432 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\YL7ROG0G\btappCATWWPG9.js (524 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\3Y5KZMDN\btappCAGVHF75.js (564 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\WBDJL3LL\btapp[7].js (232 bytes)
C:\Users\"%CurrentUserName%"\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\49514950C94E8026A2B06312597DFF49_569BD946168DB279A65378F7D088CFD0 (1158 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\RM4KMRI1\analytics[1].js (17373 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\RM4KMRI1\gui[5].js (588 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\RM4KMRI1\btappCA4EU6T6.js (44 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\YL7ROG0G\ecommerce[1].js (25 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\YL7ROG0G\btapp[11].js (44 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\uTorrent\settings.dat.new (73 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\uTorrent\Somewhere Else.torrent (26 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\WBDJL3LL\btappCAORHTYW.js (25 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\3Y5KZMDN\icon[1].ico (200 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\YL7ROG0G\btappCA2YL915.js (44 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\3Y5KZMDN\icon[5].ico (200 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\RM4KMRI1\gui[11].js (645 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\RM4KMRI1\btapp[10].js (571 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\WBDJL3LL\btappCA60IRQ9.js (44 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\uTorrent\apps\D944B3378FAB35793B7951FA53E41B2AB9CC462B\x.png (265 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\WBDJL3LL\guiCAYOMHHW.js (645 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\RM4KMRI1\gui[8].js (645 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\RM4KMRI1\e[2].htm (63 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\WBDJL3LL\gui[1].js (587 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\RM4KMRI1\fileserve[1].png (200 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\uTorrent\apps\D944B3378FAB35793B7951FA53E41B2AB9CC462B (4 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\WBDJL3LL\btappCA76YDBI.js (44 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\3Y5KZMDN\btappCALGLIDR.js (527 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\3Y5KZMDN\amex-discover[1].png (2529 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\WBDJL3LL\btappCA893JQU.js (674 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\RM4KMRI1\gui[2].js (586 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\3Y5KZMDN\btappCAYV6RLD.js (44 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\RM4KMRI1\btappCA16OKIJ.js (25 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\YL7ROG0G\btappCA0HQ2IF.js (25 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\WBDJL3LL\btappCAJ86T5M.js (434 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Microsoft\Windows\Cookies\6T8M8RS9.txt (146 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\RM4KMRI1\btappCAKQNK1W.js (44 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\RM4KMRI1\btapp[4].js (44 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\3Y5KZMDN\icon[6].ico (200 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\YL7ROG0G\btappCA2DIY6N.js (702 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\3Y5KZMDN\collect[1].gif (35 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\WBDJL3LL\gui[4].js (644 bytes)
C:\Users\"%CurrentUserName%"\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\49514950C94E8026A2B06312597DFF49_F4692EBD578D04048E176E82BB8369BB (1360 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\3Y5KZMDN\btappCAUV541P.js (25 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\3Y5KZMDN\btappCADPZUWT.js (44 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\3Y5KZMDN\btappCAQEA4DS.js (25 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\RM4KMRI1\btappCAIJ2BFK.js (44 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\WBDJL3LL\gui[3].js (585 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\RM4KMRI1\btappCAUF2REB.js (44 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\YL7ROG0G\bundle-logo-large.4a053bd30f5bb3329130cf4fc49d0d73[1].png (987 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\YL7ROG0G\btapp[1].js (109 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\3Y5KZMDN\btappCAV05NPV.js (25 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\RM4KMRI1\devices-02[1].png (2403 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Microsoft\Windows\Cookies\IEI7BOL6.txt (633 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\WBDJL3LL\btappCAB041E2.js (528 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\3Y5KZMDN\btapp[11].js (551 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\YL7ROG0G\btapp[6].js (44 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\3Y5KZMDN\btapp[8].js (44 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\YL7ROG0G\blank[1].htm (109 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\YL7ROG0G\gui[2].js (617 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\WBDJL3LL\ribbon[1].png (2207 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\3Y5KZMDN\btappCAWY7ST5.js (44 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\WBDJL3LL\btapp[11].js (44 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\YL7ROG0G\btappCA24VUAH.js (702 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\RM4KMRI1\collect[1].gif (35 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\3Y5KZMDN\btappCAWA29F5.js (684 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\3Y5KZMDN\btappCAT9WB3C.js (406 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\WBDJL3LL\icon-close[1].png (235 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\utt6038.tmp.new (2 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\utt60D5.tmp (693 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\WBDJL3LL\gui[7].js (645 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\WBDJL3LL\btappCAC7JF1R.js (993 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Microsoft\Windows\Cookies\B8TRNDGE.txt (339 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\3Y5KZMDN\btapp[1].js (64 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\WBDJL3LL\e[1].htm (63 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\3Y5KZMDN\fileserve[1].js (505 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\YL7ROG0G\btappCAU0AT4E.js (558 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\3Y5KZMDN\btappCAGEBRJD.js (640 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\RM4KMRI1\gui[6].js (598 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\3Y5KZMDN\4nXTCoozQ8OBGW8wolSQ_zd_somewhere_else_final[1].jpg (14411 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\RM4KMRI1\btappCAUDQNXH.js (44 bytes)
C:\Users\"%CurrentUserName%"\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\7D266D9E1E69FA1EEFB9699B009B34C8_0A9BFDD75B598C2110CBF610C078E6E6 (1212 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Microsoft\Windows\Cookies\LCR0UH4E.txt (633 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\RM4KMRI1\btappCAWD74G7.js (44 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\YL7ROG0G\btappCAHS2FO6.js (556 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Internet Explorer\DOMStore\DRT4YCWO\bundles.bittorrent[1].xml (3071 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\YL7ROG0G\btappCADGI316.js (1 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\uTorrent\apps\featuredContent.btapp.new (19 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\uTorrent\updates\3.4.1_31105.exe (10815 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\3Y5KZMDN\btappCA7TBH0K.js (44 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\RM4KMRI1\badge_itunes-lrg[1].png (5 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\WBDJL3LL\css[1].css (25 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\YL7ROG0G\btapp[5].js (44 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\3Y5KZMDN\btapp[3].js (44 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\RM4KMRI1\e[1].htm (63 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\YL7ROG0G\fileserve[1].css (73 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\WBDJL3LL\guiCAGRIGUN.js (602 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\uTorrent\apps\D944B3378FAB35793B7951FA53E41B2AB9CC462B\vid_thumb.jpg (23 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\3Y5KZMDN\gui[5].js (597 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\WBDJL3LL\btappCACNHOSQ.js (44 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\3Y5KZMDN\gui[1].js (582 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\YL7ROG0G\btappCAUTA572.js (786 bytes)
C:\Users\"%CurrentUserName%"\Downloads\Somewhere Else\02 - Zeds Dead x Memorecks - Love Me.mp3 (1078 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\RM4KMRI1\gui[7].js (645 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\YL7ROG0G\btappCANXT65X.js (44 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\WBDJL3LL\public.b32f033b6c29a80cf06b5ef8d8265b05.gz[1].js (95219 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\3Y5KZMDN\gui[2].js (617 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\uTorrent\apps\D944B3378FAB35793B7951FA53E41B2AB9CC462B\btapp (201 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\WBDJL3LL\btappCATBT11Q.js (44 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\3Y5KZMDN\btapp[4].js (44 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\WBDJL3LL\79b5f927c68a0bc7f648e016404705ab4f86772403bfbd9c089194fbebe30203[1].htm (6497 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\3Y5KZMDN\laptop-free[1].png (1 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\3Y5KZMDN\btappCAB198YI.js (925 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\3Y5KZMDN\btappCAWQ9GOB.js (44 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\RM4KMRI1\devices-01[1].png (865 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\uTorrent\dlimagecache\165F6EF40A81DD175FFAEA69E77ABFD30B27E71C (119 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\WBDJL3LL\gui[2].js (639 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\WBDJL3LL\gui[10].js (645 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\uTorrent\dlimagecache\06916B614AFE15475B00E95D2B77B0E8E5F34CE3 (8492 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\WBDJL3LL\btappCAL8JXE2.js (25 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\History\desktop.ini (224 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\WBDJL3LL\main[1].js (314 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\uTorrent\app.1404290028.tmp (1568 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\RM4KMRI1\btappCAB0KCU7.js (527 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\WBDJL3LL\btappCAP7YO57.js (628 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\3Y5KZMDN\btappCA0Y0KCM.js (44 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\WBDJL3LL\btappCAMGHUEY.js (44 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\WBDJL3LL\btappCAZJAUXF.js (44 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\3Y5KZMDN\btappCAN2SLR7.js (25 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\uTorrent\apps\D944B3378FAB35793B7951FA53E41B2AB9CC462B\main.css (6 bytes)

The process %original file name%.exe:1224 makes changes in the file system.
The Worm creates and/or writes to the following file(s):

C:\Users\"%CurrentUserName%"\Desktop\µTorrent.lnk (811 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Microsoft\Windows\Cookies\WHLZDAY7.txt (88 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\i_temp.temp (327 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\uTorrent\maindoc.ico (63 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\offconfig.temp (1 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\uTorrent\apps\72F0D3E2141065DACF6134D07A06A2DF20590748\main.css (946 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\YL7ROG0G\impression[1].png (109 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\uttDD87.tmp.new (82 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\uTorrent\apps\plus.btapp (796 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\utt5F94.tmp.new (2 bytes)
C:\Users\"%CurrentUserName%"\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\77EC63BDA74BD0D0E0426DC8F8008506 (656 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\WBDJL3LL\impression[1].png (109 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\uttD646.tmp.new (63 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\uTorrent\apps\72F0D3E2141065DACF6134D07A06A2DF20590748\icon.bmp (1 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\TarBE03.tmp (2712 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\uTorrent\apps\72F0D3E2141065DACF6134D07A06A2DF20590748\index.js (1 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\uttD03C.tmp (603 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\ADKAppsOfferManager.dll (204 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\uTorrent\settings.dat.new (215 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\uTorrent\apps\D944B3378FAB35793B7951FA53E41B2AB9CC462B\index.html (3 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\uTorrent\uTorrent.exe (50 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\uTorrent\apps\featuredContent.btapp (19 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\uTorrent\toolbar_offer.benc (3 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\uTorrent\toolbar.benc.new (63 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\uTorrent\apps\welcome-upsell.btapp (28 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\uTorrent\apps\72F0D3E2141065DACF6134D07A06A2DF20590748\btapp (196 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\RM4KMRI1\impression[1].png (109 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\uTorrent\apps\player.btapp (3 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\CabBE02.tmp (54 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\uTorrent\apps\D944B3378FAB35793B7951FA53E41B2AB9CC462B\vid_thumb.jpg (23 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\uTorrent\apps\72F0D3E2141065DACF6134D07A06A2DF20590748\index.html (1 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Microsoft\Windows\Start Menu\µTorrent.lnk (791 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\uTorrent\apps\D944B3378FAB35793B7951FA53E41B2AB9CC462B\x.png (265 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\µTorrent.lnk (791 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\uttBB91.tmp.new (2 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\uTorrent\apps\D944B3378FAB35793B7951FA53E41B2AB9CC462B\btapp (201 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Microsoft\Windows\Cookies\IP85O6D3.txt (87 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\3Y5KZMDN\offers[1].json (1250 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\idlimage.temp (9705 bytes)
C:\Users\"%CurrentUserName%"\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\57C8EDB95DF3F0AD4EE2DC2B8CFD4157 (672 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\utt5372.tmp.exe (1046 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\uTorrent\apps\D944B3378FAB35793B7951FA53E41B2AB9CC462B\empty_movie.gif (282 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\3Y5KZMDN\dll_mypcbackup[1].jpg (8797 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\uTorrent\apps\D944B3378FAB35793B7951FA53E41B2AB9CC462B\main.css (6 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Microsoft\Crypto\RSA\S-1-5-21-2858020935-2156992550-3658131804-1003\1f91d2d17ea675d4c2c3192e241743f9_c0322acd-5e5d-42f0-b163-c591ee6ff5b9 (105 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\uTorrent\apps\D944B3378FAB35793B7951FA53E41B2AB9CC462B\info_icon.png (250 bytes)

The process MyPC Backup.exe:4084 makes changes in the file system.
The Worm creates and/or writes to the following file(s):

%Program Files% (x86)\MyPC Backup\ObjectListView.dll (409 bytes)
%Program Files% (x86)\MyPC Backup\MPCBClient.dll (49 bytes)
C:\Users\"%CurrentUserName%"\Desktop\Sync Folder.lnk (1 bytes)
C:\Users\"%CurrentUserName%"\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\42B9A473B4DAF01285A36B4D3C7B1662_178C086B699FD6C56B804AF3EF759CB5 (1624 bytes)
%Program Files% (x86)\MyPC Backup\Database\mpcb_settings.db (1237 bytes)
%Program Files% (x86)\MyPC Backup\GetText.dll (12 bytes)
%Program Files% (x86)\MyPC Backup\AWSSDK.dll (291 bytes)
%Program Files% (x86)\MyPC Backup\Database\mpcb_settings.db-journal (31598 bytes)
%Program Files% (x86)\MyPC Backup\x64\System.Data.SQLite.dll (49 bytes)
C:\Users\"%CurrentUserName%"\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\42B9A473B4DAF01285A36B4D3C7B1662_178C086B699FD6C56B804AF3EF759CB5 (471 bytes)
C:\Users\"%CurrentUserName%"\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\66AE3BFDF94A732B262342AD2154B86E_7DD744F73D87EE469E5BC583C31249E2 (1624 bytes)
C:\Users\"%CurrentUserName%"\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\66AE3BFDF94A732B262342AD2154B86E_7DD744F73D87EE469E5BC583C31249E2 (471 bytes)
%Program Files% (x86)\MyPC Backup\log\WAIT_HANDLES.log (540 bytes)
%Program Files% (x86)\MyPC Backup\Shared Stack.dll (146 bytes)

Registry activity

The process TPAutoConnSvc.exe:1620 makes changes in the system registry.
The Worm creates and/or sets the following values in system registry:

[HKLM\SOFTWARE\ThinPrint\TPPrnUI\HP LaserJet Professional M1212nf MFP#:2]
"FormData" = "1,2159,2794,Letter¶40,40,2086,2712, 5,2159,3556,Legal¶40,40,2086,3474, 9,2100,2970,A4¶39,39,2032,2890, 7,1842,2667,Executive¶40,40,1761,2585, 258,2159,3302,8.5 x 13 (custom)¶40,40,2086,3220, 11,1480,2100,A5¶39,39,1408,2020, 70,1050,1480,A6¶39,39,975,1399, 13,1820,2570,B5 (JIS)¶39,39,1747,2490, 264,1950,2700,16K 195x270¶39,39,1882,2620, 263,1840,2600,16K 184x260¶39,39,1761,2520, 257,1970,2730,16K 197x273¶39,39,1896,2650, 43,1000,1480,Japanese Postcard¶39,39,921,1399, 82,1480,2000,Double Japan Postcard Rotated¶39,39,1408,1919, 20,1046,2413,Envelope #10¶40,40,975,2331, 37,983,1905,Envelope Monarch¶40,40,907,1823, 34,1760,2500,Envelope B5¶39,39,1693,2420, 28,1620,2290,Envelope C5¶39,39,1544,2209, 27,1100,2200,Envelope DL¶39,39,1029,2120"
"TrayData" = "2,Tray 3, 3,Tray 2, 1,Tray 1, 4,Manual Feed, 7,Auto Select"

[HKU\.DEFAULT\Printers\DevModes2]
"HP LaserJet Professional M1212nf MFP#:2" = "48 00 50 00 20 00 4C 00 61 00 73 00 65 00 72 00"

[HKLM\SOFTWARE\ThinPrint\TPPrnUI\HP LaserJet Professional M1212nf MFP#:2]
"DelAfterCreate" = "1"

The Worm deletes the following registry key(s):

[HKLM\SOFTWARE\ThinPrint\TPPrnUI\HP LaserJet Professional M1212nf MFP#:2]

The process CloudBackup404.exe:1692 makes changes in the system registry.
The Worm creates and/or sets the following values in system registry:

[HKLM\System\CurrentControlSet\Control\Session Manager]
"PendingFileRenameOperations" = "\??\%Program Files% (x86)\Google\Update\1.3.24.7, , \??\C:\Windows\TEMP\GoogleUpdateSetup.exe1b71e, , \??\C:\Users\"%CurrentUserName%"\AppData\Local\Temp\ADKAppsOfferManager.dll, , \??\C:\Users\"%CurrentUserName%"\AppData\Local\Temp\OpenCandy_Why_Is_This_Here.txt, , \??\C:\Users\"%CurrentUserName%"\AppData\Local\Temp\uttD03C.tmp, , \??\D:\Users\"%CurrentUserName%"\AppData\Local\Temp\, , \??\C:\Users\"%CurrentUserName%"\AppData\Local\Temp\nsx9AD9.tmp\nsSCM.dll,"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\MyPC Backup]
"DisplayName" = "MyPC Backup"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"UNCAsIntranet" = "0"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\MyPC Backup]
"DisplayVersion" = ""
"URLInfoAbout" = "http://www.mypcbackup.com"
"Publisher" = "JDi Backup Ltd"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"AutoDetect" = "1"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\MyPC Backup]
"DisplayIcon" = "%Program Files% (x86)\MyPC Backup\MyPC Backup.exe"
"UninstallString" = "%Program Files% (x86)\MyPC Backup\uninst.exe"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\App Paths\MyPC Backup]
"(Default)" = "%Program Files% (x86)\MyPC Backup\BackupStack.exe"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\MyPC Backup]
"HelpLink" = "http://support.mypcbackup.com"

The Worm deletes the following value(s) in system registry:

[HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"ProxyBypass"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"ProxyBypass"
"IntranetName"

[HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"IntranetName"

The process utt5372.tmp.exe:1808 makes changes in the system registry.
The Worm creates and/or sets the following values in system registry:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Cookies]
"CachePrefix" = "Cookie:"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"AutoDetect" = "1"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\History]
"CachePrefix" = "Visited:"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Content]
"CachePrefix" = ""

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\00-50-56-f3-c8-bd]
"WpadDecisionReason" = "1"
"WpadDetectedUrl" = ""
"WpadDecision" = "0"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"UNCAsIntranet" = "0"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Connections]
"SavedLegacySettings" = "46 00 00 00 3E 00 00 00 09 00 00 00 00 00 00 00"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\00-50-56-f3-c8-bd]
"WpadDecisionTime" = "86 77 A5 14 D0 95 CF 01"

To automatically run itself each time Windows is booted, the Worm adds the following link to its file to the system registry autorun key:

[HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\RunOnce]
"APN-Stub_BTR-V7" = "C:\ProgramData\APN\APN-Stub\BTR-V7\ApnSetup.exe /install=BTR-V7 /trgb=IE /sa=1 /hpr=1 /runonce"

Proxy settings are disabled:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings]
"ProxyEnable" = "0"

The Worm deletes the following value(s) in system registry:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"ProxyBypass"

[HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"ProxyBypass"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings]
"ProxyOverride"
"AutoDetect"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"IntranetName"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings]
"ProxyServer"

[HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"IntranetName"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings]
"AutoConfigURL"

The Worm disables automatic startup of the application by deleting the following autorun value:

[HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\RunOnce]
"APN-Stub_BTR-V7"

[HKCU\Software\Microsoft\Windows\CurrentVersion\RunOnce]
"APN-Stub_BTR-V7"

The process rundll32.exe:1728 makes changes in the system registry.
The Worm creates and/or sets the following values in system registry:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Cookies]
"CachePrefix" = "Cookie:"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"AutoDetect" = "1"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{9C99CCBB-10A0-4B2A-A5BE-4CAC43F74632}]
"WpadDecision" = "0"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\History]
"CachePrefix" = "Visited:"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Content]
"CachePrefix" = ""

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\00-50-56-f3-c8-bd]
"WpadDecisionReason" = "1"
"WpadDetectedUrl" = ""

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{9C99CCBB-10A0-4B2A-A5BE-4CAC43F74632}]
"WpadDecisionTime" = "0C EF 6E 52 D0 95 CF 01"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\00-50-56-f3-c8-bd]
"WpadDecision" = "0"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"UNCAsIntranet" = "0"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Connections]
"SavedLegacySettings" = "46 00 00 00 3D 00 00 00 09 00 00 00 00 00 00 00"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{9C99CCBB-10A0-4B2A-A5BE-4CAC43F74632}]
"WpadDecisionReason" = "1"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\00-50-56-f3-c8-bd]
"WpadDecisionTime" = "86 77 A5 14 D0 95 CF 01"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{9C99CCBB-10A0-4B2A-A5BE-4CAC43F74632}]
"WpadNetworkName" = "Network 3"

Proxy settings are disabled:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings]
"ProxyEnable" = "0"

The Worm deletes the following value(s) in system registry:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\00-50-56-f3-c8-bd]
"WpadDetectedUrl"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"ProxyBypass"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings]
"ProxyServer"
"ProxyOverride"
"AutoDetect"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"IntranetName"

[HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"ProxyBypass"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{9C99CCBB-10A0-4B2A-A5BE-4CAC43F74632}]
"WpadDetectedUrl"

[HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"IntranetName"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings]
"AutoConfigURL"

The process TrustedInstaller.exe:3868 makes changes in the system registry.
The Worm creates and/or sets the following values in system registry:

[HKLM\COMPONENTS\CanonicalData\Catalogs\333c3c8a825eb46b5db7da4db82125807c7afa0591882445f186c767af2ac85e]
"c!policy.9.0...vc90.openmp_1fc8b3b9a1e18e3b_9.0.21022.8_330b958c9268999d" = "Type: REG_BINARY, Length: 0"

[HKLM\COMPONENTS\DerivedData\VersionedIndex\6.1.7601.17592 (win7sp1_gdr.110408-1631)\ComponentFamilies\amd64_microsoft.vc90.mfc_1fc8b3b9a1e18e3b_none_a2f75f3b9d7989e4\v!9.0.30729.1\UnstagedFiles]
"mfc90u.dll" = "Type: REG_BINARY, Length: 0"

[HKLM\COMPONENTS\CanonicalData\Deployments\microsoft.vc90.mfcloc_1fc8b3b9a1e18e3b_9.0.30729.1_92995f253c01eddb]
"i!SIAW_" = "00 00 00 00 1F 00 00 00 43 3A 5C 57 69 6E 64 6F"

[HKLM\COMPONENTS\DerivedData\VersionedIndex\6.1.7601.17592 (win7sp1_gdr.110408-1631)\ComponentFamilies\amd64_microsoft.vc90.atl_1fc8b3b9a1e18e3b_none_a268ec259de3174d\v!9.0.30729.4148]
"S1H" = "14 AA 6E 76 31 91 54 C4 03 11 34 8A 36 B3 FF AB"

[HKLM\COMPONENTS\DerivedData\VersionedIndex\6.1.7601.17592 (win7sp1_gdr.110408-1631)\ComponentFamilies\amd64_policy.9.0.microsoft.vc90.openmp_1fc8b3b9a1e18e3b_none_1eef21b42ca2596f\v!9.0.30729.4148]
"(Default)" = "6"

[HKLM\COMPONENTS\DerivedData\VersionedIndex\6.1.7601.17592 (win7sp1_gdr.110408-1631)\ComponentFamilies\amd64_microsoft.vc90.crt_1fc8b3b9a1e18e3b_none_a28692199dcba471\v!9.0.30729.1]
"MCP_c22d037d" = "00 00 00 00 0F 8E 52 01 4B 08 00 00"

[HKLM\COMPONENTS\DerivedData\Components\amd64_policy.9.0.microsoft.vc90.atl_1fc8b3b9a1e18e3b_9.0.30729.1_none_3a15284abf58447e]
"c!policy.9.0...ft.vc90.atl_1fc8b3b9a1e18e3b_9.0.30729.1_3a15284abf58447e" = "Type: REG_BINARY, Length: 0"

[HKLM\COMPONENTS\DerivedData\VersionedIndex\6.1.7601.17592 (win7sp1_gdr.110408-1631)\ComponentFamilies\amd64_policy.9.0.microsoft.vc90.mfc_1fc8b3b9a1e18e3b_none_bbd99e435df8a088\v!9.0.30729.4148]
"sf" = "1"

[HKLM\COMPONENTS\DerivedData\VersionedIndex\6.1.7601.17592 (win7sp1_gdr.110408-1631)\ComponentFamilies\amd64_microsoft.vc90.crt_1fc8b3b9a1e18e3b_none_a28692199dcba471\v!9.0.30729.4940]
"MCP_c22d037d" = "00 00 00 00 5A 96 52 01 4B 08 00 00"

[HKLM\COMPONENTS\DerivedData\VersionedIndex\6.1.7601.17592 (win7sp1_gdr.110408-1631)\ComponentFamilies\amd64_policy.9.0.microsoft.vc90.mfcloc_1fc8b3b9a1e18e3b_none_399d052615c6abee\v!9.0.30729.4148]
"sf" = "1"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\SideBySide\Winners\amd64_microsoft.vc90.atl_1fc8b3b9a1e18e3b_none_a268ec259de3174d\9.0]
"9.0.30729.1" = "01"

[HKLM\COMPONENTS\DerivedData\VersionedIndex\6.1.7601.17592 (win7sp1_gdr.110408-1631)\ComponentFamilies\amd64_policy.9.0.microsoft.vc90.crt_1fc8b3b9a1e18e3b_none_bb22ca2f5e815913\v!9.0.30729.4148]
"(Default)" = "6"

[HKLM\COMPONENTS\DerivedData\Components\amd64_microsoft.vc90.mfc_1fc8b3b9a1e18e3b_9.0.30729.1_none_951ab4128654b0c9]
"f!mfcm90.dll" = "6D 00 66 00 63 00 6D 00 39 00 30 00 2E 00 64 00"

[HKLM\COMPONENTS\DerivedData\VersionedIndex\6.1.7601.17592 (win7sp1_gdr.110408-1631)\ComponentFamilies\amd64_microsoft.vc90.mfc_1fc8b3b9a1e18e3b_none_a2f75f3b9d7989e4\v!9.0.30729.4148]
"sf" = "1"

[HKLM\COMPONENTS\DerivedData\Components\amd64_policy.9.0.microsoft.vc90.mfc_1fc8b3b9a1e18e3b_9.0.30729.1_none_3624aa14c1dce505]
"ClosureFlags" = "3"

[HKLM\COMPONENTS\DerivedData\VersionedIndex\6.1.7601.17592 (win7sp1_gdr.110408-1631)\ComponentFamilies\amd64_policy.9.0.microsoft.vc90.mfc_1fc8b3b9a1e18e3b_none_bbd99e435df8a088\v!9.0.30729.1]
"MCP_c22d037d" = "00 00 00 00 B9 C8 52 01 CE 04 00 00"

[HKLM\COMPONENTS\DerivedData\Components\amd64_microsoft.vc90.mfcloc_1fc8b3b9a1e18e3b_9.0.30729.1_none_92995f253c01eddb]
"f!mfc90kor.dll" = "4D 00 46 00 43 00 39 00 30 00 4B 00 4F 00 52 00"

[HKLM\COMPONENTS\DerivedData\VersionedIndex\6.1.7601.17592 (win7sp1_gdr.110408-1631)\ComponentFamilies\amd64_policy.9.0.microsoft.vc90.mfcloc_1fc8b3b9a1e18e3b_none_399d052615c6abee\v!9.0.30729.1]
"MCP_c22d037d" = "00 00 00 00 00 F9 52 01 E0 04 00 00"

[HKLM\COMPONENTS\DerivedData\VersionedIndex\6.1.7601.17592 (win7sp1_gdr.110408-1631)\ComponentFamilies\amd64_microsoft.vc90.atl_1fc8b3b9a1e18e3b_none_a268ec259de3174d\v!9.0.30729.1\UnstagedFiles]
"atl90.dll" = "41 54 4C 39 30 2E 64 6C 6C"

[HKLM\COMPONENTS\CanonicalData\Deployments\policy.9.0...vc90.mfcloc_1fc8b3b9a1e18e3b_9.0.30729.1_39e222e84b9e7e6f]
"CatalogThumbprint" = "fe0fac4e315b16deed38f335d82d54236d1dddb87577f2cadc062421a1e828a3"

[HKLM\COMPONENTS\DerivedData\Components\amd64_microsoft.vc90.openmp_1fc8b3b9a1e18e3b_9.0.21022.8_none_a5325551f9d85633]
"S256H" = "24 BE B9 75 C2 7B 1D 95 FD D4 FE 4E 13 54 0E 21"

[HKLM\COMPONENTS\DerivedData\Components\amd64_policy.9.0.microsoft.vc90.mfcloc_1fc8b3b9a1e18e3b_9.0.30729.1_none_39e222e84b9e7e6f]
"Identity" = "70 6F 6C 69 63 79 2E 39 2E 30 2E 4D 69 63 72 6F"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\SideBySide\Winners\amd64_microsoft.vc90.mfcloc_1fc8b3b9a1e18e3b_none_f0ee8071fb10f4e2\9.0]
"9.0.30729.1" = "01"

[HKLM\COMPONENTS\DerivedData\VersionedIndex\6.1.7601.17592 (win7sp1_gdr.110408-1631)\ComponentFamilies\amd64_microsoft.vc90.mfc_1fc8b3b9a1e18e3b_none_a2f75f3b9d7989e4\v!9.0.30729.4148]
"(Default)" = "10"

[HKLM\COMPONENTS\DerivedData\VersionedIndex\6.1.7601.17592 (win7sp1_gdr.110408-1631)\ComponentFamilies\amd64_microsoft.vc90.mfcloc_1fc8b3b9a1e18e3b_none_f0ee8071fb10f4e2\v!9.0.30729.4148]
"MCP_c22d037d" = "00 00 00 00 98 E5 52 01 68 13 00 00"

[HKLM\COMPONENTS\CanonicalData\Deployments\policy.9.0...vc90.openmp_1fc8b3b9a1e18e3b_9.0.21022.8_330b958c9268999d]
"i!SIAW_" = "00 00 00 00 1F 00 00 00 43 3A 5C 57 69 6E 64 6F"

[HKLM\COMPONENTS\DerivedData\VersionedIndex\6.1.7601.17592 (win7sp1_gdr.110408-1631)\ComponentFamilies\amd64_microsoft.vc90.crt_1fc8b3b9a1e18e3b_none_a28692199dcba471\v!9.0.30729.1]
"S1H" = "38 09 81 95 0B 31 B2 00 22 13 37 FF CF FB FF 41"

[HKLM\COMPONENTS\DerivedData\VersionedIndex\6.1.7601.17592 (win7sp1_gdr.110408-1631)\ComponentFamilies\amd64_microsoft.vc90.mfcloc_1fc8b3b9a1e18e3b_none_f0ee8071fb10f4e2\v!9.0.30729.1]
"CT" = "36 00 64 00 63 00 31 00 62 00 39 00 63 00 33 00"

[HKLM\COMPONENTS\DerivedData\VersionedIndex\6.1.7601.17592 (win7sp1_gdr.110408-1631)\ComponentFamilies\amd64_microsoft.vc90.openmp_1fc8b3b9a1e18e3b_none_ba5d016b21242809\v!9.0.21022.8]
"S1H" = "FE 8C 92 2C 75 1D 5B CC FB 3B D3 CB 22 A9 B8 23"

[HKLM\COMPONENTS\DerivedData\VersionedIndex\6.1.7601.17592 (win7sp1_gdr.110408-1631)\ComponentFamilies\amd64_policy.9.0.microsoft.vc90.crt_1fc8b3b9a1e18e3b_none_bb22ca2f5e815913\v!9.0.30729.4148]
"MCP_c22d037d" = "00 00 00 00 87 B0 52 01 C6 04 00 00"

[HKLM\COMPONENTS\DerivedData\VersionedIndex\6.1.7601.17592 (win7sp1_gdr.110408-1631)\ComponentFamilies\amd64_policy.9.0.microsoft.vc90.mfcloc_1fc8b3b9a1e18e3b_none_399d052615c6abee\v!9.0.30729.4148]
"S1H" = "AE 6F 51 9A C7 46 73 82 69 39 92 25 65 46 09 57"

[HKLM\COMPONENTS\DerivedData\VersionedIndex\6.1.7601.17592 (win7sp1_gdr.110408-1631)\ComponentFamilies\amd64_microsoft.vc90.mfcloc_1fc8b3b9a1e18e3b_none_f0ee8071fb10f4e2\v!9.0.30729.1\UnstagedFiles]
"mfc90chs.dll" = "4D 46 43 39 30 43 48 53 2E 44 4C 4C"

[HKLM\COMPONENTS\DerivedData\Components\amd64_microsoft.vc90.mfc_1fc8b3b9a1e18e3b_9.0.30729.1_none_951ab4128654b0c9]
"f!mfc90u.dll" = "6D 00 66 00 63 00 39 00 30 00 75 00 2E 00 64 00"

[HKLM\COMPONENTS\DerivedData\VersionedIndex\6.1.7601.17592 (win7sp1_gdr.110408-1631)\ComponentFamilies\amd64_policy.9.0.microsoft.vc90.crt_1fc8b3b9a1e18e3b_none_bb22ca2f5e815913\v!9.0.30729.1]
"(Default)" = "6"

[HKLM\COMPONENTS\DerivedData\VersionedIndex\6.1.7601.17592 (win7sp1_gdr.110408-1631)\ComponentFamilies\amd64_microsoft.vc90.crt_1fc8b3b9a1e18e3b_none_a28692199dcba471\v!9.0.30729.1\UnstagedFiles]
"msvcm90.dll" = "Type: REG_BINARY, Length: 0"

[HKLM\COMPONENTS\DerivedData\VersionedIndex\6.1.7601.17592 (win7sp1_gdr.110408-1631)\ComponentFamilies\amd64_policy.9.0.microsoft.vc90.crt_1fc8b3b9a1e18e3b_none_bb22ca2f5e815913\v!9.0.30729.1]
"S1H" = "76 C9 DC 05 BC 6B 6B 4C A3 FA EB 6F 47 42 95 CE"

[HKLM\COMPONENTS\DerivedData\VersionedIndex\6.1.7601.17592 (win7sp1_gdr.110408-1631)\ComponentFamilies\amd64_microsoft.vc90.openmp_1fc8b3b9a1e18e3b_none_ba5d016b21242809\v!9.0.21022.8]
"sf" = "2"

[HKLM\COMPONENTS\DerivedData\Components\amd64_policy.9.0.microsoft.vc90.openmp_1fc8b3b9a1e18e3b_9.0.21022.8_none_330b958c9268999d]
"ClosureFlags" = "3"

[HKLM\COMPONENTS\CanonicalData\Catalogs\6dc1b9c301d48eb965f7f4cee06ac63e7207040bfa6101252e8cea08a0855d4e]
"c!microsoft.vc90.mfcloc_1fc8b3b9a1e18e3b_9.0.30729.1_92995f253c01eddb" = "Type: REG_BINARY, Length: 0"

[HKLM\COMPONENTS\DerivedData\Components\amd64_policy.9.0.microsoft.vc90.crt_1fc8b3b9a1e18e3b_9.0.30729.1_none_3da38fdebd0e6822]
"Identity" = "70 6F 6C 69 63 79 2E 39 2E 30 2E 4D 69 63 72 6F"

[HKLM\COMPONENTS\DerivedData\VersionedIndex\6.1.7601.17592 (win7sp1_gdr.110408-1631)\ComponentFamilies\amd64_microsoft.vc90.crt_1fc8b3b9a1e18e3b_none_a28692199dcba471\v!9.0.30729.4148]
"MCP_c22d037d" = "00 00 00 00 A5 9E 52 01 3E 08 00 00"

[HKLM\COMPONENTS\CanonicalData\Deployments\policy.9.0...vc90.openmp_1fc8b3b9a1e18e3b_9.0.21022.8_330b958c9268999d]
"CatalogThumbprint" = "333c3c8a825eb46b5db7da4db82125807c7afa0591882445f186c767af2ac85e2V"

[HKLM\COMPONENTS\DerivedData\VersionedIndex\6.1.7601.17592 (win7sp1_gdr.110408-1631)\ComponentFamilies\amd64_microsoft.vc90.openmp_1fc8b3b9a1e18e3b_none_ba5d016b21242809\v!9.0.30729.4148]
"sf" = "1"

[HKLM\COMPONENTS\DerivedData\Components\amd64_microsoft.vc90.mfc_1fc8b3b9a1e18e3b_9.0.30729.1_none_951ab4128654b0c9]
"S256H" = "26 93 44 15 5C 4C F6 E2 AE DE 35 F5 1F 79 11 C0"

[HKLM\COMPONENTS\DerivedData\VersionedIndex\6.1.7601.17592 (win7sp1_gdr.110408-1631)\ComponentFamilies\amd64_microsoft.vc90.mfcloc_1fc8b3b9a1e18e3b_none_f0ee8071fb10f4e2\v!9.0.30729.1]
"sf" = "2"

[HKLM\COMPONENTS\CanonicalData\Deployments\policy.9.0...ft.vc90.crt_1fc8b3b9a1e18e3b_9.0.30729.1_3da38fdebd0e6822]
"CatalogThumbprint" = "cc70a861e6263ece8ebd924aed1f90031fe1c199ab22cd0f7c7f0a2558cd93226V"

[HKLM\COMPONENTS\DerivedData\VersionedIndex\6.1.7601.17592 (win7sp1_gdr.110408-1631)\ComponentFamilies\amd64_microsoft.vc90.openmp_1fc8b3b9a1e18e3b_none_ba5d016b21242809\v!9.0.30729.4148]
"MCP_c22d037d" = "00 00 00 00 24 08 53 01 6C 05 00 00"

[HKLM\COMPONENTS\DerivedData\Components\amd64_microsoft.vc90.mfcloc_1fc8b3b9a1e18e3b_9.0.30729.1_none_92995f253c01eddb]
"f!mfc90enu.dll" = "4D 00 46 00 43 00 39 00 30 00 45 00 4E 00 55 00"

[HKLM\COMPONENTS\CanonicalData\Deployments\microsoft.vc90.openmp_1fc8b3b9a1e18e3b_9.0.21022.8_a5325551f9d85633]
"AppID" = "4D 69 63 72 6F 73 6F 66 74 2E 56 43 39 30 2E 4F"

[HKLM\COMPONENTS\DerivedData\VersionedIndex\6.1.7601.17592 (win7sp1_gdr.110408-1631)\ComponentFamilies\amd64_microsoft.vc90.openmp_1fc8b3b9a1e18e3b_none_ba5d016b21242809\v!9.0.30729.4148]
"(Default)" = "10"

[HKLM\COMPONENTS\CanonicalData\Deployments\policy.9.0...ft.vc90.mfc_1fc8b3b9a1e18e3b_9.0.30729.1_3624aa14c1dce505]
"i!SIAW_" = "00 00 00 00 1F 00 00 00 43 3A 5C 57 69 6E 64 6F"
"CatalogThumbprint" = "522ed40176b2323ddf1104a8cafa128db5f21bbac59aaf6b48e59ac154a036f73V"

[HKLM\COMPONENTS\DerivedData\VersionedIndex\6.1.7601.17592 (win7sp1_gdr.110408-1631)\ComponentFamilies\amd64_policy.9.0.microsoft.vc90.mfc_1fc8b3b9a1e18e3b_none_bbd99e435df8a088\v!9.0.30729.4148]
"(Default)" = "6"

[HKLM\COMPONENTS\DerivedData\VersionedIndex\6.1.7601.17592 (win7sp1_gdr.110408-1631)\ComponentFamilies\amd64_microsoft.vc90.mfcloc_1fc8b3b9a1e18e3b_none_f0ee8071fb10f4e2\v!9.0.30729.1]
"MCP_c22d037d" = "00 00 00 00 59 D2 52 01 3F 13 00 00"

[HKLM\COMPONENTS\DerivedData\Components\amd64_policy.9.0.microsoft.vc90.crt_1fc8b3b9a1e18e3b_9.0.30729.1_none_3da38fdebd0e6822]
"ClosureFlags" = "3"

[HKLM\COMPONENTS\DerivedData\Components\amd64_microsoft.vc90.mfc_1fc8b3b9a1e18e3b_9.0.30729.1_none_951ab4128654b0c9]
"Identity" = "4D 69 63 72 6F 73 6F 66 74 2E 56 43 39 30 2E 4D"

[HKLM\COMPONENTS\DerivedData\VersionedIndex\6.1.7601.17592 (win7sp1_gdr.110408-1631)\ComponentFamilies\amd64_policy.9.0.microsoft.vc90.atl_1fc8b3b9a1e18e3b_none_bb797aeb5e404097\v!9.0.30729.4148]
"MCP_c22d037d" = "00 00 00 00 42 89 52 01 CD 04 00 00"

[HKLM\COMPONENTS\DerivedData\VersionedIndex\6.1.7601.17592 (win7sp1_gdr.110408-1631)\ComponentFamilies\amd64_policy.9.0.microsoft.vc90.openmp_1fc8b3b9a1e18e3b_none_1eef21b42ca2596f\v!9.0.30729.4148]
"S1H" = "E4 EC 8B 0B 75 55 36 62 51 1D 04 0E 86 AD 97 AC"

[HKLM\COMPONENTS\DerivedData\Components\amd64_microsoft.vc90.openmp_1fc8b3b9a1e18e3b_9.0.21022.8_none_a5325551f9d85633]
"c!microsoft.vc90.openmp_1fc8b3b9a1e18e3b_9.0.21022.8_a5325551f9d85633" = "Type: REG_BINARY, Length: 0"

[HKLM\COMPONENTS\CanonicalData\Deployments\microsoft.vc90.openmp_1fc8b3b9a1e18e3b_9.0.21022.8_a5325551f9d85633]
"i!SIAW_" = "00 00 00 00 1F 00 00 00 43 3A 5C 57 69 6E 64 6F"

[HKLM\COMPONENTS\CanonicalData\Deployments\policy.9.0...ft.vc90.atl_1fc8b3b9a1e18e3b_9.0.30729.1_3a15284abf58447e]
"CatalogThumbprint" = "d2ca8f3588969dd145bf8b1a7124f0754cebffde0e20d205e2e767ee4bf69d2aV"
"AppID" = "70 6F 6C 69 63 79 2E 39 2E 30 2E 4D 69 63 72 6F"

[HKLM\COMPONENTS\DerivedData\Components\amd64_microsoft.vc90.mfcloc_1fc8b3b9a1e18e3b_9.0.30729.1_none_92995f253c01eddb]
"f!mfc90fra.dll" = "4D 00 46 00 43 00 39 00 30 00 46 00 52 00 41 00"

[HKLM\COMPONENTS\DerivedData\VersionedIndex\6.1.7601.17592 (win7sp1_gdr.110408-1631)\ComponentFamilies\amd64_microsoft.vc90.atl_1fc8b3b9a1e18e3b_none_a268ec259de3174d\v!9.0.30729.4148]
"sf" = "1"

[HKLM\COMPONENTS\DerivedData\VersionedIndex\6.1.7601.17592 (win7sp1_gdr.110408-1631)\ComponentFamilies\amd64_policy.9.0.microsoft.vc90.mfc_1fc8b3b9a1e18e3b_none_bbd99e435df8a088\v!9.0.30729.4148]
"MCP_c22d037d" = "00 00 00 00 87 CD 52 01 D2 04 00 00"

[HKLM\COMPONENTS\DerivedData\Components\amd64_microsoft.vc90.mfcloc_1fc8b3b9a1e18e3b_9.0.30729.1_none_92995f253c01eddb]
"f!mfc90rus.dll" = "4D 00 46 00 43 00 39 00 30 00 52 00 55 00 53 00"

[HKLM\COMPONENTS\CanonicalData\Catalogs\a8095efeef7cae736f55a416d69c2b12e250b764bbf39505a3456a6903d27c7d]
"c!microsoft.vc90.crt_1fc8b3b9a1e18e3b_9.0.30729.1_99b61f5e8371c1d4" = "Type: REG_BINARY, Length: 0"

[HKLM\COMPONENTS\DerivedData\VersionedIndex\6.1.7601.17592 (win7sp1_gdr.110408-1631)\ComponentFamilies\amd64_policy.9.0.microsoft.vc90.openmp_1fc8b3b9a1e18e3b_none_1eef21b42ca2596f\v!9.0.21022.8]
"MCP_c22d037d" = "00 00 00 00 90 0D 53 01 8F 04 00 00"

[HKLM\COMPONENTS\CanonicalData\Deployments\policy.9.0...ft.vc90.atl_1fc8b3b9a1e18e3b_9.0.30729.1_3a15284abf58447e]
"i!SIAW_" = "00 00 00 00 1F 00 00 00 43 3A 5C 57 69 6E 64 6F"

[HKLM\COMPONENTS\DerivedData\VersionedIndex\6.1.7601.17592 (win7sp1_gdr.110408-1631)\ComponentFamilies\amd64_policy.9.0.microsoft.vc90.openmp_1fc8b3b9a1e18e3b_none_1eef21b42ca2596f\v!9.0.30729.4148]
"MCP_c22d037d" = "00 00 00 00 1F 12 53 01 D6 04 00 00"

[HKLM\COMPONENTS\DerivedData\VersionedIndex\6.1.7601.17592 (win7sp1_gdr.110408-1631)\ComponentFamilies\amd64_policy.9.0.microsoft.vc90.atl_1fc8b3b9a1e18e3b_none_bb797aeb5e404097\v!9.0.30729.1]
"MCP_c22d037d" = "00 00 00 00 74 84 52 01 CE 04 00 00"

[HKLM\COMPONENTS\DerivedData\VersionedIndex\6.1.7601.17592 (win7sp1_gdr.110408-1631)\ComponentFamilies\amd64_policy.9.0.microsoft.vc90.mfc_1fc8b3b9a1e18e3b_none_bbd99e435df8a088\v!9.0.30729.1]
"S1H" = "EF 36 D4 10 E0 A9 EA 70 90 91 65 79 2A 07 E7 18"

[HKLM\COMPONENTS\DerivedData\VersionedIndex\6.1.7601.17592 (win7sp1_gdr.110408-1631)\ComponentFamilies\amd64_policy.9.0.microsoft.vc90.crt_1fc8b3b9a1e18e3b_none_bb22ca2f5e815913\v!9.0.30729.1]
"MCP_c22d037d" = "00 00 00 00 E3 A6 52 01 D4 04 00 00"

[HKLM\COMPONENTS\DerivedData\VersionedIndex\6.1.7601.17592 (win7sp1_gdr.110408-1631)\ComponentFamilies\amd64_microsoft.vc90.openmp_1fc8b3b9a1e18e3b_none_ba5d016b21242809\v!9.0.21022.8\UnstagedFiles]
"vcomp90.dll" = "Type: REG_BINARY, Length: 0"

[HKLM\COMPONENTS\DerivedData\VersionedIndex\6.1.7601.17592 (win7sp1_gdr.110408-1631)]
"UtilizedSpace_MCP_c22d037d" = "F7 22 52 01 00 00 00 00"

[HKLM\COMPONENTS\CanonicalData\Catalogs\fe0fac4e315b16deed38f335d82d54236d1dddb87577f2cadc062421a1e828a3]
"c!policy.9.0...vc90.mfcloc_1fc8b3b9a1e18e3b_9.0.30729.1_39e222e84b9e7e6f" = "Type: REG_BINARY, Length: 0"

[HKLM\COMPONENTS\DerivedData\Components\amd64_microsoft.vc90.mfcloc_1fc8b3b9a1e18e3b_9.0.30729.1_none_92995f253c01eddb]
"c!microsoft.vc90.mfcloc_1fc8b3b9a1e18e3b_9.0.30729.1_92995f253c01eddb" = "Type: REG_BINARY, Length: 0"

[HKLM\COMPONENTS\DerivedData\VersionedIndex\6.1.7601.17592 (win7sp1_gdr.110408-1631)\ComponentFamilies\amd64_policy.9.0.microsoft.vc90.atl_1fc8b3b9a1e18e3b_none_bb797aeb5e404097\v!9.0.30729.1]
"CT" = "64 00 32 00 63 00 61 00 38 00 66 00 33 00 35 00"

[HKLM\COMPONENTS\CanonicalData\Catalogs\0244eac606f513cdc5623c418d394dd7fdcf005174c9136143ffd57e370c8bba]
"c!microsoft.vc90.atl_1fc8b3b9a1e18e3b_9.0.30729.1_9aefdaaa829eb818" = "Type: REG_BINARY, Length: 0"

[HKLM\COMPONENTS\DerivedData\Components\amd64_microsoft.vc90.atl_1fc8b3b9a1e18e3b_9.0.30729.1_none_9aefdaaa829eb818]
"Identity" = "4D 69 63 72 6F 73 6F 66 74 2E 56 43 39 30 2E 41"

[HKLM\COMPONENTS\DerivedData\Components\amd64_policy.9.0.microsoft.vc90.atl_1fc8b3b9a1e18e3b_9.0.30729.1_none_3a15284abf58447e]
"ClosureFlags" = "3"

[HKLM\COMPONENTS\CanonicalData\Catalogs\522ed40176b2323ddf1104a8cafa128db5f21bbac59aaf6b48e59ac154a036f7]
"c!policy.9.0...ft.vc90.mfc_1fc8b3b9a1e18e3b_9.0.30729.1_3624aa14c1dce505" = "Type: REG_BINARY, Length: 0"

[HKLM\COMPONENTS\DerivedData\VersionedIndex\6.1.7601.17592 (win7sp1_gdr.110408-1631)\ComponentFamilies\amd64_microsoft.vc90.crt_1fc8b3b9a1e18e3b_none_a28692199dcba471\v!9.0.30729.4148]
"S1H" = "83 EB 34 D7 CE D2 B9 DC 71 DB B8 49 AA 21 EA 78"

[HKLM\COMPONENTS\DerivedData\VersionedIndex\6.1.7601.17592 (win7sp1_gdr.110408-1631)\ComponentFamilies\amd64_policy.9.0.microsoft.vc90.mfc_1fc8b3b9a1e18e3b_none_bbd99e435df8a088\v!9.0.30729.1]
"sf" = "1"

[HKLM\COMPONENTS\DerivedData\Components\amd64_policy.9.0.microsoft.vc90.atl_1fc8b3b9a1e18e3b_9.0.30729.1_none_3a15284abf58447e]
"S256H" = "69 55 F7 F5 CC 99 69 B8 69 B9 90 86 6D B9 02 DA"

[HKLM\COMPONENTS\DerivedData\VersionedIndex\6.1.7601.17592 (win7sp1_gdr.110408-1631)\ComponentFamilies\amd64_microsoft.vc90.mfcloc_1fc8b3b9a1e18e3b_none_f0ee8071fb10f4e2\v!9.0.30729.1\UnstagedFiles]
"mfc90fra.dll" = "4D 46 43 39 30 46 52 41 2E 44 4C 4C"

[HKLM\COMPONENTS\CanonicalData\Deployments\microsoft.vc90.mfcloc_1fc8b3b9a1e18e3b_9.0.30729.1_92995f253c01eddb]
"AppID" = "4D 69 63 72 6F 73 6F 66 74 2E 56 43 39 30 2E 4D"

[HKLM\COMPONENTS\DerivedData\Components\amd64_policy.9.0.microsoft.vc90.mfcloc_1fc8b3b9a1e18e3b_9.0.30729.1_none_39e222e84b9e7e6f]
"c!policy.9.0...vc90.mfcloc_1fc8b3b9a1e18e3b_9.0.30729.1_39e222e84b9e7e6f" = "Type: REG_BINARY, Length: 0"

[HKLM\COMPONENTS\DerivedData\Components\amd64_microsoft.vc90.crt_1fc8b3b9a1e18e3b_9.0.30729.1_none_99b61f5e8371c1d4]
"ClosureFlags" = "3"

[HKLM\COMPONENTS\DerivedData\VersionedIndex\6.1.7601.17592 (win7sp1_gdr.110408-1631)\ComponentFamilies\amd64_microsoft.vc90.atl_1fc8b3b9a1e18e3b_none_a268ec259de3174d\v!9.0.30729.1]
"CT" = "30 00 32 00 34 00 34 00 65 00 61 00 63 00 36 00"

[HKLM\COMPONENTS\DerivedData\Components\amd64_policy.9.0.microsoft.vc90.openmp_1fc8b3b9a1e18e3b_9.0.21022.8_none_330b958c9268999d]
"Identity" = "70 6F 6C 69 63 79 2E 39 2E 30 2E 4D 69 63 72 6F"

[HKLM\COMPONENTS\DerivedData\Components\amd64_policy.9.0.microsoft.vc90.atl_1fc8b3b9a1e18e3b_9.0.30729.1_none_3a15284abf58447e]
"Identity" = "70 6F 6C 69 63 79 2E 39 2E 30 2E 4D 69 63 72 6F"

[HKLM\COMPONENTS\CanonicalData\Deployments\microsoft.vc90.mfc_1fc8b3b9a1e18e3b_9.0.30729.1_951ab4128654b0c9]
"CatalogThumbprint" = "95ce0638280a2ff1d3cb1be6be97e25e47ff2be6f7c987e85530957c3751bf901V"

[HKLM\COMPONENTS\DerivedData\Components\amd64_microsoft.vc90.crt_1fc8b3b9a1e18e3b_9.0.30729.1_none_99b61f5e8371c1d4]
"c!microsoft.vc90.crt_1fc8b3b9a1e18e3b_9.0.30729.1_99b61f5e8371c1d4" = "Type: REG_BINARY, Length: 0"

[HKLM\COMPONENTS\DerivedData\VersionedIndex\6.1.7601.17592 (win7sp1_gdr.110408-1631)\ComponentFamilies\amd64_microsoft.vc90.crt_1fc8b3b9a1e18e3b_none_a28692199dcba471\v!9.0.30729.4940]
"(Default)" = "10"

[HKLM\COMPONENTS\DerivedData\VersionedIndex\6.1.7601.17592 (win7sp1_gdr.110408-1631)\ComponentFamilies\amd64_microsoft.vc90.openmp_1fc8b3b9a1e18e3b_none_ba5d016b21242809\v!9.0.30729.4148]
"S1H" = "DD 16 14 4C C5 08 00 43 4F CC B2 B6 FE 9C 3F 5E"

[HKLM\COMPONENTS\DerivedData\VersionedIndex\6.1.7601.17592 (win7sp1_gdr.110408-1631)\ComponentFamilies\amd64_policy.9.0.microsoft.vc90.crt_1fc8b3b9a1e18e3b_none_bb22ca2f5e815913\v!9.0.30729.4148]
"sf" = "1"

[HKLM\COMPONENTS\DerivedData\VersionedIndex\6.1.7601.17592 (win7sp1_gdr.110408-1631)\ComponentFamilies\amd64_microsoft.vc90.mfcloc_1fc8b3b9a1e18e3b_none_f0ee8071fb10f4e2\v!9.0.30729.4148]
"(Default)" = "10"

[HKLM\COMPONENTS\DerivedData\VersionedIndex\6.1.7601.17592 (win7sp1_gdr.110408-1631)\ComponentFamilies\amd64_microsoft.vc90.crt_1fc8b3b9a1e18e3b_none_a28692199dcba471\v!9.0.30729.4940]
"S1H" = "AA 99 E7 4A 4B C1 C0 3A D2 57 8D E2 4A 0B 3A 42"

[HKLM\COMPONENTS\DerivedData\Components\amd64_microsoft.vc90.mfcloc_1fc8b3b9a1e18e3b_9.0.30729.1_none_92995f253c01eddb]
"Identity" = "4D 69 63 72 6F 73 6F 66 74 2E 56 43 39 30 2E 4D"
"S256H" = "6C E2 C2 01 E1 39 B8 B7 FD D6 B0 15 1A D0 20 DB"

[HKLM\COMPONENTS\DerivedData\VersionedIndex\6.1.7601.17592 (win7sp1_gdr.110408-1631)\ComponentFamilies\amd64_microsoft.vc90.openmp_1fc8b3b9a1e18e3b_none_ba5d016b21242809\v!9.0.21022.8]
"MCP_c22d037d" = "00 00 00 00 B3 02 53 01 71 05 00 00"

[HKLM\COMPONENTS\DerivedData\VersionedIndex\6.1.7601.17592 (win7sp1_gdr.110408-1631)\ComponentFamilies\amd64_microsoft.vc90.atl_1fc8b3b9a1e18e3b_none_a268ec259de3174d\v!9.0.30729.1]
"S1H" = "23 CA 6B 65 00 D5 28 6A FC B4 CD 40 F3 13 09 16"
"sf" = "2"

[HKLM\COMPONENTS\CanonicalData\Deployments\policy.9.0...vc90.openmp_1fc8b3b9a1e18e3b_9.0.21022.8_330b958c9268999d]
"AppID" = "70 6F 6C 69 63 79 2E 39 2E 30 2E 4D 69 63 72 6F"

[HKLM\COMPONENTS\DerivedData\Components\amd64_policy.9.0.microsoft.vc90.crt_1fc8b3b9a1e18e3b_9.0.30729.1_none_3da38fdebd0e6822]
"S256H" = "34 66 B6 B0 1E 23 20 74 33 3A E8 90 DE BA 8F D9"

[HKLM\COMPONENTS\CanonicalData\Deployments\policy.9.0...vc90.mfcloc_1fc8b3b9a1e18e3b_9.0.30729.1_39e222e84b9e7e6f]
"i!SIAW_" = "00 00 00 00 1F 00 00 00 43 3A 5C 57 69 6E 64 6F"

[HKLM\COMPONENTS\DerivedData\Components\amd64_microsoft.vc90.mfcloc_1fc8b3b9a1e18e3b_9.0.30729.1_none_92995f253c01eddb]
"f!mfc90esn.dll" = "4D 00 46 00 43 00 39 00 30 00 45 00 53 00 4E 00"

[HKLM\COMPONENTS\DerivedData\Components\amd64_microsoft.vc90.mfc_1fc8b3b9a1e18e3b_9.0.30729.1_none_951ab4128654b0c9]
"c!microsoft.vc90.mfc_1fc8b3b9a1e18e3b_9.0.30729.1_951ab4128654b0c9" = "Type: REG_BINARY, Length: 0"

[HKLM\COMPONENTS\DerivedData\Components\amd64_microsoft.vc90.atl_1fc8b3b9a1e18e3b_9.0.30729.1_none_9aefdaaa829eb818]
"f!atl90.dll" = "41 00 54 00 4C 00 39 00 30 00 2E 00 64 00 6C 00"

[HKLM\COMPONENTS\CanonicalData\Deployments\microsoft.vc90.openmp_1fc8b3b9a1e18e3b_9.0.21022.8_a5325551f9d85633]
"CatalogThumbprint" = "4c41971c13d332f75376e357800f14c8671cabe1762b1395ecb015bdaebe1343V"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\SideBySide\Winners\amd64_microsoft.vc90.crt_1fc8b3b9a1e18e3b_none_a28692199dcba471\9.0]
"9.0.30729.1" = "01"

[HKLM\COMPONENTS\DerivedData\VersionedIndex\6.1.7601.17592 (win7sp1_gdr.110408-1631)\ComponentFamilies\amd64_microsoft.vc90.atl_1fc8b3b9a1e18e3b_none_a268ec259de3174d\v!9.0.30729.1]
"MCP_c22d037d" = "00 00 00 00 9F 79 52 01 6B 05 00 00"

[HKLM\COMPONENTS\DerivedData\Components\amd64_microsoft.vc90.openmp_1fc8b3b9a1e18e3b_9.0.21022.8_none_a5325551f9d85633]
"Identity" = "4D 69 63 72 6F 73 6F 66 74 2E 56 43 39 30 2E 4F"

[HKLM\COMPONENTS\DerivedData\VersionedIndex\6.1.7601.17592 (win7sp1_gdr.110408-1631)\ComponentFamilies\amd64_microsoft.vc90.crt_1fc8b3b9a1e18e3b_none_a28692199dcba471\v!9.0.30729.4940]
"sf" = "1"

[HKLM\COMPONENTS\CanonicalData\Deployments\policy.9.0...ft.vc90.mfc_1fc8b3b9a1e18e3b_9.0.30729.1_3624aa14c1dce505]
"AppID" = "70 6F 6C 69 63 79 2E 39 2E 30 2E 4D 69 63 72 6F"

[HKLM\COMPONENTS\CanonicalData\Deployments\microsoft.vc90.mfc_1fc8b3b9a1e18e3b_9.0.30729.1_951ab4128654b0c9]
"i!SIAW_" = "00 00 00 00 1F 00 00 00 43 3A 5C 57 69 6E 64 6F"

[HKLM\COMPONENTS\CanonicalData\Deployments\policy.9.0...vc90.mfcloc_1fc8b3b9a1e18e3b_9.0.30729.1_39e222e84b9e7e6f]
"AppID" = "70 6F 6C 69 63 79 2E 39 2E 30 2E 4D 69 63 72 6F"

[HKLM\COMPONENTS\DerivedData\Components\amd64_microsoft.vc90.mfc_1fc8b3b9a1e18e3b_9.0.30729.1_none_951ab4128654b0c9]
"f!mfc90.dll" = "6D 00 66 00 63 00 39 00 30 00 2E 00 64 00 6C 00"

[HKLM\COMPONENTS\DerivedData\Components\amd64_microsoft.vc90.openmp_1fc8b3b9a1e18e3b_9.0.21022.8_none_a5325551f9d85633]
"ClosureFlags" = "3"

[HKLM\COMPONENTS\DerivedData\VersionedIndex\6.1.7601.17592 (win7sp1_gdr.110408-1631)\ComponentFamilies\amd64_microsoft.vc90.mfc_1fc8b3b9a1e18e3b_none_a2f75f3b9d7989e4\v!9.0.30729.1]
"sf" = "2"

[HKLM\COMPONENTS\DerivedData\VersionedIndex\6.1.7601.17592 (win7sp1_gdr.110408-1631)\ComponentFamilies\amd64_microsoft.vc90.mfcloc_1fc8b3b9a1e18e3b_none_f0ee8071fb10f4e2\v!9.0.30729.4148]
"sf" = "1"

[HKLM\COMPONENTS\CanonicalData\Catalogs\d2ca8f3588969dd145bf8b1a7124f0754cebffde0e20d205e2e767ee4bf69d2a]
"c!policy.9.0...ft.vc90.atl_1fc8b3b9a1e18e3b_9.0.30729.1_3a15284abf58447e" = "Type: REG_BINARY, Length: 0"

[HKLM\COMPONENTS\DerivedData\VersionedIndex\6.1.7601.17592 (win7sp1_gdr.110408-1631)\ComponentFamilies\amd64_policy.9.0.microsoft.vc90.mfcloc_1fc8b3b9a1e18e3b_none_399d052615c6abee\v!9.0.30729.1]
"(Default)" = "6"

[HKLM\COMPONENTS\DerivedData\VersionedIndex\6.1.7601.17592 (win7sp1_gdr.110408-1631)\ComponentFamilies\amd64_policy.9.0.microsoft.vc90.openmp_1fc8b3b9a1e18e3b_none_1eef21b42ca2596f\v!9.0.30729.4148]
"sf" = "1"

[HKLM\COMPONENTS\DerivedData\VersionedIndex\6.1.7601.17592 (win7sp1_gdr.110408-1631)\ComponentFamilies\amd64_microsoft.vc90.mfc_1fc8b3b9a1e18e3b_none_a2f75f3b9d7989e4\v!9.0.30729.4148]
"S1H" = "59 FC 44 3F E4 A9 36 69 AC E0 F5 9F A7 98 6B C9"

[HKLM\COMPONENTS\DerivedData\Components\amd64_policy.9.0.microsoft.vc90.mfc_1fc8b3b9a1e18e3b_9.0.30729.1_none_3624aa14c1dce505]
"Identity" = "70 6F 6C 69 63 79 2E 39 2E 30 2E 4D 69 63 72 6F"

[HKLM\COMPONENTS\DerivedData\VersionedIndex\6.1.7601.17592 (win7sp1_gdr.110408-1631)\ComponentFamilies\amd64_microsoft.vc90.crt_1fc8b3b9a1e18e3b_none_a28692199dcba471\v!9.0.30729.1\UnstagedFiles]
"msvcr90.dll" = "Type: REG_BINARY, Length: 0"

[HKLM\COMPONENTS\DerivedData\Components\amd64_microsoft.vc90.mfcloc_1fc8b3b9a1e18e3b_9.0.30729.1_none_92995f253c01eddb]
"ClosureFlags" = "3"

[HKLM\COMPONENTS\DerivedData\VersionedIndex\6.1.7601.17592 (win7sp1_gdr.110408-1631)\ComponentFamilies\amd64_microsoft.vc90.mfc_1fc8b3b9a1e18e3b_none_a2f75f3b9d7989e4\v!9.0.30729.4148]
"MCP_c22d037d" = "00 00 00 00 FC BE 52 01 BD 09 00 00"

[HKLM\COMPONENTS\DerivedData\VersionedIndex\6.1.7601.17592 (win7sp1_gdr.110408-1631)\ComponentFamilies\amd64_policy.9.0.microsoft.vc90.crt_1fc8b3b9a1e18e3b_none_bb22ca2f5e815913\v!9.0.30729.4940]
"MCP_c22d037d" = "00 00 00 00 B7 AB 52 01 D0 04 00 00"

[HKLM\COMPONENTS\DerivedData\VersionedIndex\6.1.7601.17592 (win7sp1_gdr.110408-1631)\ComponentFamilies\amd64_microsoft.vc90.mfcloc_1fc8b3b9a1e18e3b_none_f0ee8071fb10f4e2\v!9.0.30729.1\UnstagedFiles]
"mfc90enu.dll" = "4D 46 43 39 30 45 4E 55 2E 44 4C 4C"

[HKLM\COMPONENTS\DerivedData\VersionedIndex\6.1.7601.17592 (win7sp1_gdr.110408-1631)\ComponentFamilies\amd64_policy.9.0.microsoft.vc90.crt_1fc8b3b9a1e18e3b_none_bb22ca2f5e815913\v!9.0.30729.1]
"sf" = "1"

[HKLM\COMPONENTS\DerivedData\Components\amd64_microsoft.vc90.mfcloc_1fc8b3b9a1e18e3b_9.0.30729.1_none_92995f253c01eddb]
"f!mfc90jpn.dll" = "4D 00 46 00 43 00 39 00 30 00 4A 00 50 00 4E 00"

[HKLM\COMPONENTS\CanonicalData\Deployments\microsoft.vc90.mfc_1fc8b3b9a1e18e3b_9.0.30729.1_951ab4128654b0c9]
"AppID" = "4D 69 63 72 6F 73 6F 66 74 2E 56 43 39 30 2E 4D"

[HKLM\COMPONENTS\DerivedData\VersionedIndex\6.1.7601.17592 (win7sp1_gdr.110408-1631)\ComponentFamilies\amd64_policy.9.0.microsoft.vc90.mfcloc_1fc8b3b9a1e18e3b_none_399d052615c6abee\v!9.0.30729.4148]
"(Default)" = "6"

[HKLM\COMPONENTS\CanonicalData\Deployments\microsoft.vc90.crt_1fc8b3b9a1e18e3b_9.0.30729.1_99b61f5e8371c1d4]
"AppID" = "4D 69 63 72 6F 73 6F 66 74 2E 56 43 39 30 2E 43"

[HKLM\COMPONENTS\DerivedData\VersionedIndex\6.1.7601.17592 (win7sp1_gdr.110408-1631)\ComponentFamilies\amd64_microsoft.vc90.mfc_1fc8b3b9a1e18e3b_none_a2f75f3b9d7989e4\v!9.0.30729.1]
"CT" = "39 00 35 00 63 00 65 00 30 00 36 00 33 00 38 00"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\SideBySide\Winners\amd64_microsoft.vc90.openmp_1fc8b3b9a1e18e3b_none_ba5d016b21242809\9.0]
"9.0.21022.8" = "01"

[HKLM\COMPONENTS\DerivedData\VersionedIndex\6.1.7601.17592 (win7sp1_gdr.110408-1631)\ComponentFamilies\amd64_microsoft.vc90.crt_1fc8b3b9a1e18e3b_none_a28692199dcba471\v!9.0.30729.1]
"(Default)" = "10"

[HKLM\COMPONENTS\DerivedData\Components\amd64_policy.9.0.microsoft.vc90.mfc_1fc8b3b9a1e18e3b_9.0.30729.1_none_3624aa14c1dce505]
"c!policy.9.0...ft.vc90.mfc_1fc8b3b9a1e18e3b_9.0.30729.1_3624aa14c1dce505" = "Type: REG_BINARY, Length: 0"

[HKLM\COMPONENTS\DerivedData\Components\amd64_microsoft.vc90.mfcloc_1fc8b3b9a1e18e3b_9.0.30729.1_none_92995f253c01eddb]
"f!mfc90deu.dll" = "4D 00 46 00 43 00 39 00 30 00 44 00 45 00 55 00"

[HKLM\COMPONENTS\DerivedData\VersionedIndex\6.1.7601.17592 (win7sp1_gdr.110408-1631)\ComponentFamilies\amd64_policy.9.0.microsoft.vc90.atl_1fc8b3b9a1e18e3b_none_bb797aeb5e404097\v!9.0.30729.1]
"(Default)" = "6"

[HKLM\COMPONENTS\DerivedData\VersionedIndex\6.1.7601.17592 (win7sp1_gdr.110408-1631)\ComponentFamilies\amd64_microsoft.vc90.crt_1fc8b3b9a1e18e3b_none_a28692199dcba471\v!9.0.30729.1]
"sf" = "2"

[HKLM\COMPONENTS\DerivedData\VersionedIndex\6.1.7601.17592 (win7sp1_gdr.110408-1631)\ComponentFamilies\amd64_policy.9.0.microsoft.vc90.atl_1fc8b3b9a1e18e3b_none_bb797aeb5e404097\v!9.0.30729.4148]
"sf" = "1"

[HKLM\COMPONENTS\DerivedData\VersionedIndex\6.1.7601.17592 (win7sp1_gdr.110408-1631)\ComponentFamilies\amd64_microsoft.vc90.crt_1fc8b3b9a1e18e3b_none_a28692199dcba471\v!9.0.30729.1\UnstagedFiles]
"msvcp90.dll" = "Type: REG_BINARY, Length: 0"

[HKLM\COMPONENTS\CanonicalData\Deployments\microsoft.vc90.mfcloc_1fc8b3b9a1e18e3b_9.0.30729.1_92995f253c01eddb]
"CatalogThumbprint" = "6dc1b9c301d48eb965f7f4cee06ac63e7207040bfa6101252e8cea08a0855d4eV"

[HKLM\COMPONENTS\DerivedData\VersionedIndex\6.1.7601.17592 (win7sp1_gdr.110408-1631)\ComponentFamilies\amd64_policy.9.0.microsoft.vc90.mfc_1fc8b3b9a1e18e3b_none_bbd99e435df8a088\v!9.0.30729.4148]
"S1H" = "4F C7 D7 36 AD BC B2 7C 10 86 7E 21 90 BD D1 34"

[HKLM\COMPONENTS\DerivedData\VersionedIndex\6.1.7601.17592 (win7sp1_gdr.110408-1631)\ComponentFamilies\amd64_microsoft.vc90.openmp_1fc8b3b9a1e18e3b_none_ba5d016b21242809\v!9.0.21022.8]
"CT" = "34 00 63 00 34 00 31 00 39 00 37 00 31 00 63 00"

[HKLM\COMPONENTS\DerivedData\Components\amd64_microsoft.vc90.mfc_1fc8b3b9a1e18e3b_9.0.30729.1_none_951ab4128654b0c9]
"ClosureFlags" = "3"

[HKLM\COMPONENTS\DerivedData\VersionedIndex\6.1.7601.17592 (win7sp1_gdr.110408-1631)\ComponentFamilies\amd64_policy.9.0.microsoft.vc90.crt_1fc8b3b9a1e18e3b_none_bb22ca2f5e815913\v!9.0.30729.4940]
"(Default)" = "6"

[HKLM\COMPONENTS\CanonicalData\Deployments\policy.9.0...ft.vc90.crt_1fc8b3b9a1e18e3b_9.0.30729.1_3da38fdebd0e6822]
"i!SIAW_" = "00 00 00 00 1F 00 00 00 43 3A 5C 57 69 6E 64 6F"

[HKLM\COMPONENTS\DerivedData\VersionedIndex\6.1.7601.17592 (win7sp1_gdr.110408-1631)\ComponentFamilies\amd64_microsoft.vc90.mfc_1fc8b3b9a1e18e3b_none_a2f75f3b9d7989e4\v!9.0.30729.1\UnstagedFiles]
"mfc90.dll" = "Type: REG_BINARY, Length: 0"

[HKLM\COMPONENTS\DerivedData\VersionedIndex\6.1.7601.17592 (win7sp1_gdr.110408-1631)\ComponentFamilies\amd64_microsoft.vc90.mfcloc_1fc8b3b9a1e18e3b_none_f0ee8071fb10f4e2\v!9.0.30729.1]
"S1H" = "DA 6E 20 D5 AE 2F 76 AF 71 19 31 70 48 42 36 52"

[HKLM\COMPONENTS\DerivedData\VersionedIndex\6.1.7601.17592 (win7sp1_gdr.110408-1631)\ComponentFamilies\amd64_policy.9.0.microsoft.vc90.mfcloc_1fc8b3b9a1e18e3b_none_399d052615c6abee\v!9.0.30729.1]
"sf" = "1"

[HKLM\COMPONENTS\DerivedData\VersionedIndex\6.1.7601.17592 (win7sp1_gdr.110408-1631)\ComponentFamilies\amd64_microsoft.vc90.atl_1fc8b3b9a1e18e3b_none_a268ec259de3174d\v!9.0.30729.1]
"(Default)" = "10"

[HKLM\COMPONENTS\DerivedData\VersionedIndex\6.1.7601.17592 (win7sp1_gdr.110408-1631)\ComponentFamilies\amd64_microsoft.vc90.mfcloc_1fc8b3b9a1e18e3b_none_f0ee8071fb10f4e2\v!9.0.30729.1\UnstagedFiles]
"mfc90kor.dll" = "4D 46 43 39 30 4B 4F 52 2E 44 4C 4C"

[HKLM\COMPONENTS\DerivedData\VersionedIndex\6.1.7601.17592 (win7sp1_gdr.110408-1631)\ComponentFamilies\amd64_microsoft.vc90.crt_1fc8b3b9a1e18e3b_none_a28692199dcba471\v!9.0.30729.1]
"CT" = "61 00 38 00 30 00 39 00 35 00 65 00 66 00 65 00"

[HKLM\COMPONENTS\DerivedData\VersionedIndex\6.1.7601.17592 (win7sp1_gdr.110408-1631)\ComponentFamilies\amd64_microsoft.vc90.crt_1fc8b3b9a1e18e3b_none_a28692199dcba471\v!9.0.30729.4148]
"sf" = "1"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\SideBySide\Winners\amd64_microsoft.vc90.mfc_1fc8b3b9a1e18e3b_none_a2f75f3b9d7989e4\9.0]
"9.0.30729.1" = "01"

[HKLM\COMPONENTS\DerivedData\VersionedIndex\6.1.7601.17592 (win7sp1_gdr.110408-1631)\ComponentFamilies\amd64_policy.9.0.microsoft.vc90.mfc_1fc8b3b9a1e18e3b_none_bbd99e435df8a088\v!9.0.30729.1]
"(Default)" = "6"

[HKLM\COMPONENTS\DerivedData\VersionedIndex\6.1.7601.17592 (win7sp1_gdr.110408-1631)\ComponentFamilies\amd64_policy.9.0.microsoft.vc90.crt_1fc8b3b9a1e18e3b_none_bb22ca2f5e815913\v!9.0.30729.1]
"CT" = "63 00 63 00 37 00 30 00 61 00 38 00 36 00 31 00"

[HKLM\COMPONENTS\DerivedData\VersionedIndex\6.1.7601.17592 (win7sp1_gdr.110408-1631)\ComponentFamilies\amd64_policy.9.0.microsoft.vc90.atl_1fc8b3b9a1e18e3b_none_bb797aeb5e404097\v!9.0.30729.1]
"sf" = "1"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\SideBySide]
"PublisherPolicyChangeTime" = "Type: REG_QWORD, Length: 8"

[HKLM\COMPONENTS\CanonicalData\Deployments\microsoft.vc90.atl_1fc8b3b9a1e18e3b_9.0.30729.1_9aefdaaa829eb818]
"i!SIAW_" = "00 00 00 00 1F 00 00 00 43 3A 5C 57 69 6E 64 6F"

[HKLM\COMPONENTS\DerivedData\VersionedIndex\6.1.7601.17592 (win7sp1_gdr.110408-1631)\ComponentFamilies\amd64_policy.9.0.microsoft.vc90.mfcloc_1fc8b3b9a1e18e3b_none_399d052615c6abee\v!9.0.30729.4148]
"MCP_c22d037d" = "00 00 00 00 E0 FD 52 01 D3 04 00 00"

[HKLM\COMPONENTS\DerivedData\VersionedIndex\6.1.7601.17592 (win7sp1_gdr.110408-1631)\ComponentFamilies\amd64_policy.9.0.microsoft.vc90.mfcloc_1fc8b3b9a1e18e3b_none_399d052615c6abee\v!9.0.30729.1]
"S1H" = "E6 CA F0 F6 A2 0D C9 9F 62 27 42 55 D7 B2 1B 34"
"CT" = "66 00 65 00 30 00 66 00 61 00 63 00 34 00 65 00"

[HKLM\COMPONENTS\DerivedData\VersionedIndex\6.1.7601.17592 (win7sp1_gdr.110408-1631)\ComponentFamilies\amd64_policy.9.0.microsoft.vc90.mfc_1fc8b3b9a1e18e3b_none_bbd99e435df8a088\v!9.0.30729.1]
"CT" = "35 00 32 00 32 00 65 00 64 00 34 00 30 00 31 00"

[HKLM\COMPONENTS\DerivedData\Components\amd64_microsoft.vc90.crt_1fc8b3b9a1e18e3b_9.0.30729.1_none_99b61f5e8371c1d4]
"f!msvcm90.dll" = "6D 00 73 00 76 00 63 00 6D 00 39 00 30 00 2E 00"

[HKLM\COMPONENTS\DerivedData\Components\amd64_policy.9.0.microsoft.vc90.crt_1fc8b3b9a1e18e3b_9.0.30729.1_none_3da38fdebd0e6822]
"c!policy.9.0...ft.vc90.crt_1fc8b3b9a1e18e3b_9.0.30729.1_3da38fdebd0e6822" = "Type: REG_BINARY, Length: 0"

[HKLM\COMPONENTS\ServicingStackVersions]
"6.1.7601.17592 (win7sp1_gdr.110408-1631)" = "2014/7/2:8:34:3.482 6.1.7601.17592 (win7sp1_gdr.110408-1631)"

[HKLM\COMPONENTS\DerivedData\VersionedIndex\6.1.7601.17592 (win7sp1_gdr.110408-1631)\ComponentFamilies\amd64_policy.9.0.microsoft.vc90.atl_1fc8b3b9a1e18e3b_none_bb797aeb5e404097\v!9.0.30729.1]
"S1H" = "64 21 A7 13 7F 81 51 EC C9 C6 32 1F CB 89 4E ED"

[HKLM\COMPONENTS\DerivedData\Components\amd64_microsoft.vc90.openmp_1fc8b3b9a1e18e3b_9.0.21022.8_none_a5325551f9d85633]
"f!vcomp90.dll" = "76 00 63 00 6F 00 6D 00 70 00 39 00 30 00 2E 00"

[HKLM\COMPONENTS\DerivedData\Components\amd64_policy.9.0.microsoft.vc90.mfcloc_1fc8b3b9a1e18e3b_9.0.30729.1_none_39e222e84b9e7e6f]
"ClosureFlags" = "3"

[HKLM\COMPONENTS\DerivedData\Components\amd64_microsoft.vc90.mfcloc_1fc8b3b9a1e18e3b_9.0.30729.1_none_92995f253c01eddb]
"f!mfc90esp.dll" = "4D 00 46 00 43 00 39 00 30 00 45 00 53 00 50 00"

[HKLM\COMPONENTS\CanonicalData\Deployments\microsoft.vc90.crt_1fc8b3b9a1e18e3b_9.0.30729.1_99b61f5e8371c1d4]
"CatalogThumbprint" = "a8095efeef7cae736f55a416d69c2b12e250b764bbf39505a3456a6903d27c7d"

[HKLM\COMPONENTS\DerivedData\VersionedIndex\6.1.7601.17592 (win7sp1_gdr.110408-1631)\ComponentFamilies\amd64_microsoft.vc90.mfc_1fc8b3b9a1e18e3b_none_a2f75f3b9d7989e4\v!9.0.30729.1]
"S1H" = "CC E5 48 A1 81 09 83 7C D5 26 1A F8 35 AB 54 9D"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\SideBySide\Winners\amd64_policy.9.0.microsoft.vc90.atl_1fc8b3b9a1e18e3b_none_bb797aeb5e404097\9.0]
"9.0.30729.1" = "01"

[HKLM\COMPONENTS\DerivedData\VersionedIndex\6.1.7601.17592 (win7sp1_gdr.110408-1631)\ComponentFamilies\amd64_policy.9.0.microsoft.vc90.openmp_1fc8b3b9a1e18e3b_none_1eef21b42ca2596f\v!9.0.21022.8]
"(Default)" = "6"

[HKLM\COMPONENTS\DerivedData\VersionedIndex\6.1.7601.17592 (win7sp1_gdr.110408-1631)\ComponentFamilies\amd64_microsoft.vc90.mfcloc_1fc8b3b9a1e18e3b_none_f0ee8071fb10f4e2\v!9.0.30729.1\UnstagedFiles]
"mfc90esp.dll" = "4D 46 43 39 30 45 53 50 2E 44 4C 4C"

[HKLM\COMPONENTS\DerivedData\VersionedIndex\6.1.7601.17592 (win7sp1_gdr.110408-1631)\ComponentFamilies\amd64_policy.9.0.microsoft.vc90.crt_1fc8b3b9a1e18e3b_none_bb22ca2f5e815913\v!9.0.30729.4940]
"S1H" = "74 EA A7 88 4B 21 D7 1F 33 34 94 89 89 7C 0A F6"

[HKLM\COMPONENTS\DerivedData\Components\amd64_microsoft.vc90.mfcloc_1fc8b3b9a1e18e3b_9.0.30729.1_none_92995f253c01eddb]
"f!mfc90ita.dll" = "4D 00 46 00 43 00 39 00 30 00 49 00 54 00 41 00"

[HKLM\COMPONENTS\CanonicalData\Catalogs\95ce0638280a2ff1d3cb1be6be97e25e47ff2be6f7c987e85530957c3751bf90]
"c!microsoft.vc90.mfc_1fc8b3b9a1e18e3b_9.0.30729.1_951ab4128654b0c9" = "Type: REG_BINARY, Length: 0"

[HKLM\COMPONENTS\DerivedData\VersionedIndex\6.1.7601.17592 (win7sp1_gdr.110408-1631)\ComponentFamilies\amd64_policy.9.0.microsoft.vc90.atl_1fc8b3b9a1e18e3b_none_bb797aeb5e404097\v!9.0.30729.4148]
"(Default)" = "6"

[HKLM\COMPONENTS\DerivedData\Components\amd64_microsoft.vc90.mfcloc_1fc8b3b9a1e18e3b_9.0.30729.1_none_92995f253c01eddb]
"f!mfc90cht.dll" = "4D 00 46 00 43 00 39 00 30 00 43 00 48 00 54 00"

[HKLM\COMPONENTS\DerivedData\VersionedIndex\6.1.7601.17592 (win7sp1_gdr.110408-1631)\ComponentFamilies\amd64_microsoft.vc90.mfcloc_1fc8b3b9a1e18e3b_none_f0ee8071fb10f4e2\v!9.0.30729.1\UnstagedFiles]
"mfc90esn.dll" = "4D 46 43 39 30 45 53 4E 2E 44 4C 4C"

[HKLM\COMPONENTS\DerivedData\Components\amd64_microsoft.vc90.crt_1fc8b3b9a1e18e3b_9.0.30729.1_none_99b61f5e8371c1d4]
"f!msvcp90.dll" = "6D 00 73 00 76 00 63 00 70 00 39 00 30 00 2E 00"

[HKLM\COMPONENTS\DerivedData\Components\amd64_policy.9.0.microsoft.vc90.openmp_1fc8b3b9a1e18e3b_9.0.21022.8_none_330b958c9268999d]
"c!policy.9.0...vc90.openmp_1fc8b3b9a1e18e3b_9.0.21022.8_330b958c9268999d" = "Type: REG_BINARY, Length: 0"

[HKLM\COMPONENTS\DerivedData\VersionedIndex\6.1.7601.17592 (win7sp1_gdr.110408-1631)\ComponentFamilies\amd64_policy.9.0.microsoft.vc90.atl_1fc8b3b9a1e18e3b_none_bb797aeb5e404097\v!9.0.30729.4148]
"S1H" = "80 93 28 44 A9 44 70 27 55 3E C3 07 5D F5 63 DF"

[HKLM\COMPONENTS\DerivedData\VersionedIndex\6.1.7601.17592 (win7sp1_gdr.110408-1631)\ComponentFamilies\amd64_microsoft.vc90.crt_1fc8b3b9a1e18e3b_none_a28692199dcba471\v!9.0.30729.4148]
"(Default)" = "10"

[HKLM\COMPONENTS\DerivedData\VersionedIndex\6.1.7601.17592 (win7sp1_gdr.110408-1631)\ComponentFamilies\amd64_microsoft.vc90.mfc_1fc8b3b9a1e18e3b_none_a2f75f3b9d7989e4\v!9.0.30729.1\UnstagedFiles]
"mfcm90u.dll" = "Type: REG_BINARY, Length: 0"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\SideBySide\Winners\amd64_policy.9.0.microsoft.vc90.mfc_1fc8b3b9a1e18e3b_none_bbd99e435df8a088\9.0]
"9.0.30729.1" = "01"

[HKLM\COMPONENTS\DerivedData\VersionedIndex\6.1.7601.17592 (win7sp1_gdr.110408-1631)\ComponentFamilies\amd64_microsoft.vc90.atl_1fc8b3b9a1e18e3b_none_a268ec259de3174d\v!9.0.30729.4148]
"(Default)" = "10"

[HKLM\COMPONENTS\DerivedData\VersionedIndex\6.1.7601.17592 (win7sp1_gdr.110408-1631)\ComponentFamilies\amd64_policy.9.0.microsoft.vc90.crt_1fc8b3b9a1e18e3b_none_bb22ca2f5e815913\v!9.0.30729.4940]
"sf" = "1"

[HKLM\COMPONENTS\CanonicalData\Catalogs\4c41971c13d332f75376e357800f14c8671cabe1762b1395ecb015bdaebe1343]
"c!microsoft.vc90.openmp_1fc8b3b9a1e18e3b_9.0.21022.8_a5325551f9d85633" = "Type: REG_BINARY, Length: 0"

[HKLM\COMPONENTS\DerivedData\VersionedIndex\6.1.7601.17592 (win7sp1_gdr.110408-1631)\ComponentFamilies\amd64_microsoft.vc90.mfc_1fc8b3b9a1e18e3b_none_a2f75f3b9d7989e4\v!9.0.30729.1]
"(Default)" = "10"

[HKLM\COMPONENTS]
"StoreDirty" = "01"

[HKLM\COMPONENTS\DerivedData\VersionedIndex\6.1.7601.17592 (win7sp1_gdr.110408-1631)\ComponentFamilies\amd64_policy.9.0.microsoft.vc90.crt_1fc8b3b9a1e18e3b_none_bb22ca2f5e815913\v!9.0.30729.4148]
"S1H" = "31 95 AA CA BF 6A 85 7B 8A 02 CC 29 B3 F8 BA 35"

[HKLM\COMPONENTS\DerivedData\VersionedIndex\6.1.7601.17592 (win7sp1_gdr.110408-1631)\ComponentFamilies\amd64_microsoft.vc90.mfc_1fc8b3b9a1e18e3b_none_a2f75f3b9d7989e4\v!9.0.30729.1]
"MCP_c22d037d" = "00 00 00 00 4D B5 52 01 AF 09 00 00"

[HKLM\COMPONENTS\DerivedData\VersionedIndex\6.1.7601.17592 (win7sp1_gdr.110408-1631)\ComponentFamilies\amd64_microsoft.vc90.openmp_1fc8b3b9a1e18e3b_none_ba5d016b21242809\v!9.0.21022.8]
"(Default)" = "10"

[HKLM\COMPONENTS\DerivedData\Components\amd64_microsoft.vc90.crt_1fc8b3b9a1e18e3b_9.0.30729.1_none_99b61f5e8371c1d4]
"S256H" = "08 8C D1 14 A3 5A A0 03 0F 8A C8 09 40 2C 7C 22"

[HKLM\COMPONENTS\DerivedData\VersionedIndex\6.1.7601.17592 (win7sp1_gdr.110408-1631)\ComponentFamilies\amd64_policy.9.0.microsoft.vc90.openmp_1fc8b3b9a1e18e3b_none_1eef21b42ca2596f\v!9.0.21022.8]
"CT" = "33 00 33 00 33 00 63 00 33 00 63 00 38 00 61 00"

[HKU\.DEFAULT\Software\Classes\Local Settings\MuiCache\28\52C64B7E]
"LanguageList" = "en-US, en"

[HKLM\COMPONENTS\DerivedData\VersionedIndex\6.1.7601.17592 (win7sp1_gdr.110408-1631)\ComponentFamilies\amd64_microsoft.vc90.mfcloc_1fc8b3b9a1e18e3b_none_f0ee8071fb10f4e2\v!9.0.30729.1]
"(Default)" = "10"

[HKLM\COMPONENTS\DerivedData\Components\amd64_microsoft.vc90.atl_1fc8b3b9a1e18e3b_9.0.30729.1_none_9aefdaaa829eb818]
"c!microsoft.vc90.atl_1fc8b3b9a1e18e3b_9.0.30729.1_9aefdaaa829eb818" = "Type: REG_BINARY, Length: 0"

[HKLM\COMPONENTS\DerivedData\VersionedIndex\6.1.7601.17592 (win7sp1_gdr.110408-1631)\ComponentFamilies\amd64_microsoft.vc90.mfcloc_1fc8b3b9a1e18e3b_none_f0ee8071fb10f4e2\v!9.0.30729.1\UnstagedFiles]
"mfc90jpn.dll" = "4D 46 43 39 30 4A 50 4E 2E 44 4C 4C"

[HKLM\COMPONENTS\DerivedData\Components\amd64_policy.9.0.microsoft.vc90.mfc_1fc8b3b9a1e18e3b_9.0.30729.1_none_3624aa14c1dce505]
"S256H" = "8D C0 05 84 25 4A F1 6C 47 CA 9C 96 C9 44 75 51"

[HKLM\COMPONENTS]
"ExecutionState" = "2"

[HKLM\COMPONENTS\DerivedData\VersionedIndex\6.1.7601.17592 (win7sp1_gdr.110408-1631)\ComponentFamilies\amd64_microsoft.vc90.atl_1fc8b3b9a1e18e3b_none_a268ec259de3174d\v!9.0.30729.4148]
"MCP_c22d037d" = "00 00 00 00 0A 7F 52 01 6A 05 00 00"

[HKLM\COMPONENTS\DerivedData\VersionedIndex\6.1.7601.17592 (win7sp1_gdr.110408-1631)\ComponentFamilies\amd64_microsoft.vc90.mfc_1fc8b3b9a1e18e3b_none_a2f75f3b9d7989e4\v!9.0.30729.1\UnstagedFiles]
"mfcm90.dll" = "Type: REG_BINARY, Length: 0"

[HKLM\COMPONENTS\DerivedData\Components\amd64_microsoft.vc90.atl_1fc8b3b9a1e18e3b_9.0.30729.1_none_9aefdaaa829eb818]
"ClosureFlags" = "3"

[HKLM\COMPONENTS\DerivedData\Components\amd64_policy.9.0.microsoft.vc90.openmp_1fc8b3b9a1e18e3b_9.0.21022.8_none_330b958c9268999d]
"S256H" = "FE AE 5D B0 21 40 AA 1D 6C CD 8E EF 81 27 94 DF"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\SideBySide\Winners\amd64_policy.9.0.microsoft.vc90.crt_1fc8b3b9a1e18e3b_none_bb22ca2f5e815913\9.0]
"9.0.30729.1" = "01"

[HKLM\COMPONENTS\DerivedData\Components\amd64_microsoft.vc90.atl_1fc8b3b9a1e18e3b_9.0.30729.1_none_9aefdaaa829eb818]
"S256H" = "EB E1 76 88 C7 DC EA 0B F8 87 58 62 C8 C7 2A 58"

[HKLM\COMPONENTS\DerivedData\VersionedIndex\6.1.7601.17592 (win7sp1_gdr.110408-1631)\ComponentFamilies\amd64_microsoft.vc90.mfcloc_1fc8b3b9a1e18e3b_none_f0ee8071fb10f4e2\v!9.0.30729.1\UnstagedFiles]
"mfc90rus.dll" = "4D 46 43 39 30 52 55 53 2E 44 4C 4C"

[HKLM\COMPONENTS\CanonicalData\Deployments\microsoft.vc90.atl_1fc8b3b9a1e18e3b_9.0.30729.1_9aefdaaa829eb818]
"AppID" = "4D 69 63 72 6F 73 6F 66 74 2E 56 43 39 30 2E 41"

[HKLM\COMPONENTS\DerivedData\VersionedIndex\6.1.7601.17592 (win7sp1_gdr.110408-1631)\ComponentFamilies\amd64_microsoft.vc90.mfcloc_1fc8b3b9a1e18e3b_none_f0ee8071fb10f4e2\v!9.0.30729.1\UnstagedFiles]
"mfc90deu.dll" = "4D 46 43 39 30 44 45 55 2E 44 4C 4C"

[HKLM\COMPONENTS\DerivedData\Components\amd64_microsoft.vc90.crt_1fc8b3b9a1e18e3b_9.0.30729.1_none_99b61f5e8371c1d4]
"Identity" = "4D 69 63 72 6F 73 6F 66 74 2E 56 43 39 30 2E 43"

[HKLM\COMPONENTS\CanonicalData\Deployments\microsoft.vc90.crt_1fc8b3b9a1e18e3b_9.0.30729.1_99b61f5e8371c1d4]
"i!SIAW_" = "00 00 00 00 1F 00 00 00 43 3A 5C 57 69 6E 64 6F"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\SideBySide\Winners\amd64_policy.9.0.microsoft.vc90.mfcloc_1fc8b3b9a1e18e3b_none_399d052615c6abee\9.0]
"9.0.30729.1" = "01"

[HKLM\COMPONENTS\DerivedData\Components\amd64_microsoft.vc90.crt_1fc8b3b9a1e18e3b_9.0.30729.1_none_99b61f5e8371c1d4]
"f!msvcr90.dll" = "6D 00 73 00 76 00 63 00 72 00 39 00 30 00 2E 00"

[HKLM\COMPONENTS\DerivedData\VersionedIndex\6.1.7601.17592 (win7sp1_gdr.110408-1631)\ComponentFamilies\amd64_policy.9.0.microsoft.vc90.openmp_1fc8b3b9a1e18e3b_none_1eef21b42ca2596f\v!9.0.21022.8]
"S1H" = "9E 2C 9A 79 1D 8E C7 78 4A 73 08 8C 2E 1E AF C1"

[HKLM\COMPONENTS\DerivedData\Components\amd64_policy.9.0.microsoft.vc90.mfcloc_1fc8b3b9a1e18e3b_9.0.30729.1_none_39e222e84b9e7e6f]
"S256H" = "0E DF 78 65 CB 6E 59 40 E6 8D 63 1A FE E7 83 B0"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\SideBySide\Winners\amd64_policy.9.0.microsoft.vc90.openmp_1fc8b3b9a1e18e3b_none_1eef21b42ca2596f\9.0]
"9.0.21022.8" = "01"

[HKLM\COMPONENTS\CanonicalData\Catalogs\cc70a861e6263ece8ebd924aed1f90031fe1c199ab22cd0f7c7f0a2558cd9322]
"c!policy.9.0...ft.vc90.crt_1fc8b3b9a1e18e3b_9.0.30729.1_3da38fdebd0e6822" = "Type: REG_BINARY, Length: 0"

[HKLM\COMPONENTS\DerivedData\VersionedIndex\6.1.7601.17592 (win7sp1_gdr.110408-1631)\ComponentFamilies\amd64_microsoft.vc90.mfcloc_1fc8b3b9a1e18e3b_none_f0ee8071fb10f4e2\v!9.0.30729.4148]
"S1H" = "E3 17 DA F8 C4 AE B9 52 16 AF B2 EE 85 45 57 D7"

[HKLM\COMPONENTS\DerivedData\VersionedIndex\6.1.7601.17592 (win7sp1_gdr.110408-1631)\ComponentFamilies\amd64_policy.9.0.microsoft.vc90.openmp_1fc8b3b9a1e18e3b_none_1eef21b42ca2596f\v!9.0.21022.8]
"sf" = "1"

[HKLM\COMPONENTS\CanonicalData\Deployments\microsoft.vc90.atl_1fc8b3b9a1e18e3b_9.0.30729.1_9aefdaaa829eb818]
"CatalogThumbprint" = "0244eac606f513cdc5623c418d394dd7fdcf005174c9136143ffd57e370c8bbaNV"

[HKLM\COMPONENTS\CanonicalData\Deployments\policy.9.0...ft.vc90.crt_1fc8b3b9a1e18e3b_9.0.30729.1_3da38fdebd0e6822]
"AppID" = "70 6F 6C 69 63 79 2E 39 2E 30 2E 4D 69 63 72 6F"

[HKLM\COMPONENTS\DerivedData\Components\amd64_microsoft.vc90.mfcloc_1fc8b3b9a1e18e3b_9.0.30729.1_none_92995f253c01eddb]
"f!mfc90chs.dll" = "4D 00 46 00 43 00 39 00 30 00 43 00 48 00 53 00"

[HKLM\COMPONENTS\DerivedData\Components\amd64_microsoft.vc90.mfc_1fc8b3b9a1e18e3b_9.0.30729.1_none_951ab4128654b0c9]
"f!mfcm90u.dll" = "6D 00 66 00 63 00 6D 00 39 00 30 00 75 00 2E 00"

[HKLM\COMPONENTS\DerivedData\VersionedIndex\6.1.7601.17592 (win7sp1_gdr.110408-1631)\ComponentFamilies\amd64_microsoft.vc90.mfcloc_1fc8b3b9a1e18e3b_none_f0ee8071fb10f4e2\v!9.0.30729.1\UnstagedFiles]
"mfc90cht.dll" = "4D 46 43 39 30 43 48 54 2E 44 4C 4C"
"mfc90ita.dll" = "4D 46 43 39 30 49 54 41 2E 44 4C 4C"

The Worm deletes the following registry key(s):

[HKLM\COMPONENTS\DerivedData\VersionedIndex\6.1.7601.17592 (win7sp1_gdr.110408-1631)\ComponentFamilies\amd64_microsoft.vc90.mfcloc_1fc8b3b9a1e18e3b_none_f0ee8071fb10f4e2\v!9.0.30729.1\UnstagedFiles]
[HKLM\COMPONENTS\DerivedData\VersionedIndex\6.1.7601.17592 (win7sp1_gdr.110408-1631)\ComponentFamilies\amd64_microsoft.vc90.crt_1fc8b3b9a1e18e3b_none_a28692199dcba471\v!9.0.30729.1\UnstagedFiles]
[HKLM\COMPONENTS\DerivedData\VersionedIndex\6.1.7601.17592 (win7sp1_gdr.110408-1631)\ComponentFamilies\amd64_microsoft.vc90.atl_1fc8b3b9a1e18e3b_none_a268ec259de3174d\v!9.0.30729.1\UnstagedFiles]
[HKLM\COMPONENTS\DerivedData\VersionedIndex\6.1.7601.17592 (win7sp1_gdr.110408-1631)\ComponentFamilies\amd64_microsoft.vc90.mfc_1fc8b3b9a1e18e3b_none_a2f75f3b9d7989e4\v!9.0.30729.1\UnstagedFiles]
[HKLM\COMPONENTS\DerivedData\VersionedIndex\6.1.7601.17592 (win7sp1_gdr.110408-1631)\ComponentFamilies\amd64_microsoft.vc90.openmp_1fc8b3b9a1e18e3b_none_ba5d016b21242809\v!9.0.21022.8\UnstagedFiles]

The Worm deletes the following value(s) in system registry:

[HKLM\COMPONENTS\DerivedData\VersionedIndex\6.1.7601.17592 (win7sp1_gdr.110408-1631)\ComponentFamilies\amd64_microsoft.vc90.mfcloc_1fc8b3b9a1e18e3b_none_f0ee8071fb10f4e2\v!9.0.30729.1\UnstagedFiles]
"mfc90fra.dll"
"mfc90esp.dll"

[HKLM\COMPONENTS]
"PoqexecFailure"

[HKLM\COMPONENTS\DerivedData\VersionedIndex\6.1.7601.17592 (win7sp1_gdr.110408-1631)\ComponentFamilies\amd64_policy.9.0.microsoft.vc90.mfc_1fc8b3b9a1e18e3b_none_bbd99e435df8a088]
"SomeUnparsedVersionsExist"

[HKLM\COMPONENTS\DerivedData\VersionedIndex\6.1.7601.17592 (win7sp1_gdr.110408-1631)\ComponentFamilies\amd64_microsoft.vc90.mfcloc_1fc8b3b9a1e18e3b_none_f0ee8071fb10f4e2\v!9.0.30729.1\UnstagedFiles]
"mfc90rus.dll"
"mfc90enu.dll"

[HKLM\COMPONENTS]
"PendingXmlIdentifier"
"LastScavengeFlags"

[HKLM\COMPONENTS\DerivedData\VersionedIndex\6.1.7601.17592 (win7sp1_gdr.110408-1631)\ComponentFamilies\amd64_policy.9.0.microsoft.vc90.openmp_1fc8b3b9a1e18e3b_none_1eef21b42ca2596f]
"SomeUnparsedVersionsExist"

[HKLM\COMPONENTS\DerivedData\VersionedIndex\6.1.7601.17592 (win7sp1_gdr.110408-1631)\ComponentFamilies\amd64_microsoft.vc90.mfcloc_1fc8b3b9a1e18e3b_none_f0ee8071fb10f4e2\v!9.0.30729.1\UnstagedFiles]
"mfc90esn.dll"

[HKLM\COMPONENTS\DerivedData\VersionedIndex\6.1.7601.17592 (win7sp1_gdr.110408-1631)\ComponentFamilies\amd64_microsoft.vc90.openmp_1fc8b3b9a1e18e3b_none_ba5d016b21242809\v!9.0.21022.8\UnstagedFiles]
"vcomp90.dll"

[HKLM\COMPONENTS\DerivedData\VersionedIndex\6.1.7601.17592 (win7sp1_gdr.110408-1631)\ComponentFamilies\amd64_policy.9.0.microsoft.vc90.atl_1fc8b3b9a1e18e3b_none_bb797aeb5e404097]
"SomeUnparsedVersionsExist"

[HKLM\COMPONENTS\DerivedData\VersionedIndex\6.1.7601.17592 (win7sp1_gdr.110408-1631)\ComponentFamilies\amd64_microsoft.vc90.mfc_1fc8b3b9a1e18e3b_none_a2f75f3b9d7989e4\v!9.0.30729.1\UnstagedFiles]
"mfcm90u.dll"

[HKLM\COMPONENTS\DerivedData\VersionedIndex\6.1.7601.17592 (win7sp1_gdr.110408-1631)\ComponentFamilies\amd64_microsoft.vc90.atl_1fc8b3b9a1e18e3b_none_a268ec259de3174d\v!9.0.30729.1\UnstagedFiles]
"atl90.dll"

[HKLM\COMPONENTS\DerivedData\VersionedIndex\6.1.7601.17592 (win7sp1_gdr.110408-1631)\ComponentFamilies\amd64_microsoft.vc90.crt_1fc8b3b9a1e18e3b_none_a28692199dcba471\v!9.0.30729.1\UnstagedFiles]
"msvcr90.dll"
"msvcp90.dll"

[HKLM\COMPONENTS\DerivedData\VersionedIndex\6.1.7601.17592 (win7sp1_gdr.110408-1631)\ComponentFamilies\amd64_microsoft.vc90.mfcloc_1fc8b3b9a1e18e3b_none_f0ee8071fb10f4e2\v!9.0.30729.1\UnstagedFiles]
"mfc90jpn.dll"

[HKLM\COMPONENTS\DerivedData\VersionedIndex\6.1.7601.17592 (win7sp1_gdr.110408-1631)\ComponentFamilies\amd64_microsoft.vc90.atl_1fc8b3b9a1e18e3b_none_a268ec259de3174d]
"SomeUnparsedVersionsExist"

[HKLM\COMPONENTS\DerivedData\VersionedIndex\6.1.7601.17592 (win7sp1_gdr.110408-1631)\ComponentFamilies\amd64_microsoft.vc90.mfc_1fc8b3b9a1e18e3b_none_a2f75f3b9d7989e4\v!9.0.30729.1\UnstagedFiles]
"mfc90.dll"

[HKLM\COMPONENTS\DerivedData\VersionedIndex\6.1.7601.17592 (win7sp1_gdr.110408-1631)\ComponentFamilies\amd64_microsoft.vc90.mfcloc_1fc8b3b9a1e18e3b_none_f0ee8071fb10f4e2\v!9.0.30729.1\UnstagedFiles]
"mfc90chs.dll"

[HKLM\COMPONENTS\DerivedData\VersionedIndex\6.1.7601.17592 (win7sp1_gdr.110408-1631)\ComponentFamilies\amd64_microsoft.vc90.mfcloc_1fc8b3b9a1e18e3b_none_f0ee8071fb10f4e2]
"SomeUnparsedVersionsExist"

[HKLM\COMPONENTS\DerivedData\VersionedIndex\6.1.7601.17592 (win7sp1_gdr.110408-1631)\ComponentFamilies\amd64_microsoft.vc90.crt_1fc8b3b9a1e18e3b_none_a28692199dcba471\v!9.0.30729.1\UnstagedFiles]
"msvcm90.dll"

[HKLM\COMPONENTS]
"RepairTransactionPended"

[HKLM\COMPONENTS\DerivedData\VersionedIndex\6.1.7601.17592 (win7sp1_gdr.110408-1631)\ComponentFamilies\amd64_microsoft.vc90.mfcloc_1fc8b3b9a1e18e3b_none_f0ee8071fb10f4e2\v!9.0.30729.1\UnstagedFiles]
"mfc90kor.dll"

[HKLM\COMPONENTS]
"LastScavengeCookie"

[HKLM\COMPONENTS\DerivedData\VersionedIndex\6.1.7601.17592 (win7sp1_gdr.110408-1631)\ComponentFamilies\amd64_microsoft.vc90.mfcloc_1fc8b3b9a1e18e3b_none_f0ee8071fb10f4e2\v!9.0.30729.1\UnstagedFiles]
"mfc90deu.dll"

[HKLM\COMPONENTS]
"ExecutionState"

[HKLM\COMPONENTS\DerivedData\VersionedIndex\6.1.7601.17592 (win7sp1_gdr.110408-1631)\ComponentFamilies\amd64_policy.9.0.microsoft.vc90.crt_1fc8b3b9a1e18e3b_none_bb22ca2f5e815913]
"SomeUnparsedVersionsExist"

[HKLM\COMPONENTS\DerivedData\VersionedIndex\6.1.7601.17592 (win7sp1_gdr.110408-1631)\ComponentFamilies\amd64_microsoft.vc90.mfc_1fc8b3b9a1e18e3b_none_a2f75f3b9d7989e4\v!9.0.30729.1\UnstagedFiles]
"mfc90u.dll"

[HKLM\COMPONENTS\DerivedData\VersionedIndex\6.1.7601.17592 (win7sp1_gdr.110408-1631)\ComponentFamilies\amd64_policy.9.0.microsoft.vc90.mfcloc_1fc8b3b9a1e18e3b_none_399d052615c6abee]
"SomeUnparsedVersionsExist"

[HKLM\COMPONENTS\DerivedData\VersionedIndex\6.1.7601.17592 (win7sp1_gdr.110408-1631)\ComponentFamilies\amd64_microsoft.vc90.mfc_1fc8b3b9a1e18e3b_none_a2f75f3b9d7989e4]
"SomeUnparsedVersionsExist"

[HKLM\COMPONENTS]
"StoreDirty"

[HKLM\COMPONENTS\DerivedData\VersionedIndex\6.1.7601.17592 (win7sp1_gdr.110408-1631)\ComponentFamilies\amd64_microsoft.vc90.mfc_1fc8b3b9a1e18e3b_none_a2f75f3b9d7989e4\v!9.0.30729.1\UnstagedFiles]
"mfcm90.dll"

[HKLM\COMPONENTS\DerivedData\VersionedIndex\6.1.7601.17592 (win7sp1_gdr.110408-1631)\ComponentFamilies\amd64_microsoft.vc90.mfcloc_1fc8b3b9a1e18e3b_none_f0ee8071fb10f4e2\v!9.0.30729.1\UnstagedFiles]
"mfc90cht.dll"

[HKLM\COMPONENTS\DerivedData\VersionedIndex\6.1.7601.17592 (win7sp1_gdr.110408-1631)\ComponentFamilies\amd64_microsoft.vc90.openmp_1fc8b3b9a1e18e3b_none_ba5d016b21242809]
"SomeUnparsedVersionsExist"

[HKLM\COMPONENTS\DerivedData\VersionedIndex\6.1.7601.17592 (win7sp1_gdr.110408-1631)\ComponentFamilies\amd64_microsoft.vc90.crt_1fc8b3b9a1e18e3b_none_a28692199dcba471]
"SomeUnparsedVersionsExist"

[HKLM\COMPONENTS\DerivedData\VersionedIndex\6.1.7601.17592 (win7sp1_gdr.110408-1631)\ComponentFamilies\amd64_microsoft.vc90.mfcloc_1fc8b3b9a1e18e3b_none_f0ee8071fb10f4e2\v!9.0.30729.1\UnstagedFiles]
"mfc90ita.dll"

The process RunDll32.exe:2568 makes changes in the system registry.
The Worm creates and/or sets the following values in system registry:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\00-50-56-f3-c8-bd]
"WpadDetectedUrl" = ""

[HKLM\System\CurrentControlSet\Control\Session Manager]
"PendingFileRenameOperations" = "\??\%Program Files% (x86)\Google\Update\1.3.24.7, , \??\C:\Windows\TEMP\GoogleUpdateSetup.exe1b71e, , \??\C:\Users\"%CurrentUserName%"\AppData\Local\Temp\ADKAppsOfferManager.dll, , \??\C:\Users\"%CurrentUserName%"\AppData\Local\Temp\OpenCandy_Why_Is_This_Here.txt,"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Connections]
"SavedLegacySettings" = "46 00 00 00 3C 00 00 00 09 00 00 00 00 00 00 00"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\00-50-56-f3-c8-bd]
"WpadDecisionReason" = "1"
"WpadDecision" = "0"
"WpadDecisionTime" = "86 77 A5 14 D0 95 CF 01"

Proxy settings are disabled:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings]
"ProxyEnable" = "0"

The Worm deletes the following value(s) in system registry:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings]
"AutoConfigURL"
"ProxyServer"
"ProxyOverride"
"AutoDetect"

The process SearchProtocolHost.exe:2868 makes changes in the system registry.
The Worm creates and/or sets the following values in system registry:

[HKU\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached]
"{DFFACDC5-679F-4156-8947-C5C76BC0B67F} {ADD8BA80-002B-11D0-8F0F-00C04FD7D062} 0xFFFF" = "01 00 00 00 00 00 00 00 5A 77 C2 50 D0 95 CF 01"

The process uTorrent.exe:300 makes changes in the system registry.
The Worm creates and/or sets the following values in system registry:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"AutoDetect" = "1"

[HKLM\SOFTWARE\Wow6432Node\Microsoft\DirectDraw\MostRecentApplication]
"ID" = "1399311569"

[HKCU\Software\BitTorrent\uTorrent]
"OfferProvider" = "AdKnowledge"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\History]
"CachePrefix" = "Visited:"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\00-50-56-f3-c8-bd]
"WpadDecisionReason" = "1"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{9C99CCBB-10A0-4B2A-A5BE-4CAC43F74632}]
"WpadNetworkName" = "Network 3"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"UNCAsIntranet" = "0"

[HKCU\Software\Microsoft\Internet Explorer\DOMStorage\Total]
"(Default)" = "91475"

[HKCU\Software\Microsoft\Internet Explorer\DOMStorage\bittorrent.com]
"(Default)" = "14"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{9C99CCBB-10A0-4B2A-A5BE-4CAC43F74632}]
"WpadDecision" = "0"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Content]
"CachePrefix" = ""

[HKCU\Software\BitTorrent\uTorrent]
"OfferViaCAU" = "0"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{9C99CCBB-10A0-4B2A-A5BE-4CAC43F74632}]
"WpadDecisionReason" = "1"

[HKLM\SOFTWARE\Wow6432Node\Microsoft\DirectDraw\MostRecentApplication]
"Name" = "uTorrent.exe"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\00-50-56-f3-c8-bd]
"WpadDecisionTime" = "0C EF 6E 52 D0 95 CF 01"
"WpadDetectedUrl" = ""

[HKCU\Software\Classes\Local Settings\MuiCache\28\52C64B7E]
"LanguageList" = "en-US, en"

[HKCU\Software\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_BROWSER_EMULATION]
"utorrent.exe" = "9000"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Connections]
"SavedLegacySettings" = "46 00 00 00 3F 00 00 00 09 00 00 00 00 00 00 00"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\00-50-56-f3-c8-bd]
"WpadDecision" = "0"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Cookies]
"CachePrefix" = "Cookie:"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{9C99CCBB-10A0-4B2A-A5BE-4CAC43F74632}]
"WpadDecisionTime" = "A5 6E 60 54 D0 95 CF 01"

[HKCU\Software\BitTorrent\uTorrent]
"OfferName" = ""
"OfferAccepted" = "1"

Proxy settings are disabled:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings]
"ProxyEnable" = "0"

The Worm deletes the following value(s) in system registry:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\00-50-56-f3-c8-bd]
"WpadDetectedUrl"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"ProxyBypass"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings]
"ProxyServer"
"ProxyOverride"
"AutoDetect"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"IntranetName"

[HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"ProxyBypass"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{9C99CCBB-10A0-4B2A-A5BE-4CAC43F74632}]
"WpadDetectedUrl"

[HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"IntranetName"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings]
"AutoConfigURL"

The process %original file name%.exe:1224 makes changes in the system registry.
The Worm creates and/or sets the following values in system registry:

[HKCU\Software\Classes\.btinstall]
"Content Type" = "application/x-bittorrent-appinst"

[HKCU\Software\Classes\Applications\uTorrent.exe\shell\open\command]
"(Default)" = "C:\Users\"%CurrentUserName%"\AppData\Roaming\uTorrent\uTorrent.exe %1"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"AutoDetect" = "1"

[HKCR\MIME\Database\Content Type\application/x-bittorrent-app]
"Extension" = ".btapp"

[HKCU\Software\Classes\FalconBetaAccount]
"remote_access_client_id" = "0364783266"

[HKCU\Software\Classes\MIME\Database\Content Type\application/x-bittorrent-appinst]
"Extension" = ".btinstall"

[HKCU\Software\Classes\bittorrent]
"URL Protocol" = ""

[HKCU\Software\BitTorrent\uTorrent]
"OfferProvider" = ""

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\History]
"CachePrefix" = "Visited:"

[HKCU\Software\Classes\Magnet]
"URL Protocol" = ""

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\00-50-56-f3-c8-bd]
"WpadDecisionReason" = "1"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Uninstall\uTorrent]
"InstallLocation" = "C:\Users\"%CurrentUserName%"\AppData\Roaming\uTorrent"

[HKCR\MIME\Database\Content Type\application/x-bittorrent]
"Extension" = ".torrent"

[HKCR\MIME\Database\Content Type\application/x-bittorrent-appinst]
"Extension" = ".btinstall"

[HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\explorer]
"GlobalAssocChangedCounter" = "35"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{9C99CCBB-10A0-4B2A-A5BE-4CAC43F74632}]
"WpadNetworkName" = "Network 3"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"UNCAsIntranet" = "0"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Uninstall\uTorrent]
"VersionMinor" = "4"
"URLInfoAbout" = "http://www.utorrent.com"

[HKCU\Software\Classes\Magnet\shell\open\command]
"(Default)" = "C:\Users\"%CurrentUserName%"\AppData\Roaming\uTorrent\uTorrent.exe %1"

[HKCU\Software\Classes\bittorrent]
"(Default)" = "bittorrent URI"

[HKCU\Software\Classes\.btsearch]
"(Default)" = "uTorrent"

[HKCU\Software\Classes\bittorrent\DefaultIcon]
"(Default)" = "C:\Users\"%CurrentUserName%"\AppData\Roaming\uTorrent\maindoc.ico"

[HKCU\Software\Classes\Magnet]
"(Default)" = "Magnet URI"

[HKCU\Software\Classes\Magnet\DefaultIcon]
"(Default)" = "C:\Users\"%CurrentUserName%"\AppData\Roaming\uTorrent\maindoc.ico"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Uninstall\uTorrent]
"UninstallString" = "C:\Users\"%CurrentUserName%"\AppData\Roaming\uTorrent\uTorrent.exe /UNINSTALL"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{9C99CCBB-10A0-4B2A-A5BE-4CAC43F74632}]
"WpadDecision" = "0"

[HKLM\System\CurrentControlSet\Control\Session Manager]
"PendingFileRenameOperations" = "\??\%Program Files% (x86)\Google\Update\1.3.24.7, , \??\C:\Windows\TEMP\GoogleUpdateSetup.exe1b71e, , \??\C:\Users\"%CurrentUserName%"\AppData\Local\Temp\ADKAppsOfferManager.dll,"

[HKCU\Software\Classes\uTorrent\DefaultIcon]
"(Default)" = "C:\Users\"%CurrentUserName%"\AppData\Roaming\uTorrent\maindoc.ico"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Content]
"CachePrefix" = ""

[HKCU\Software\Classes\uTorrent\Content Type]
"(Default)" = "application/x-bittorrent"

[HKCU\Software\Classes\Magnet]
"Content Type" = "application/x-magnet"

[HKCU\Software\Classes\.btkey]
"(Default)" = "uTorrent"

[HKCU\Software\BitTorrent\uTorrent]
"OfferViaCAU" = "0"

[HKCU\Software\Classes\MIME\Database\Content Type\application/x-bittorrent]
"Extension" = ".torrent"

[HKCU\Software\BitTorrent\uTorrent]
"Revision" = "31105"

[HKCR\MIME\Database\Content Type\application/x-bittorrent-skin]
"Extension" = ".btskin"

[HKCU\Software\Classes\Magnet\shell]
"(Default)" = "open"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{9C99CCBB-10A0-4B2A-A5BE-4CAC43F74632}]
"WpadDecisionReason" = "1"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Uninstall\uTorrent]
"DisplayVersion" = "3.4.1.31105"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\00-50-56-f3-c8-bd]
"WpadDecisionTime" = "AE B6 2A 06 1E 92 CF 01"

[HKCU\Software\Classes\.btapp]
"Content Type" = "application/x-bittorrent-app"

[HKCU\Software\Classes\.btinstall]
"(Default)" = "uTorrent"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\00-50-56-f3-c8-bd]
"WpadDetectedUrl" = ""

[HKCU\Software\Classes\MIME\Database\Content Type\application/x-bittorrent-skin]
"Extension" = ".btskin"

[HKCU\Software\Classes\.torrent]
"(Default)" = "uTorrent"

[HKCU\Software\Classes\MIME\Database\Content Type\application/x-bittorrentsearchdescription xml]
"Extension" = ".btsearch"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Uninstall\uTorrent]
"DisplayName" = "µTorrent"
"VersionMajor" = "3"

[HKCU\Software\Classes\.btskin]
"Content Type" = "application/x-bittorrent-skin"

[HKCU\Software\Classes\Local Settings\MuiCache\28\52C64B7E]
"LanguageList" = "en-US, en"

[HKCU\Software\BitTorrent]
"computerid" = "EE 9E 6B BF 00 9F D8 C1 15 62 DB D4 5B 52 BC FE"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Uninstall\uTorrent]
"NoRepair" = "1"

[HKCU\Software\Classes\.torrent]
"Content Type" = "application/x-bittorrent"

[HKCU\Software\Classes\uTorrent\shell]
"(Default)" = "open"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Connections]
"SavedLegacySettings" = "46 00 00 00 3B 00 00 00 09 00 00 00 00 00 00 00"

[HKCU\Software\Classes\.btsearch\OpenWithProgids]
"uTorrent" = ""

[HKCU\Software\Classes\bittorrent]
"Content Type" = "application/x-bittorrent-protocol"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Uninstall\uTorrent]
"MinorVersion" = "4"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\00-50-56-f3-c8-bd]
"WpadDecision" = "0"

[HKCU\Software\Classes\.torrent\OpenWithProgids]
"uTorrent" = ""

[HKCR\MIME\Database\Content Type\application/x-bittorrentsearchdescription xml]
"Extension" = ".btsearch"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Cookies]
"CachePrefix" = "Cookie:"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Uninstall\uTorrent]
"MajorVersion" = "3"

[HKCR\MIME\Database\Content Type\application/x-bittorrent-key]
"Extension" = ".btkey"

[HKCU\Software\Classes\bittorrent\shell]
"(Default)" = "open"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Uninstall\uTorrent]
"DisplayIcon" = "C:\Users\"%CurrentUserName%"\AppData\Roaming\uTorrent\uTorrent.exe,0"

[HKCU\Software\Classes\.btsearch]
"Content Type" = "application/x-bittorrentsearchdescription xml"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Uninstall\uTorrent]
"NoModify" = "1"

[HKCU\Software\Classes\MIME\Database\Content Type\application/x-bittorrent-key]
"Extension" = ".btkey"

[HKCU\Software\Classes\MIME\Database\Content Type\application/x-bittorrent-app]
"Extension" = ".btapp"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Uninstall\uTorrent]
"Publisher" = "BitTorrent Inc."

[HKCU\Software\Classes\Applications\uTorrent.exe\shell]
"(Default)" = "open"

[HKCU\Software\BitTorrent\uTorrent]
"OfferAccepted" = "0"

[HKCU\Software\Classes\.btskin]
"(Default)" = "uTorrent"

[HKCU\Software\Classes\uTorrent\shell\open\command]
"(Default)" = "C:\Users\"%CurrentUserName%"\AppData\Roaming\uTorrent\uTorrent.exe %1"

[HKCU\Software\BitTorrent\uTorrent]
"OfferName" = ""

[HKCU\Software\Classes\bittorrent\shell\open\command]
"(Default)" = "C:\Users\"%CurrentUserName%"\AppData\Roaming\uTorrent\uTorrent.exe %1"

[HKCU\Software\Classes\.btapp]
"(Default)" = "uTorrent"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{9C99CCBB-10A0-4B2A-A5BE-4CAC43F74632}]
"WpadDecisionTime" = "86 77 A5 14 D0 95 CF 01"

[HKCU\Software\Classes\.btkey]
"Content Type" = "application/x-bittorrent-key"

Proxy settings are disabled:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings]
"ProxyEnable" = "0"

To automatically run itself each time Windows is booted, the Worm adds the following link to its file to the system registry autorun key:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Run]
"uTorrent" = "C:\Users\"%CurrentUserName%"\AppData\Roaming\uTorrent\uTorrent.exe /MINIMIZED"

The Worm deletes the following registry key(s):

[HKCR\.torrent\OpenWithProgIDs]

The Worm deletes the following value(s) in system registry:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\00-50-56-f3-c8-bd]
"WpadDetectedUrl"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"ProxyBypass"

[HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"ProxyBypass"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings]
"ProxyOverride"
"AutoDetect"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"IntranetName"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings]
"ProxyServer"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{9C99CCBB-10A0-4B2A-A5BE-4CAC43F74632}]
"WpadDetectedUrl"

[HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"IntranetName"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings]
"AutoConfigURL"

The process MyPC Backup.exe:4084 makes changes in the system registry.
The Worm creates and/or sets the following values in system registry:

[HKCU\Software\Classes\Local Settings\MuiCache\28\52C64B7E]
"LanguageList" = "en-US, en"

Dropped PE files

MD5 File path
e2c80c6c8ba5d2847601c5f8d426b63a c:\Program Files (x86)\MyPC Backup\AWSSDK.dll
5bfc53c0daee82e70ef02b9cf7ae3042 c:\Program Files (x86)\MyPC Backup\AlphaVSS.51.x86.dll
ba1d420f7fa1b4eef8cc127bee74a023 c:\Program Files (x86)\MyPC Backup\AlphaVSS.52.x64.dll
568754948b2aa5fcc41217fb28425cc5 c:\Program Files (x86)\MyPC Backup\AlphaVSS.52.x86.dll
a3ef02398e089dcd9708cbc4e427d0f7 c:\Program Files (x86)\MyPC Backup\AlphaVSS.60.x64.dll
057cf7fd20135899d616714534d0b7a8 c:\Program Files (x86)\MyPC Backup\AlphaVSS.60.x86.dll
3116e40a8b9709917e1dc1db4e068152 c:\Program Files (x86)\MyPC Backup\AlphaVSS.Common.dll
926dc40857c15a10325946e555020c39 c:\Program Files (x86)\MyPC Backup\BackupStack.exe
79fa03520f0389d286f50b92c522e017 c:\Program Files (x86)\MyPC Backup\Configuration Updater.exe
753da5b59f0fc465ccd60a598d9b5780 c:\Program Files (x86)\MyPC Backup\Crypto32.dll
199b0a1373fc914a9b756b1f9f882899 c:\Program Files (x86)\MyPC Backup\Crypto64.dll
581bf5d22365fb13b6dc11b64e2b329f c:\Program Files (x86)\MyPC Backup\GetText.dll
9b2ac62a9aab3369b253411c14b92fcb c:\Program Files (x86)\MyPC Backup\LogicNP.EZShellExtensions.dll
03e3bba202b3794ffcc16aa345ae69d7 c:\Program Files (x86)\MyPC Backup\MPCBClient.dll
33503824b2219604cb540148063910b2 c:\Program Files (x86)\MyPC Backup\MPCBContextMenu.dll
67147424a0aaf6c71e9acf0122bae9bc c:\Program Files (x86)\MyPC Backup\MPCBIconOverlays.dll
757e57a561676b7ad066bce63e31d02c c:\Program Files (x86)\MyPC Backup\MyPC Backup.exe
5a5498e2176e0f40a8fddd53da88920e c:\Program Files (x86)\MyPC Backup\ObjectListView.dll
4bb211393828d585cb5396a273008d94 c:\Program Files (x86)\MyPC Backup\RegisterExtensionDotNet20_x64.exe
74a8c01b69adedd7f1330245cd994821 c:\Program Files (x86)\MyPC Backup\RegisterExtensionDotNet20_x86.exe
158c16d067a3e27c1234b03aa69120b2 c:\Program Files (x86)\MyPC Backup\RestartExplorer.exe
a5d9e1fa931b1002c7a798448496e04c c:\Program Files (x86)\MyPC Backup\Service Start.exe
256f0ddfada4a1f4e20f7abdc99a0e28 c:\Program Files (x86)\MyPC Backup\Shared Stack.dll
1f80c15acc3c04ffad4efb17274200bf c:\Program Files (x86)\MyPC Backup\Signup Wizard.exe
760cda7e27bc06b622490333816c7f1c c:\Program Files (x86)\MyPC Backup\UnRegisterExtensions.exe
738a57e0d8dd303b87220f209bd49024 c:\Program Files (x86)\MyPC Backup\Updater.exe
1946bde7c1276752a747bf987bd0ccbf c:\Program Files (x86)\MyPC Backup\diffstack.dll
81db880082752821345938f1b98f7d77 c:\Program Files (x86)\MyPC Backup\uninst.exe
9f71303bddecf888cc77c2a486769c9d c:\Program Files (x86)\MyPC Backup\x64\System.Data.SQLite.dll
80725a732aba27911402f9ca09fede23 c:\Program Files (x86)\MyPC Backup\x86\System.Data.SQLite.dll
f9970fb733cd39910571596fbde55d22 c:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\RM4KMRI1\aff_setup[1].exe
cc1e34422f0fe7957531b7db55f193b5 c:\Users\"%CurrentUserName%"\AppData\Local\Temp\CloudBackup404.exe
62efa7b730eb0523a026ea4325403b77 c:\Users\"%CurrentUserName%"\AppData\Local\Temp\nsx9AD9.tmp\nsSCM.dll
7a9bf84ae6f5793548177fb6998ce922 c:\Users\"%CurrentUserName%"\AppData\Local\Temp\uttD03C.tmp
40395c175553cb14d2050888efccdf00 c:\Users\"%CurrentUserName%"\AppData\Local\Temp\vcredist_x64.exe
32404c1980e70f48bd5ef6a50cd3185b c:\Users\"%CurrentUserName%"\AppData\Roaming\uTorrent\updates\3.4.2_32176.exe
c101f49f8fbdc203757ebf954d83af12 c:\Windows\Installer\$PatchCache$\Managed\EFEE0228DC83E77358593193D847A0EC\9.0.30729\FL_msdia71_dll_2_60035_amd64_ln.3643236F_FC70_11D3_A536_0090278A1BB8
45e475fa46d8f04a682eb5eed5476e08 c:\Windows\winsxs\amd64_microsoft.vc90.atl_1fc8b3b9a1e18e3b_9.0.30729.1_none_9aefdaaa829eb818\ATL90.dll
1e7ce519349ca4b49930ad843470a3f9 c:\Windows\winsxs\amd64_microsoft.vc90.crt_1fc8b3b9a1e18e3b_9.0.30729.1_none_99b61f5e8371c1d4\msvcm90.dll
1f914c93052445e6629c37b81d421f7b c:\Windows\winsxs\amd64_microsoft.vc90.crt_1fc8b3b9a1e18e3b_9.0.30729.1_none_99b61f5e8371c1d4\msvcp90.dll
425d035880430fbed64dd6205c77f5b2 c:\Windows\winsxs\amd64_microsoft.vc90.crt_1fc8b3b9a1e18e3b_9.0.30729.1_none_99b61f5e8371c1d4\msvcr90.dll
e75de70a944462a9912c93e888b4106f c:\Windows\winsxs\amd64_microsoft.vc90.mfc_1fc8b3b9a1e18e3b_9.0.30729.1_none_951ab4128654b0c9\mfc90.dll
6962af1e97d8566e9c3496dc118fd3b7 c:\Windows\winsxs\amd64_microsoft.vc90.mfc_1fc8b3b9a1e18e3b_9.0.30729.1_none_951ab4128654b0c9\mfc90u.dll
e6ffdd8f997366fd88a799743579d389 c:\Windows\winsxs\amd64_microsoft.vc90.mfc_1fc8b3b9a1e18e3b_9.0.30729.1_none_951ab4128654b0c9\mfcm90.dll
f668d2f0c2377cc3b1459506a00b0f0b c:\Windows\winsxs\amd64_microsoft.vc90.mfc_1fc8b3b9a1e18e3b_9.0.30729.1_none_951ab4128654b0c9\mfcm90u.dll
deebddd75a0ecb8afd463bd3b2d9131a c:\Windows\winsxs\amd64_microsoft.vc90.mfcloc_1fc8b3b9a1e18e3b_9.0.30729.1_none_92995f253c01eddb\MFC90CHS.DLL
b0552cba0f603e1730762056add5eb9a c:\Windows\winsxs\amd64_microsoft.vc90.mfcloc_1fc8b3b9a1e18e3b_9.0.30729.1_none_92995f253c01eddb\MFC90CHT.DLL
2822498a5df669d223e6b093c00cb93a c:\Windows\winsxs\amd64_microsoft.vc90.mfcloc_1fc8b3b9a1e18e3b_9.0.30729.1_none_92995f253c01eddb\MFC90DEU.DLL
91e5d7df820fb0fe7ead68c32bead0da c:\Windows\winsxs\amd64_microsoft.vc90.mfcloc_1fc8b3b9a1e18e3b_9.0.30729.1_none_92995f253c01eddb\MFC90ENU.DLL
85bdf40f2af1944f579a7a134bd08a34 c:\Windows\winsxs\amd64_microsoft.vc90.mfcloc_1fc8b3b9a1e18e3b_9.0.30729.1_none_92995f253c01eddb\MFC90ESN.DLL
390ab412debb2be22fcaca5a59c9a3c2 c:\Windows\winsxs\amd64_microsoft.vc90.mfcloc_1fc8b3b9a1e18e3b_9.0.30729.1_none_92995f253c01eddb\MFC90ESP.DLL
598dcb951afd9a3d3d2e1abf7603de60 c:\Windows\winsxs\amd64_microsoft.vc90.mfcloc_1fc8b3b9a1e18e3b_9.0.30729.1_none_92995f253c01eddb\MFC90FRA.DLL
9e87f90e281ea1f41669920b349189c5 c:\Windows\winsxs\amd64_microsoft.vc90.mfcloc_1fc8b3b9a1e18e3b_9.0.30729.1_none_92995f253c01eddb\MFC90ITA.DLL
67695d68d782b48625a6c3ec08954216 c:\Windows\winsxs\amd64_microsoft.vc90.mfcloc_1fc8b3b9a1e18e3b_9.0.30729.1_none_92995f253c01eddb\MFC90JPN.DLL
91f1a8b875354dd5a1939e329af45656 c:\Windows\winsxs\amd64_microsoft.vc90.mfcloc_1fc8b3b9a1e18e3b_9.0.30729.1_none_92995f253c01eddb\MFC90KOR.DLL
32a4c8c6c2d09b98b14af92cd991a6d8 c:\Windows\winsxs\amd64_microsoft.vc90.mfcloc_1fc8b3b9a1e18e3b_9.0.30729.1_none_92995f253c01eddb\MFC90RUS.DLL
63e472c8410a0e9ce25c35a0482bbbbf c:\Windows\winsxs\amd64_microsoft.vc90.openmp_1fc8b3b9a1e18e3b_9.0.21022.8_none_a5325551f9d85633\vcomp90.dll

HOSTS file anomalies

No changes have been detected.

Rootkit activity

No anomalies have been detected.

Propagation

VersionInfo

Company Name: BitTorrent Inc.
Product Name: HD Player
Product Version: 3.4.1.31105
Legal Copyright: (c)2014 BitTorrent, Inc. All Rights Reserved.
Legal Trademarks:
Original Filename: uTorrent.exe
Internal Name: uTorrent.exe
File Version: 3.4.1.31105
File Description:
Comments:
Language: English (United States)

PE Sections

Name Virtual Address Virtual Size Raw Size Entropy Section MD5
UPX0 4096 2101248 0 0 d41d8cd98f00b204e9800998ecf8427e
UPX1 2105344 1138688 1137152 5.54498 9f1cd203b2bc8324154d0ae330096641
.rsrc 3244032 126976 123904 4.88297 539e097dbacec480094d692f9664d32f
.opcandy 3371008 303104 300032 5.51512 7a9bf84ae6f5793548177fb6998ce922
.adknow 3674112 102400 102400 5.513 e91cd5bbcf94d8b3455254f7744f738c

Dropped from:

Downloaded by:

Similar by SSDeep:

Similar by Lavasoft Polymorphic Checker:

URLs

URL IP
hxxp://a1621.g.akamai.net/msdownload/update/v3/static/trustedr/en/disallowedcertstl.cab?2911a00539d0dcf2
hxxp://a1621.g.akamai.net/msdownload/update/v3/static/trustedr/en/authrootstl.cab?ad5bd4c8a0fca6e2
hxxp://com-utorrent-prod-bench-290894750.us-east-1.elb.amazonaws.com/e?i=D2544ACE4303E0E45B2240BD78E93A67FFE4B5B2
hxxp://com-utorrent-prod-bench-290894750.us-east-1.elb.amazonaws.com/e?i=21
hxxp://update.utorrent.com/installoffer.php?h=AJ_YwRVi29RbUrz-&v=109279617&w=1DB10106&l=en&c=US&w64=1&db=iexplore.exe&cl=uTorrent&tsub=1&svp=4&cmp=82&ocmp=82 67.215.246.203
hxxp://update.utorrent.com/installstats.php?cl=uTorrent&v=109279617&h=AJ_YwRVi29RbUrz-&w=1DB10106&bu=0&pr=0&cmp=82&ocmp=82&showtbexists&pid=1224&cau=0&tbe=0&cd=0&view=win32 67.215.246.203
hxxp://imp.install-zone.com/impression.do/?user_id=FE2D69B3-3914-4632-9A57-DB6072FEFE3C&event=setup_run&spsource=68E633381BD14a69BD08A05C22B72D6A&traffic_source=68E633381BD14a69BD08A05C22B72D6A&browser=IE&implementation_id=dll 54.243.212.97
hxxp://config.install-zone.com/68E633381BD14a69BD08A05C22B72D6A/offers.json?version=1.1&pid=2&ts=&browser=IE 50.17.210.69
hxxp://d22z5jqfvuej9a.cloudfront.net/bundles/mypcbackup/dll_mypcbackup.jpg 54.230.230.176
hxxp://imp.install-zone.com/impression.do/?user_id=FE2D69B3-3914-4632-9A57-DB6072FEFE3C&event=dll_wrapper_initialize_0_2340&spsource=68E633381BD14a69BD08A05C22B72D6A&traffic_source=68E633381BD14a69BD08A05C22B72D6A&browser=IE&implementation_id=dll 54.243.212.97
hxxp://api.opencandy.com/?clientv=29&cltzone=180&language=en,en&method=get_offers&mstime=0.124&os=WIN6.1SP1-64&product_key=cb00343115ffdf69411419d8a9ceff1a&v=1.0&signature=76c9333ec06129b83c928f81de3acca9 204.232.180.209
hxxp://update.utorrent.com/installstats.php?cl=uTorrent&v=109279617&h=AJ_YwRVi29RbUrz-&w=1DB10106&bu=0&pr=0&cmp=82&ocmp=82&offerretrievedfromserver&pid=1224&cau=0&ServerOfferRetrieved=1&sec_offs=adk,oc&view=win32 67.215.246.203
hxxp://s3-1-w.amazonaws.com/templates/3204/3301/30906.png
hxxp://update.utorrent.com/installstats.php?cl=uTorrent&v=109279617&h=AJ_YwRVi29RbUrz-&w=1DB10106&bu=0&pr=0&cmp=82&ocmp=82&mismexecute&pid=1224&cau=0&download=0&execute=0&error=mism execute succeeded&mismreturn=0&mismresult=provider:8,search:1,homepage:1&view=win32 67.215.246.203
hxxp://bittorrent.vo.llnwd.net/offers/mediaCaster_default_grey.bmp
hxxp://bittorrent.vo.llnwd.net/offers/ZedsDead_InstallPath.bmp
hxxp://update.utorrent.com/updatestats.php?cl=uTorrent&v=109279617&h=AJ_YwRVi29RbUrz-&k=&ip=8&dns=1092&con=78&dl=78&error=HTTP Error 404&dlurl=http://ll.download3.utorrent.com/offers/mediaCaster_default_grey.bmp&svp=4&pid=1224&sz=168&bin=bmp&p1=192.168.139.2&m1=0&p2=192.168.50.10&m2=1&p3=193.138.244.233&m3=125&p4=10.235.0.11&m4=1&p5=193.138.244.106&m5=1&p6=46.164.136.181&m6=35&p7=80.91.160.129&m7=23&p9=195.22.214.108&m9=73&p10=89.221.34.123&m10=76&p11=89.221.34.181&m11=82&p12=87.248.216.137&m12=71&p13=87.248.217.254&m13=74 67.215.246.203
hxxp://update.utorrent.com/installstats.php?cl=uTorrent&v=109279617&h=AJ_YwRVi29RbUrz-&w=1DB10106&bu=0&pr=0&cmp=82&ocmp=82&showwarning&pid=1224&cau=0&view=win32 67.215.246.203
hxxp://update.utorrent.com/installstats.php?cl=uTorrent&v=109279617&h=AJ_YwRVi29RbUrz-&w=1DB10106&bu=0&pr=0&cmp=82&ocmp=82&showinstall&pid=1224&cau=0&au=0&view=win32 67.215.246.203
hxxp://imp.install-zone.com/impression.do/?user_id=FE2D69B3-3914-4632-9A57-DB6072FEFE3C&event=offer_0_accepted_mypcbackup_ww&spsource=68E633381BD14a69BD08A05C22B72D6A&traffic_source=68E633381BD14a69BD08A05C22B72D6A&browser=IE&implementation_id=dll 54.243.212.97
hxxp://update.utorrent.com/installstats.php?cl=uTorrent&v=109279617&h=AJ_YwRVi29RbUrz-&w=1DB10106&bu=0&pr=0&cmp=82&ocmp=82&offerapicurrentoffer&pid=1224&cau=0&OfferProvider=AdKnowledge&Offer=NotProvided&Accepted=1&view=win32 67.215.246.203
hxxp://update.utorrent.com/installstats.php?cl=uTorrent&v=109279617&h=AJ_YwRVi29RbUrz-&w=1DB10106&bu=0&pr=0&cmp=82&ocmp=82&showtorrentoffer&pid=1224&cau=0&toroffer=1&torofferid=ZedsDead&view=win32 67.215.246.203
hxxp://update.utorrent.com/installstats.php?cl=uTorrent&v=109279617&h=AJ_YwRVi29RbUrz-&w=1DB10106&bu=0&pr=0&cmp=82&ocmp=82&wizardcomplete&pid=1224&cau=0&view=win32 67.215.246.203
hxxp://update.utorrent.com/installstats.php?cl=uTorrent&v=109279617&h=AJ_YwRVi29RbUrz-&w=1DB10106&bu=0&pr=0&cmp=82&ocmp=82&gettbofferresult&pid=1224&cau=0&tbofferresult=3&exit=1375&cbsearch=1&cbhomepage=1&tb=ask-surf&view=win32 67.215.246.203
hxxp://d3abeplup23idj.cloudfront.net/
hxxp://bittorrent.vo.llnwd.net/utorrent-onboarding/player.btapp
hxxp://bittorrent.vo.llnwd.net/utorrent-onboarding/welcome-upsell.btapp
hxxp://s3-website-us-east-1.amazonaws.com/plus/utorrent/index.html
hxxp://update.utorrent.com/installstats.php?cl=uTorrent&v=109279617&h=AJ_YwRVi29RbUrz-&w=1DB10106&bu=0&pr=0&cmp=82&ocmp=82&installresult&pid=1224&cau=0&installresult=0&exit=1&au=0&view=win32 67.215.246.203
hxxp://bittorrent.vo.llnwd.net/offers/APNSetup-en-20140416.exe
hxxp://backupgrid.jdibackup.netdna-cdn.com/aff_setup.exe
hxxp://www106.search.ask.com/v7/installed?pid=BTR-V7&dtid=&cbid=&pf=&pids=&dbr=iexplore.exe_6_10.0.9200.16521&user_lid=409&client=stub
hxxp://a90.b.akamai.net/media/toolbar/everest/partners/BTR-V7/YY/Setup.ini
hxxp://imp.install-zone.com/impression.do/?user_id=FE2D69B3-3914-4632-9A57-DB6072FEFE3C&event=mypcbackup_ww_downloaded&spsource=68E633381BD14a69BD08A05C22B72D6A&traffic_source=68E633381BD14a69BD08A05C22B72D6A&browser=IE&implementation_id=dll 54.243.212.97
hxxp://www187a.apnanalytics.com/tr.gif?anxa=APNStub&anxv=7.7.3.1&anxe=OfferCheckEvent&anxr=5V5uPKoB&reason=unsupportedBrowser&tb-type=bt-crxrt&tpid=BTR-V7&trgb=IE&result=-1&ft=install&udbr=iexplore.exe_6_10.0.9200.16521
hxxp://imp.install-zone.com/impression.do/?user_id=FE2D69B3-3914-4632-9A57-DB6072FEFE3C&event=mypcbackup_ww_filesize_106748&spsource=68E633381BD14a69BD08A05C22B72D6A&traffic_source=68E633381BD14a69BD08A05C22B72D6A&browser=IE&implementation_id=dll 54.243.212.97
hxxp://www187a.apnanalytics.com/tr.gif?anxa=APNStub&anxv=7.7.3.1&anxe=InstallerEvent&anxr=5V5uPKoB&ieVersionInstalled=10.0.9200.16521&apn_dbr=iexplore.exe_6_10.0.9200.16521&defaultSearchChoice=1&ffVersionInstalled=29.0.1.5239&osArchitecture=64&tb-type=bt-crxrt&anxp=^BJ2^YYYYYY^YY^UA&installApiAttempts=1&msiErrorData=&osDetail=6.1.1.sp1.x64&msiErrorCode=&errorCondition=unsupportedBrowser&tpid=BTR-V7&offerCheckTime=0.22&installApiTime=0.36&user_dbr=iexplore.exe_6_10.0.9200.16521&locale=en_US&crVersionInstalled=35.0.1916.114&TargetBrowser=IE&msiVersion=5.0.7601.17807&msiExitCode=&installationResult=fail&setupTime=0.16&homepageChoice=1
hxxp://update.utorrent.com/installstats.php?cl=uTorrent&v=109279617&h=AJ_YwRVi29RbUrz-&w=1DB10106&bu=0&pr=0&cmp=82&ocmp=82&gettbinstallresult&pid=1224&cau=0&tbinstallresult=3&cbsearch=1&cbhomepage=1&error=0&msg=&tb=ask-surf&url=http://ll.download3.utorrent.com/offers/APNSetup-en-20140416.exe&prog=100&t=&view=win32 67.215.246.203
hxxp://track.mypcbackup.com/a04d5a5c/D0wnloads-{date}/MyPCBackup_Setup.exe 184.154.150.131
hxxp://update.utorrent.com/updatestats.php?cl=uTorrent&v=109279617&h=AJ_YwRVi29RbUrz-&k=&ip=8&dns=1092&con=31&dl=749&dlurl=http://ll.download3.utorrent.com/offers/APNSetup-en-20140416.exe&svp=4&pid=1224&sz=522704&bin=toolbar&p1=192.168.139.2&m1=0&p2=192.168.50.10&m2=0&p3=193.138.244.233&m3=4&p4=10.235.0.11&m4=0&p5=193.138.244.106&m5=1&p6=46.164.136.181&m6=1&p7=80.91.160.129&m7=7&p9=195.22.214.108&m9=55&p10=89.221.34.75&m10=38&p11=89.221.34.181&m11=46&p12=87.248.216.137&m12=102&p13=87.248.217.254&m13=68 67.215.246.203
hxxp://mypcbackup.jdibackup.netdna-cdn.com/MyPCBackup_Setup.exe
hxxp://bittorrent.vo.llnwd.net/utorrent-onboarding/player.btapp?h=AJ_YwRVi29RbUrz-&v=109279617&ol=en&ul=&tk=beta&c=uTorrent
hxxp://bittorrent.vo.llnwd.net/utorrent-onboarding/welcome-upsell.btapp?h=AJ_YwRVi29RbUrz-&v=109279617&ol=en&ul=&tk=beta&c=uTorrent
hxxp://com-utorrent-prod-bench-290894750.us-east-1.elb.amazonaws.com/e?i=29
hxxp://com-utorrent-prod-bench-290894750.us-east-1.elb.amazonaws.com/e?i=27
hxxp://bittorrent.vo.llnwd.net/blank.html
hxxp://utorrent.com/download/langpacks/dl.php?build=31105&ref=client&client=utorrent&sys_l=en&sel_l=0&tk=beta 98.143.146.7
hxxp://elb033464-1775177318.us-east-1.elb.amazonaws.com/inclient/yes?starttime=1393282818000&port=10627&pair=ADFC36D802A98BEB8DDDFD9BE07E8897AB050C2B&frameaddr=38a30e0
hxxp://d22z5jqfvuej9a.cloudfront.net/control/tags/ut.json 54.230.230.176
hxxp://update.bittorrent.com/time.php 67.215.246.204
hxxp://d3abeplup23idj.cloudfront.net/inclient/yes?starttime=1393282818000&port=10627&pair=ADFC36D802A98BEB8DDDFD9BE07E8897AB050C2B&frameaddr=38a30e0
hxxp://com-utorrent-prod-bench-290894750.us-east-1.elb.amazonaws.com/e?i=32
hxxp://d3abeplup23idj.cloudfront.net/bundles/79b5f927c68a0bc7f648e016404705ab4f86772403bfbd9c089194fbebe30203?starttime=1393282818000&port=10627&pair=ADFC36D802A98BEB8DDDFD9BE07E8897AB050C2B&frameaddr=38a30e0&download=true
hxxp://update.utorrent.com/checkupdate.php?s=1&cl=uTorrent&v=109279617&l=en&svp=4&svn_revno=31105&tk=beta&period=7&sids=0,0,0,0,0&lv=0_0_&c=US&w=1DB10106&t=3&h=AJ_YwRVi29RbUrz-&mts=31&gnc=1&nat_state=255&it=11&pc=21&sctl=1&shdi=1&xai=1&def_tor=1&w64=1&doainstalled=0&ie=9.10.9200.16521&xim=3&insvr=109279617&sss=1&rsb=2&rtsb=1&view=win32&cmp=82&ocmp=82&plus=3&pupsell=1&secp=AdKnowledge&secres=1&adc=1&ch_up=1?fg=1000&mt=1752&ssb=108&ssu=11644473707&xseq=0 67.215.246.203
hxxp://googleapis.l.google.com/css?family=Open Sans:400,300,600
hxxp://d22z5jqfvuej9a.cloudfront.net/stylesheets/public.6e99eab4adc332040f74e65e06c4942b.gz.css 54.230.230.176
hxxp://d22z5jqfvuej9a.cloudfront.net/vendor/modernizr.gz.js 54.230.230.176
hxxp://com-utorrent-prod-bench-290894750.us-east-1.elb.amazonaws.com/e?i=20
hxxp://s3-website-us-east-1.amazonaws.com/offers/streaming/offer.json?cid=AJ_YwRVi29RbUrz-&cc=82&l=-1
hxxp://mininova.org/favicon.ico
hxxp://d22z5jqfvuej9a.cloudfront.net/javascripts/base.fcc9358c8aaae43d85b310d2804259c0.gz.js 54.230.230.176
hxxp://d22z5jqfvuej9a.cloudfront.net/javascripts/public/public.b32f033b6c29a80cf06b5ef8d8265b05.gz.js 54.230.230.176
hxxp://bittorrent-954311581.us-east-1.elb.amazonaws.com/api/v2
hxxp://googlehosted.l.googleusercontent.com/static/fonts/opensans/v8/cJZKeOuBrn4kERxqtaUH3fY6323mHUZFJMgTvxaG2iE.eot
hxxp://googleapis.l.google.com/ajax/libs/jquery/2.0.3/jquery.min.js
hxxp://c.global-ssl.fastly.net/nr-411.min.js
hxxp://googlehosted.l.googleusercontent.com/static/fonts/opensans/v8/MTP_ySUJH_bn48VBG8sNSnZ2MAKAc2x4R1uOSeegc5U.eot
hxxp://bittorrent.hs.llnwd.net/download/langpacks/dl.php?build=31105&ref=client&client=utorrent&sys_l=en&sel_l=0&tk=beta
hxxp://s3-website-us-east-1.amazonaws.com/offers/streaming/streaming-animation-icon.bmp
hxxp://bittorrent.vo.llnwd.net/beta/utorrent.32176.installer.exe?au=1&hash=dd9a941e25f0ad9b3f5562ca0e668f869503b1a4
hxxp://bittorrent.vo.llnwd.net/langpacks/langpack-3063504ut.win.zip
hxxp://d22z5jqfvuej9a.cloudfront.net/img/logo.2c586cc7a3f8c7e684be335d22b13d8d.png 54.230.230.176
hxxp://d22z5jqfvuej9a.cloudfront.net/img/bundle-logo-large.4a053bd30f5bb3329130cf4fc49d0d73.png 54.230.230.176
hxxp://update.utorrent.com/update_event.php?cl=uTorrent&v=109279617&l=en&svp=4&svn_revno=31105&tk=beta&c=US&w=1DB10106&h=AJ_YwRVi29RbUrz-&auexit=1 67.215.246.203
hxxp://googlehosted.l.googleusercontent.com/static/fonts/opensans/v8/DXI1ORHCpsQm3Vp6mXoaTXZ2MAKAc2x4R1uOSeegc5U.eot
hxxp://beacon-2.newrelic.com/1/8b9486d826?a=3276066&qt=5&ap=25.624376&be=0&fe=358&dc=346&v=411.b2946c1&to=IxtARFdGQF8XSXQnZUlMUkNcUV9QF0kJClAVCxo=&f=["err","xhr"]&jsonp=NREUM.setToken&perf={"timing":{"of":1404290020183,"n":0,"dl":0,"di":5,"ds":354,"de":354,"dc":355,"l":366,"le":367,"f":0,"dn":0,"dne":0,"c":0,"ce":0,"rq":0,"rp":0,"rpe":3},"navigation":{}} 50.31.164.172
hxxp://bittorrent.hs.llnwd.net/scripts/dl.php?build=31105&ref=client&client=utorrent&sys_l=en&sel_l=0&tk=beta
hxxp://www-google-analytics.l.google.com/analytics.js
hxxp://d1mh11hmkkdpin.cloudfront.net/components/font-awesome-stylus/fonts/fontawesome-webfont.8b27bc96115c2d24350f0d09e6a9433f.eot? 54.230.230.161
hxxp://d145enxyh9g9og.cloudfront.net/bittorrent/image/upload/f_jpg,w_400,q_70/content-bundles/production-df0ec56d-0fbb-bc2c-11e7-354ff3af9c4e/53a0fc156e35310200e22f33/4nXTCoozQ8OBGW8wolSQ_zd_somewhere_else_final.jpg
hxxp://d1mh11hmkkdpin.cloudfront.net/img/social-sprite.3c63010ad741960298c76cf7aabd3627.png 54.230.230.161
hxxp://d3abeplup23idj.cloudfront.net/api/analytics?action=download&label=PublicTorrent&category=79b5f927c68a0bc7f648e016404705ab4f86772403bfbd9c089194fbebe30203&value=0
hxxp://d145enxyh9g9og.cloudfront.net/bittorrent/image/upload/f_jpg,w_1440,q_70/content-bundles/production-df0ec56d-0fbb-bc2c-11e7-354ff3af9c4e/53a0fc156e35310200e22f33/oigklpHfR96yCGJVAjuK_Zeds Dead Press Photo 2014.jpg
hxxp://d3abeplup23idj.cloudfront.net/api/analytics?action=pageview&label=EmailGatePage&category=79b5f927c68a0bc7f648e016404705ab4f86772403bfbd9c089194fbebe30203&value=0
hxxp://s3-1.amazonaws.com/content-bundles/production-df0ec56d-0fbb-bc2c-11e7-354ff3af9c4e/79b5f927c68a0bc7f648e016404705ab4f86772403bfbd9c089194fbebe30203/53a31fb10c56d802001b29ae/Somewhere Else.torrent
hxxp://e8218.ce.akamaiedge.net/MFEwTzBNMEswSTAJBgUrDgMCGgUABBRIt2RJ89X++hEzqoBeQg8PymQ2UQQUANhaTCXBIuWLMe9tuvPMXynxDWECECUM6OAwYS6fK4n3BU18+P0=
hxxp://s3-website-us-east-1.amazonaws.com/offers/streaming/index.html?port=10627&pair=AAF51F5F564AD28FFCFB5020BDB00283A1ED40A1&frameaddr=68242f8&plus=0&cid=AJ_YwRVi29RbUrz-&code=4
hxxp://www-google-analytics.l.google.com/plugins/ua/ecommerce.js
hxxp://e8218.ce.akamaiedge.net/MFEwTzBNMEswSTAJBgUrDgMCGgUABBS56bKHAoUD+Oyl+0LhPg9JxyQm4gQUf9Nlp8Ld7LvwMAnzQzn6Aq8zMTMCEH7hSm9v7/LTfz+tZU062rQ=
hxxp://www-google-analytics.l.google.com/collect?v=1&_v=j23&a=36551962&t=event&_s=1&dl=http://bundles.bittorrent.com/bundles/79b5f927c68a0bc7f648e016404705ab4f86772403bfbd9c089194fbebe30203?starttime=1393282818000&port=10627&pair=ADFC36D802A98BEB8DDDFD9BE07E8897AB050C2B&frameaddr=38a30e0&download=true&ul=en-us&de=utf-8&dt=Somewhere Else | BitTorrent Bundle&sd=24-bit&sr=1716x901&vp=973x534&je=1&ec=79b5f927c68a0bc7f648e016404705ab4f86772403bfbd9c089194fbebe30203&ea=InClient__InstallPath_TorrentDownload-Attempted&el=PublicTorrent&ev=0&_u=OKAAgIgS~&jid=899397547&cid=f862f0b3-a9cb-437c-941f-9f54e60b13bf&tid=UA-43671923-1&z=1077104819
hxxp://www-google-analytics.l.google.com/collect?v=1&_v=j23&a=36551962&t=pageview&_s=2&dl=http://bundles.bittorrent.com/bundles/79b5f927c68a0bc7f648e016404705ab4f86772403bfbd9c089194fbebe30203?starttime=1393282818000&port=10627&pair=ADFC36D802A98BEB8DDDFD9BE07E8897AB050C2B&frameaddr=38a30e0&download=true&dp=/bundles/79b5f927c68a0bc7f648e016404705ab4f86772403bfbd9c089194fbebe30203&ul=en-us&de=utf-8&dt=Somewhere Else | BitTorrent Bundle&sd=24-bit&sr=1716x901&vp=973x534&je=1&_u=eKAAgIgS~&jid=&cid=f862f0b3-a9cb-437c-941f-9f54e60b13bf&tid=UA-43671923-1&z=628595388
hxxp://www-google-analytics.l.google.com/collect?v=1&_v=j23&a=36551962&t=event&_s=3&dl=http://bundles.bittorrent.com/bundles/79b5f927c68a0bc7f648e016404705ab4f86772403bfbd9c089194fbebe30203?starttime=1393282818000&port=10627&pair=ADFC36D802A98BEB8DDDFD9BE07E8897AB050C2B&frameaddr=38a30e0&download=true&dp=/bundles/79b5f927c68a0bc7f648e016404705ab4f86772403bfbd9c089194fbebe30203&ul=en-us&de=utf-8&dt=Somewhere Else | BitTorrent Bundle&sd=24-bit&sr=1716x901&vp=973x534&je=1&ec=79b5f927c68a0bc7f648e016404705ab4f86772403bfbd9c089194fbebe30203&ea=InClient__InstallPath_IeEngine&el=10.0&ev=10&_u=eKAAgIgS~&jid=&cid=f862f0b3-a9cb-437c-941f-9f54e60b13bf&tid=UA-43671923-1&z=1143596725
hxxp://com-utorrent-prod-bench-290894750.us-east-1.elb.amazonaws.com/e?callback=jQuery20309916557603343579_1404290020832&i=ContentBundles&e=eyJzZXF1ZW5jZUlEIjoxLCJ1bmlxdWVJRCI6IjVhY2ZhZWU3LWQ3MzMtNDBmZS05MzdlLWY5OTliNTg3NDZiYiIsInNzYiI6MCwiZXZlbnROYW1lIjoiQ29udGVudEJ1bmRsZXMiLCJhY3Rpb24iOiJJbkNsaWVudF9fSW5zdGFsbFBhdGhfVG9ycmVudERvd25sb2FkLUF0dGVtcHRlZCIsImxhYmVsIjoiUHVibGljVG9ycmVudCIsImNhdGVnb3J5IjoiNzliNWY5MjdjNjhhMGJjN2Y2NDhlMDE2NDA0NzA1YWI0Zjg2NzcyNDAzYmZiZDljMDg5MTk0ZmJlYmUzMDIwMyIsInZhbHVlIjowfQ==&_=1404290020833
hxxp://com-utorrent-prod-bench-290894750.us-east-1.elb.amazonaws.com/e?callback=jQuery20309916557603343579_1404290020834&i=ContentBundles&e=eyJzZXF1ZW5jZUlEIjoyLCJ1bmlxdWVJRCI6IjVhY2ZhZWU3LWQ3MzMtNDBmZS05MzdlLWY5OTliNTg3NDZiYiIsInNzYiI6MCwiZXZlbnROYW1lIjoiQ29udGVudEJ1bmRsZXMiLCJjYXRlZ29yeSI6IiIsImFjdGlvbiI6InBhZ2V2aWV3IiwibGFiZWwiOiIvYnVuZGxlcy83OWI1ZjkyN2M2OGEwYmM3ZjY0OGUwMTY0MDQ3MDVhYjRmODY3NzI0MDNiZmJkOWMwODkxOTRmYmViZTMwMjAzIn0=&_=1404290020835
hxxp://d1mh11hmkkdpin.cloudfront.net/components/font-awesome-stylus/fonts/fontawesome-webfont.3293616ec0c605c7c2db25829a0a509e.woff?v=4.0.3 54.230.230.161
hxxp://googleapis.l.google.com/css?family=Open Sans|Open Sans Condensed:700
hxxp://s3-website-us-east-1.amazonaws.com/offers/streaming/css/styles.css
hxxp://s3-website-us-east-1.amazonaws.com/offers/streaming/bower_components/components-bootstrap/css/bootstrap.min.css
hxxp://e8218.ce.akamaiedge.net/MFEwTzBNMEswSTAJBgUrDgMCGgUABBR0JBRnBp/14Jg/Xj4aa6BlKlQVdQQUAVmr5906C1mmZGPWzyAHV9WR52oCEE80nM4VX/CHBW0XphVyXfM=
hxxp://com-utorrent-prod-bench-290894750.us-east-1.elb.amazonaws.com/e?callback=jQuery20309916557603343579_1404290020840&i=ContentBundles&e=eyJzZXF1ZW5jZUlEIjozLCJ1bmlxdWVJRCI6IjVhY2ZhZWU3LWQ3MzMtNDBmZS05MzdlLWY5OTliNTg3NDZiYiIsInNzYiI6MCwiZXZlbnROYW1lIjoiQ29udGVudEJ1bmRsZXMiLCJhY3Rpb24iOiJJbkNsaWVudF9fSW5zdGFsbFBhdGhfSWVFbmdpbmUiLCJsYWJlbCI6IjEwLjAiLCJ2YWx1ZSI6MTAsImNhdGVnb3J5IjoiNzliNWY5MjdjNjhhMGJjN2Y2NDhlMDE2NDA0NzA1YWI0Zjg2NzcyNDAzYmZiZDljMDg5MTk0ZmJlYmUzMDIwMyJ9&_=1404290020841
hxxp://com-utorrent-prod-bench-290894750.us-east-1.elb.amazonaws.com/e?callback=jQuery20309916557603343579_1404290020836&i=ContentBundles&e=eyJzZXF1ZW5jZUlEIjo0LCJ1bmlxdWVJRCI6IjVhY2ZhZWU3LWQ3MzMtNDBmZS05MzdlLWY5OTliNTg3NDZiYiIsInNzYiI6MCwiZXZlbnROYW1lIjoiQ29udGVudEJ1bmRsZXMiLCJhY3Rpb24iOiJJbkNsaWVudF9fSW5zdGFsbFBhdGhfQnRhcHBfRG93bmxvYWRfU3VjY2VzcyIsImxhYmVsIjoiU29tZXdoZXJlIEVsc2UtTi00ZTc1ODEzZGZiN2NhNDhhYjMyOWFmNjhmZWMyYmYyMDBlYWI1NTA0IiwiY2F0ZWdvcnkiOiI3OWI1ZjkyN2M2OGEwYmM3ZjY0OGUwMTY0MDQ3MDVhYjRmODY3NzI0MDNiZmJkOWMwODkxOTRmYmViZTMwMjAzIiwidmFsdWUiOjB9&_=1404290020848
hxxp://www-google-analytics.l.google.com/collect?v=1&_v=j23&a=36551962&t=event&_s=4&dl=http://bundles.bittorrent.com/bundles/79b5f927c68a0bc7f648e016404705ab4f86772403bfbd9c089194fbebe30203?starttime=1393282818000&port=10627&pair=ADFC36D802A98BEB8DDDFD9BE07E8897AB050C2B&frameaddr=38a30e0&download=true&dp=/bundles/79b5f927c68a0bc7f648e016404705ab4f86772403bfbd9c089194fbebe30203&ul=en-us&de=utf-8&dt=Somewhere Else | BitTorrent Bundle&sd=24-bit&sr=1716x901&vp=973x534&je=1&ec=79b5f927c68a0bc7f648e016404705ab4f86772403bfbd9c089194fbebe30203&ea=InClient__InstallPath_Btapp_Download_Success&el=Somewhere Else-N-4e75813dfb7ca48ab329af68fec2bf200eab5504&ev=0&_u=eKAAgIgS~&jid=&cid=f862f0b3-a9cb-437c-941f-9f54e60b13bf&tid=UA-43671923-1&z=476402294
hxxp://www-google-analytics.l.google.com/collect?v=1&_v=j23&a=36551962&t=event&_s=5&dl=http://bundles.bittorrent.com/bundles/79b5f927c68a0bc7f648e016404705ab4f86772403bfbd9c089194fbebe30203?starttime=1393282818000&port=10627&pair=ADFC36D802A98BEB8DDDFD9BE07E8897AB050C2B&frameaddr=38a30e0&download=true&dp=/bundles/79b5f927c68a0bc7f648e016404705ab4f86772403bfbd9c089194fbebe30203&ul=en-us&de=utf-8&dt=Somewhere Else | BitTorrent Bundle&sd=24-bit&sr=1716x901&vp=973x534&je=1&ec=79b5f927c68a0bc7f648e016404705ab4f86772403bfbd9c089194fbebe30203&ea=InClient__InstallPath_ClientVersion&el=uTorrent_3_4_1_31105&ev=0&_u=eKAAgIgS~&jid=&cid=f862f0b3-a9cb-437c-941f-9f54e60b13bf&tid=UA-43671923-1&z=787819751
hxxp://www-google-analytics.l.google.com/collect?v=1&_v=j23&a=36551962&t=event&_s=6&dl=http://bundles.bittorrent.com/bundles/79b5f927c68a0bc7f648e016404705ab4f86772403bfbd9c089194fbebe30203?starttime=1393282818000&port=10627&pair=ADFC36D802A98BEB8DDDFD9BE07E8897AB050C2B&frameaddr=38a30e0&download=true&dp=/bundles/79b5f927c68a0bc7f648e016404705ab4f86772403bfbd9c089194fbebe30203&ul=en-us&de=utf-8&dt=Somewhere Else | BitTorrent Bundle&sd=24-bit&sr=1716x901&vp=973x534&je=1&ec=79b5f927c68a0bc7f648e016404705ab4f86772403bfbd9c089194fbebe30203&ea=InClient__InstallPath_PageView-Succeed&el=EmailGatePage&ev=0&_u=eKAAgIgS~&jid=&cid=f862f0b3-a9cb-437c-941f-9f54e60b13bf&tid=UA-43671923-1&z=999524987
hxxp://com-utorrent-prod-bench-290894750.us-east-1.elb.amazonaws.com/e?callback=jQuery20309916557603343579_1404290020844&i=ContentBundles&e=eyJzZXF1ZW5jZUlEIjo1LCJ1bmlxdWVJRCI6IjVhY2ZhZWU3LWQ3MzMtNDBmZS05MzdlLWY5OTliNTg3NDZiYiIsInNzYiI6MCwiZXZlbnROYW1lIjoiQ29udGVudEJ1bmRsZXMiLCJhY3Rpb24iOiJJbkNsaWVudF9fSW5zdGFsbFBhdGhfQ2xpZW50VmVyc2lvbiIsImxhYmVsIjoidVRvcnJlbnRfM180XzFfMzExMDUiLCJjYXRlZ29yeSI6Ijc5YjVmOTI3YzY4YTBiYzdmNjQ4ZTAxNjQwNDcwNWFiNGY4Njc3MjQwM2JmYmQ5YzA4OTE5NGZiZWJlMzAyMDMiLCJ2YWx1ZSI6MH0=&_=1404290020849
hxxp://com-utorrent-prod-bench-290894750.us-east-1.elb.amazonaws.com/e?callback=jQuery20309916557603343579_1404290020852&i=ContentBundles&e=eyJzZXF1ZW5jZUlEIjo2LCJ1bmlxdWVJRCI6IjVhY2ZhZWU3LWQ3MzMtNDBmZS05MzdlLWY5OTliNTg3NDZiYiIsInNzYiI6MCwiZXZlbnROYW1lIjoiQ29udGVudEJ1bmRsZXMiLCJhY3Rpb24iOiJJbkNsaWVudF9fSW5zdGFsbFBhdGhfUGFnZVZpZXctU3VjY2VlZCIsImxhYmVsIjoiRW1haWxHYXRlUGFnZSIsImNhdGVnb3J5IjoiNzliNWY5MjdjNjhhMGJjN2Y2NDhlMDE2NDA0NzA1YWI0Zjg2NzcyNDAzYmZiZDljMDg5MTk0ZmJlYmUzMDIwMyIsInZhbHVlIjowfQ==&_=1404290020853
hxxp://e6845.ce.akamaiedge.net/crls/secureca.crl
hxxp://s3-website-us-east-1.amazonaws.com/offers/streaming/img/icon-close.png
hxxp://e8218.ce.akamaiedge.net/MEQwQjBAMD4wPDAJBgUrDgMCGgUABBSxtDkXkBa3l3lQEfFgudSiPNvt7gQUAPkqw0GRtsnCuD5V8sCXEROgByACAwI6aQ==
hxxp://s3-website-us-east-1.amazonaws.com/offers/streaming/img/laptop-free.png
hxxp://s3-website-us-east-1.amazonaws.com/images/mobile-icon.png
hxxp://www-google-analytics.l.google.com/ocsp/MEkwRzBFMEMwQTAJBgUrDgMCGgUABBTy4Gr5hYodjXCbSRkjeqm1Gih+ZAQUSt0GFhu89mi1dvWBtrtiGrpagS8CCEvtXZfXAf64
hxxp://s3-website-us-east-1.amazonaws.com/offers/streaming/img/ribbon.png
hxxp://gp1.wac.v2cdn.net/Advertisers/a97299ec28da43eba71d3439887cf621.jpg
hxxp://s3-website-us-east-1.amazonaws.com/offers/streaming/img/devices-01.png
hxxp://s3-website-us-east-1.amazonaws.com/offers/streaming/img/ut-premium-logo.png
hxxp://gp1.wac.v2cdn.net/Advertisers/39e6df9d0f9745dfa63fdd2cf5602a1a.jpg
hxxp://bittorrent-954311581.us-east-1.elb.amazonaws.com/i.gif?e=eyJhdiI6NTk1OTcsImF0Ijo5LCJjbSI6MTI3Mzg3LCJjaCI6ODc4NSwiY3IiOjM2OTUzMywiZGkiOiIwNDgyZmM0ODllOGI0OGQxOTcwZGU5Zjc0MDE5N2M1ZCIsImRtIjozLCJmYyI6NDU1MTcxLCJmbCI6MjMyOTE2LCJpcCI6IjE5My4xMzguMjQ0LjIzMSIsImt3IjoiY2xpZW50ZGF0YT11dG9ycmVudHwzLjQuMS4zMTEwNXw4MixpZXZlcnNpb249MTAsZmxhc2g9bm9uZSIsIm53Ijo1NjgyLCJwYyI6MC4xLCJwciI6MjM3NTUsInJ0IjozLCJzdCI6MzMwNDksInVrIjoidWUxLTZjZmRiY2RjYTQ0NjQ0NmZiMDFmZDE0NDgwZGViNjRhIiwidHMiOjE0MDQyOTAxOTc3NjIsImZxIjoxfQ&s=_dkqk6fdSoQAgWHd01Qej3p10WE
hxxp://s3-website-us-east-1.amazonaws.com/offers/streaming/img/visa-mastercard.png
hxxp://s3-website-us-east-1.amazonaws.com/offers/streaming/img/amex-discover.png
hxxp://gp1.wac.v2cdn.net/Advertisers/0b9bbc295ea846bdba8e23749d787bbd
hxxp://bittorrent-954311581.us-east-1.elb.amazonaws.com/i.gif?e=eyJhdiI6MzY0OTMsImF0Ijo5LCJjbSI6MTEyMjM3LCJjaCI6ODc4NSwiY3IiOjMzMDkxMSwiZGkiOiI0YWU2Y2RjYTQ5YTk0MGFjOTgzNzc0MjQxNTk4OGM2YSIsImRtIjozLCJmYyI6NDA4MTg1LCJmbCI6MjA2NDQxLCJpcCI6IjE5My4xMzguMjQ0LjIzMSIsImt3IjoiY2xpZW50ZGF0YT11dG9ycmVudHwzLjQuMS4zMTEwNXw4MixpZXZlcnNpb249MTAsZmxhc2g9bm9uZSIsIm53Ijo1NjgyLCJwYyI6MC4wOCwicHIiOjIzNzU1LCJydCI6Mywic3QiOjMzMDQ5LCJ0ciI6dHJ1ZSwidWsiOiJ1ZTEtMTlkYThkMmRkMzM2NGU0OWFlZDdkYWNiZDkzMWQ0MjAiLCJ0cyI6MTQwNDI4OTg3NzAxNiwiZnEiOjF9&s=Iy3hRp0kcSxHtMFS49XUgy6V8ZE
hxxp://bittorrent-954311581.us-east-1.elb.amazonaws.com/i.gif?e=eyJhdiI6NTEzMjAsImF0IjoxMjI0LCJjbSI6MTA1OTgxLCJjaCI6ODc4NSwiY3IiOjM2NTIzOSwiZGkiOiJiZjQzY2NhNmEwMTg0MjQ5OWE1N2RkYTcyMDJlZTU1NyIsImRtIjozLCJmYyI6NDUwODU2LCJmbCI6MjI5OTIwLCJpcCI6IjE5My4xMzguMjQ0LjIzMSIsImt3IjoiY2xpZW50ZGF0YT11dG9ycmVudHwzLjQuMS4zMTEwNXw4MixpZXZlcnNpb249MTAsZmxhc2g9bm9uZSIsIm53Ijo1NjgyLCJwYyI6MC4wMiwicHIiOjIzNzU1LCJydCI6Mywic3QiOjMzMDQ5LCJ1ayI6InVlMS02Y2ZkYmNkY2E0NDY0NDZmYjAxZmQxNDQ4MGRlYjY0YSIsInRzIjoxNDA0MjkwMjc4MDQ1LCJmcSI6MX0&s=H8-CSOgax1FMdCtlLuH8RMCrAWs
hxxp://s3-website-us-east-1.amazonaws.com/offers/streaming/img/paypal.png
hxxp://s3-website-us-east-1.amazonaws.com/offers/streaming/img/mobile-payment.png
hxxp://s3-website-us-east-1.amazonaws.com/offers/streaming/img/other.png
hxxp://s3-website-us-east-1.amazonaws.com/offers/streaming/img/devices-02.png
hxxp://s3-website-us-east-1.amazonaws.com/offers/streaming/bower_components/jquery/dist/jquery.min.js
hxxp://s3-website-us-east-1.amazonaws.com/offers/streaming/js/client2.js
hxxp://s3-website-us-east-1.amazonaws.com/offers/streaming/js/main.js
hxxp://s3-website-us-east-1.amazonaws.com/offers/streaming/js/streaming.js
hxxp://s3-1.amazonaws.com/content-bundles/production-df0ec56d-0fbb-bc2c-11e7-354ff3af9c4e/79b5f927c68a0bc7f648e016404705ab4f86772403bfbd9c089194fbebe30203/originals/Somewhere Else/01 - Zeds Dead (feat. Twin Shadow) - Lost You (Official Music Video).mp4
hxxp://www-google-analytics.l.google.com/ga.js
hxxp://www-google-analytics.l.google.com/__utm.gif?utmwv=5.5.3&utms=1&utmn=605500297&utmhn=utclient.utorrent.com&utmcs=windows-1252&utmsr=1716x901&utmvp=989x534&utmsc=24-bit&utmul=en-us&utmje=1&utmfl=-&utmhid=1032740853&utmr=-&utmp=/offers/streaming/index.html?port=10627&pair=AAF51F5F564AD28FFCFB5020BDB00283A1ED40A1&frameaddr=68242f8&plus=0&cid=AJ_YwRVi29RbUrz-&code=4&utmht=1404290027768&utmac=UA-41506357-17&utmcc=__utma=132793802.1493147085.1404290028.1404290028.1404290028.1;+__utmz=132793802.1404290028.1.1.utmcsr=(direct)|utmccn=(direct)|utmcmd=(none);&utmu=q~
hxxp://e8218.ce.akamaiedge.net/MFEwTzBNMEswSTAJBgUrDgMCGgUABBS56bKHAoUD+Oyl+0LhPg9JxyQm4gQUf9Nlp8Ld7LvwMAnzQzn6Aq8zMTMCEFIA5aolVvwahu2WydRLM8c=
hxxp://e8218.ce.akamaiedge.net/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTSqZMG5M8TA9rdzkbCnNwuMAd5VgQUz5mp6nsm9EvJjo/X8AUm7+PSp50CEFcywVdOavgo4bT5Ors07Qg=
hxxp://com-utorrent-prod-bench-290894750.us-east-1.elb.amazonaws.com/e?i=31
hxxp://track.mypcbackup.com/aadebc4830c51c2794a960fe5a9e11df.php 184.154.150.131
hxxp://a767.dscms.akamai.net/download/2/d/6/2d61c766-107b-409d-8fba-c39e61ca08e8/vcredist_x64.exe
hxxp://us-east-1-a.route.herokuapp.com/announce?info_hash=Nu=û|¤Š³)¯hþ¿ «U&peer_id=-UT341-yа"M
c=&port=10627&uploaded=0&downloaded=0&left=295942403&corrupt=0&key=31975450&event=started&numwant=200&compact=1&no_peer_id=1&ipv6=2001:0:5ef5:79fb:44e:a454:3e75:b18
hxxp://cs9.wac.edgecastcdn.net/MFEwTzBNMEswSTAJBgUrDgMCGgUABBT3xL4LQLXDRDM9P665TW442vrsUQQUReuir/SSy4IxLVGLp6chnfNtyA8CEAQJGBtf1btmdVNDtW+VUAg=
hxxp://cs9.wac.edgecastcdn.net/MFEwTzBNMEswSTAJBgUrDgMCGgUABBSnR4FoxLLkI7vkvsUIFlZt+lGH3gQUWsS5eyoKo6XqcQPAYPkt9mV1DlgCEAyvGbEyaFTw/abLEQ3zC1w=
hxxp://imp.install-zone.com/impression.do/?user_id=FE2D69B3-3914-4632-9A57-DB6072FEFE3C&event=mypcbackup_ww_install_failed&spsource=68E633381BD14a69BD08A05C22B72D6A&traffic_source=68E633381BD14a69BD08A05C22B72D6A&browser=IE&implementation_id=dll 54.243.212.97
hxxp://imp.install-zone.com/impression.do/?user_id=FE2D69B3-3914-4632-9A57-DB6072FEFE3C&event=setup_complete&spsource=68E633381BD14a69BD08A05C22B72D6A&traffic_source=68E633381BD14a69BD08A05C22B72D6A&browser=IE&implementation_id=dll 54.243.212.97
hxxp://a1363.g.akamai.net/pki/crl/products/microsoftrootcert.crl
hxxp://a1363.g.akamai.net/pki/crl/products/WinPCA.crl
hxxp://e8218.ce.akamaiedge.net/MEQwQjBAMD4wPDAJBgUrDgMCGgUABBSxtDkXkBa3l3lQEfFgudSiPNvt7gQUAPkqw0GRtsnCuD5V8sCXEROgByACAwI6Yw==
hxxp://e8218.ce.akamaiedge.net/MFEwTzBNMEswSTAJBgUrDgMCGgUABBQSBA0TLeT5Hrk8v73bcU3oAZux9AQUEUrQcznVW2kIXLo9v2SaqIscVbwCEFCJdZ5K2+b6D313VdV4haw=
hxxp://d1mh11hmkkdpin.cloudfront.net/javascripts/base.fcc9358c8aaae43d85b310d2804259c0.gz.js 54.230.230.161
hxxp://ads.bittorrent.com/blank.html 87.248.217.254
hxxp://clients1.google.com/ocsp/MEkwRzBFMEMwQTAJBgUrDgMCGgUABBTy4Gr5hYodjXCbSRkjeqm1Gih+ZAQUSt0GFhu89mi1dvWBtrtiGrpagS8CCEvtXZfXAf64 173.194.113.201
hxxp://bench.utorrent.com/e?i=27 107.21.251.25
hxxp://ctldl.windowsupdate.com/msdownload/update/v3/static/trustedr/en/disallowedcertstl.cab?2911a00539d0dcf2 188.43.73.9
hxxp://bench.utorrent.com/e?callback=jQuery20309916557603343579_1404290020836&i=ContentBundles&e=eyJzZXF1ZW5jZUlEIjo0LCJ1bmlxdWVJRCI6IjVhY2ZhZWU3LWQ3MzMtNDBmZS05MzdlLWY5OTliNTg3NDZiYiIsInNzYiI6MCwiZXZlbnROYW1lIjoiQ29udGVudEJ1bmRsZXMiLCJhY3Rpb24iOiJJbkNsaWVudF9fSW5zdGFsbFBhdGhfQnRhcHBfRG93bmxvYWRfU3VjY2VzcyIsImxhYmVsIjoiU29tZXdoZXJlIEVsc2UtTi00ZTc1ODEzZGZiN2NhNDhhYjMyOWFmNjhmZWMyYmYyMDBlYWI1NTA0IiwiY2F0ZWdvcnkiOiI3OWI1ZjkyN2M2OGEwYmM3ZjY0OGUwMTY0MDQ3MDVhYjRmODY3NzI0MDNiZmJkOWMwODkxOTRmYmViZTMwMjAzIiwidmFsdWUiOjB9&_=1404290020848 107.21.251.25
hxxp://s3.amazonaws.com/content-bundles/production-df0ec56d-0fbb-bc2c-11e7-354ff3af9c4e/79b5f927c68a0bc7f648e016404705ab4f86772403bfbd9c089194fbebe30203/originals/Somewhere Else/01 - Zeds Dead (feat. Twin Shadow) - Lost You (Official Music Video).mp4 54.231.1.136
hxxp://tracker.bundles.bittorrent.com/announce?info_hash=Nu=û|¤Š³)¯hþ¿ «U&peer_id=-UT341-yа"M
c=&port=10627&uploaded=0&downloaded=0&left=295942403&corrupt=0&key=31975450&event=started&numwant=200&compact=1&no_peer_id=1&ipv6=2001:0:5ef5:79fb:44e:a454:3e75:b18
184.72.241.146
hxxp://utclient.utorrent.com/offers/streaming/img/icon-close.png 205.251.242.186
hxxp://engine.ap.bittorrent.com/i.gif?e=eyJhdiI6MzY0OTMsImF0Ijo5LCJjbSI6MTEyMjM3LCJjaCI6ODc4NSwiY3IiOjMzMDkxMSwiZGkiOiI0YWU2Y2RjYTQ5YTk0MGFjOTgzNzc0MjQxNTk4OGM2YSIsImRtIjozLCJmYyI6NDA4MTg1LCJmbCI6MjA2NDQxLCJpcCI6IjE5My4xMzguMjQ0LjIzMSIsImt3IjoiY2xpZW50ZGF0YT11dG9ycmVudHwzLjQuMS4zMTEwNXw4MixpZXZlcnNpb249MTAsZmxhc2g9bm9uZSIsIm53Ijo1NjgyLCJwYyI6MC4wOCwicHIiOjIzNzU1LCJydCI6Mywic3QiOjMzMDQ5LCJ0ciI6dHJ1ZSwidWsiOiJ1ZTEtMTlkYThkMmRkMzM2NGU0OWFlZDdkYWNiZDkzMWQ0MjAiLCJ0cyI6MTQwNDI4OTg3NzAxNiwiZnEiOjF9&s=Iy3hRp0kcSxHtMFS49XUgy6V8ZE 50.19.122.136
hxxp://utclient.utorrent.com/offers/streaming/img/mobile-payment.png 205.251.242.186
hxxp://apps.bittorrent.com/utorrent-onboarding/welcome-upsell.btapp?h=AJ_YwRVi29RbUrz-&v=109279617&ol=en&ul=&tk=beta&c=uTorrent 87.248.217.253
hxxp://bench.utorrent.com/e?i=31 107.21.251.25
hxxp://static.ap.bittorrent.com/Advertisers/0b9bbc295ea846bdba8e23749d787bbd 93.184.220.20
hxxp://update.utorrent.com/updatestats.php?cl=uTorrent&v=109279617&h=AJ_YwRVi29RbUrz-&k=&ip=8&dns=1092&con=78&dl=78&error=HTTP Error 404&dlurl=http://ll.download3.utorrent.com/offers/mediaCaster_default_grey.bmp&svp=4&pid=1224&sz=168&bin=<NULL>bmp&p1=192.168.139.2&m1=0&p2=192.168.50.10&m2=1&p3=193.138.244.233&m3=125&p4=10.235.0.11&m4=1&p5=193.138.244.106&m5=1&p6=46.164.136.181&m6=35&p7=80.91.160.129&m7=23&p9=195.22.214.108&m9=73&p10=89.221.34.123&m10=76&p11=89.221.34.181&m11=82&p12=87.248.216.137&m12=71&p13=87.248.217.254&m13=74 67.215.246.203
hxxp://utclient.utorrent.com/offers/streaming/js/streaming.js 205.251.242.186
hxxp://bench.utorrent.com/e?i=21 107.21.251.25
hxxp://themes.googleusercontent.com/static/fonts/opensans/v8/cJZKeOuBrn4kERxqtaUH3fY6323mHUZFJMgTvxaG2iE.eot 173.194.113.203
hxxp://utclient.utorrent.com/offers/streaming/bower_components/jquery/dist/jquery.min.js 205.251.242.186
hxxp://s2.symcb.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBS56bKHAoUD+Oyl+0LhPg9JxyQm4gQUf9Nlp8Ld7LvwMAnzQzn6Aq8zMTMCEH7hSm9v7/LTfz+tZU062rQ= 23.43.139.27
hxxp://cdn.backupgrid.net/aff_setup.exe 108.161.187.56
hxxp://utclient.utorrent.com/offers/streaming/img/amex-discover.png 205.251.242.186
hxxp://d1mh11hmkkdpin.cloudfront.net/vendor/modernizr.gz.js 54.230.230.161
hxxp://tbapi.search.ask.com/v7/installed?pid=BTR-V7&dtid=&cbid=&pf=&pids=&dbr=iexplore.exe_6_10.0.9200.16521&user_lid=409&client=stub 199.36.100.106
hxxp://sr.symcd.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBR0JBRnBp/14Jg/Xj4aa6BlKlQVdQQUAVmr5906C1mmZGPWzyAHV9WR52oCEE80nM4VX/CHBW0XphVyXfM= 23.43.139.27
hxxp://ctldl.windowsupdate.com/msdownload/update/v3/static/trustedr/en/authrootstl.cab?ad5bd4c8a0fca6e2 188.43.73.9
hxxp://ll.download3.utorrent.com/offers/mediaCaster_default_grey.bmp 87.248.217.254
hxxp://utclient.utorrent.com/offers/streaming/img/devices-01.png 205.251.242.186
hxxp://gtglobal-ocsp.geotrust.com/MEQwQjBAMD4wPDAJBgUrDgMCGgUABBSxtDkXkBa3l3lQEfFgudSiPNvt7gQUAPkqw0GRtsnCuD5V8sCXEROgByACAwI6aQ== 23.43.139.27
hxxp://bench.utorrent.com/e?i=D2544ACE4303E0E45B2240BD78E93A67FFE4B5B2 107.21.251.25
hxxp://ocsp.verisign.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTSqZMG5M8TA9rdzkbCnNwuMAd5VgQUz5mp6nsm9EvJjo/X8AUm7+PSp50CEFcywVdOavgo4bT5Ors07Qg= 23.43.139.27
hxxp://fonts.googleapis.com/css?family=Open Sans:400,300,600 173.194.70.95
hxxp://utclient.utorrent.com/offers/streaming/bower_components/components-bootstrap/css/bootstrap.min.css 205.251.242.186
hxxp://bench.utorrent.com/e?callback=jQuery20309916557603343579_1404290020840&i=ContentBundles&e=eyJzZXF1ZW5jZUlEIjozLCJ1bmlxdWVJRCI6IjVhY2ZhZWU3LWQ3MzMtNDBmZS05MzdlLWY5OTliNTg3NDZiYiIsInNzYiI6MCwiZXZlbnROYW1lIjoiQ29udGVudEJ1bmRsZXMiLCJhY3Rpb24iOiJJbkNsaWVudF9fSW5zdGFsbFBhdGhfSWVFbmdpbmUiLCJsYWJlbCI6IjEwLjAiLCJ2YWx1ZSI6MTAsImNhdGVnb3J5IjoiNzliNWY5MjdjNjhhMGJjN2Y2NDhlMDE2NDA0NzA1YWI0Zjg2NzcyNDAzYmZiZDljMDg5MTk0ZmJlYmUzMDIwMyJ9&_=1404290020841 107.21.251.25
hxxp://bench.utorrent.com/e?callback=jQuery20309916557603343579_1404290020832&i=ContentBundles&e=eyJzZXF1ZW5jZUlEIjoxLCJ1bmlxdWVJRCI6IjVhY2ZhZWU3LWQ3MzMtNDBmZS05MzdlLWY5OTliNTg3NDZiYiIsInNzYiI6MCwiZXZlbnROYW1lIjoiQ29udGVudEJ1bmRsZXMiLCJhY3Rpb24iOiJJbkNsaWVudF9fSW5zdGFsbFBhdGhfVG9ycmVudERvd25sb2FkLUF0dGVtcHRlZCIsImxhYmVsIjoiUHVibGljVG9ycmVudCIsImNhdGVnb3J5IjoiNzliNWY5MjdjNjhhMGJjN2Y2NDhlMDE2NDA0NzA1YWI0Zjg2NzcyNDAzYmZiZDljMDg5MTk0ZmJlYmUzMDIwMyIsInZhbHVlIjowfQ==&_=1404290020833 107.21.251.25
hxxp://d1mh11hmkkdpin.cloudfront.net/img/logo.2c586cc7a3f8c7e684be335d22b13d8d.png 54.230.230.161
hxxp://ocsp.geotrust.com/MEQwQjBAMD4wPDAJBgUrDgMCGgUABBSxtDkXkBa3l3lQEfFgudSiPNvt7gQUAPkqw0GRtsnCuD5V8sCXEROgByACAwI6Yw== 23.43.139.27
hxxp://www.google-analytics.com/__utm.gif?utmwv=5.5.3&utms=1&utmn=605500297&utmhn=utclient.utorrent.com&utmcs=windows-1252&utmsr=1716x901&utmvp=989x534&utmsc=24-bit&utmul=en-us&utmje=1&utmfl=-&utmhid=1032740853&utmr=-&utmp=/offers/streaming/index.html?port=10627&pair=AAF51F5F564AD28FFCFB5020BDB00283A1ED40A1&frameaddr=68242f8&plus=0&cid=AJ_YwRVi29RbUrz-&code=4&utmht=1404290027768&utmac=UA-41506357-17&utmcc=__utma=132793802.1493147085.1404290028.1404290028.1404290028.1;+__utmz=132793802.1404290028.1.1.utmcsr=(direct)|utmccn=(direct)|utmcmd=(none);&utmu=q~ 173.194.113.201
hxxp://www.google-analytics.com/collect?v=1&_v=j23&a=36551962&t=event&_s=4&dl=http://bundles.bittorrent.com/bundles/79b5f927c68a0bc7f648e016404705ab4f86772403bfbd9c089194fbebe30203?starttime=1393282818000&port=10627&pair=ADFC36D802A98BEB8DDDFD9BE07E8897AB050C2B&frameaddr=38a30e0&download=true&dp=/bundles/79b5f927c68a0bc7f648e016404705ab4f86772403bfbd9c089194fbebe30203&ul=en-us&de=utf-8&dt=Somewhere Else | BitTorrent Bundle&sd=24-bit&sr=1716x901&vp=973x534&je=1&ec=79b5f927c68a0bc7f648e016404705ab4f86772403bfbd9c089194fbebe30203&ea=InClient__InstallPath_Btapp_Download_Success&el=Somewhere Else-N-4e75813dfb7ca48ab329af68fec2bf200eab5504&ev=0&_u=eKAAgIgS~&jid=&cid=f862f0b3-a9cb-437c-941f-9f54e60b13bf&tid=UA-43671923-1&z=476402294 173.194.113.201
hxxp://www.google-analytics.com/collect?v=1&_v=j23&a=36551962&t=pageview&_s=2&dl=http://bundles.bittorrent.com/bundles/79b5f927c68a0bc7f648e016404705ab4f86772403bfbd9c089194fbebe30203?starttime=1393282818000&port=10627&pair=ADFC36D802A98BEB8DDDFD9BE07E8897AB050C2B&frameaddr=38a30e0&download=true&dp=/bundles/79b5f927c68a0bc7f648e016404705ab4f86772403bfbd9c089194fbebe30203&ul=en-us&de=utf-8&dt=Somewhere Else | BitTorrent Bundle&sd=24-bit&sr=1716x901&vp=973x534&je=1&_u=eKAAgIgS~&jid=&cid=f862f0b3-a9cb-437c-941f-9f54e60b13bf&tid=UA-43671923-1&z=628595388 173.194.113.201
hxxp://s3.amazonaws.com/content-bundles/production-df0ec56d-0fbb-bc2c-11e7-354ff3af9c4e/79b5f927c68a0bc7f648e016404705ab4f86772403bfbd9c089194fbebe30203/53a31fb10c56d802001b29ae/Somewhere Else.torrent 54.231.1.136
hxxp://utclient.utorrent.com/offers/streaming/img/devices-02.png 205.251.242.186
hxxp://static.ap.bittorrent.com/Advertisers/a97299ec28da43eba71d3439887cf621.jpg 93.184.220.20
hxxp://bench.utorrent.com/e?i=20 107.21.251.25
hxxp://bench.utorrent.com/e?callback=jQuery20309916557603343579_1404290020844&i=ContentBundles&e=eyJzZXF1ZW5jZUlEIjo1LCJ1bmlxdWVJRCI6IjVhY2ZhZWU3LWQ3MzMtNDBmZS05MzdlLWY5OTliNTg3NDZiYiIsInNzYiI6MCwiZXZlbnROYW1lIjoiQ29udGVudEJ1bmRsZXMiLCJhY3Rpb24iOiJJbkNsaWVudF9fSW5zdGFsbFBhdGhfQ2xpZW50VmVyc2lvbiIsImxhYmVsIjoidVRvcnJlbnRfM180XzFfMzExMDUiLCJjYXRlZ29yeSI6Ijc5YjVmOTI3YzY4YTBiYzdmNjQ4ZTAxNjQwNDcwNWFiNGY4Njc3MjQwM2JmYmQ5YzA4OTE5NGZiZWJlMzAyMDMiLCJ2YWx1ZSI6MH0=&_=1404290020849 107.21.251.25
hxxp://engine.ap.bittorrent.com/i.gif?e=eyJhdiI6NTEzMjAsImF0IjoxMjI0LCJjbSI6MTA1OTgxLCJjaCI6ODc4NSwiY3IiOjM2NTIzOSwiZGkiOiJiZjQzY2NhNmEwMTg0MjQ5OWE1N2RkYTcyMDJlZTU1NyIsImRtIjozLCJmYyI6NDUwODU2LCJmbCI6MjI5OTIwLCJpcCI6IjE5My4xMzguMjQ0LjIzMSIsImt3IjoiY2xpZW50ZGF0YT11dG9ycmVudHwzLjQuMS4zMTEwNXw4MixpZXZlcnNpb249MTAsZmxhc2g9bm9uZSIsIm53Ijo1NjgyLCJwYyI6MC4wMiwicHIiOjIzNzU1LCJydCI6Mywic3QiOjMzMDQ5LCJ1ayI6InVlMS02Y2ZkYmNkY2E0NDY0NDZmYjAxZmQxNDQ4MGRlYjY0YSIsInRzIjoxNDA0MjkwMjc4MDQ1LCJmcSI6MX0&s=H8-CSOgax1FMdCtlLuH8RMCrAWs 50.19.122.136
hxxp://utclient.utorrent.com/offers/streaming/css/styles.css 205.251.242.186
hxxp://gb.symcd.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBQSBA0TLeT5Hrk8v73bcU3oAZux9AQUEUrQcznVW2kIXLo9v2SaqIscVbwCEFCJdZ5K2+b6D313VdV4haw= 23.43.139.27
hxxp://www.mininova.org/favicon.ico 80.94.76.5
hxxp://apps.bittorrent.com/utorrent-onboarding/player.btapp?h=AJ_YwRVi29RbUrz-&v=109279617&ol=en&ul=&tk=beta&c=uTorrent 87.248.217.253
hxxp://engine.ap.bittorrent.com/api/v2 50.19.122.136
hxxp://content.bittorrent.com/inclient/yes?starttime=1393282818000&port=10627&pair=ADFC36D802A98BEB8DDDFD9BE07E8897AB050C2B&frameaddr=38a30e0 23.21.216.68
hxxp://www.google-analytics.com/plugins/ua/ecommerce.js 173.194.113.201
hxxp://bench.utorrent.com/e?callback=jQuery20309916557603343579_1404290020834&i=ContentBundles&e=eyJzZXF1ZW5jZUlEIjoyLCJ1bmlxdWVJRCI6IjVhY2ZhZWU3LWQ3MzMtNDBmZS05MzdlLWY5OTliNTg3NDZiYiIsInNzYiI6MCwiZXZlbnROYW1lIjoiQ29udGVudEJ1bmRsZXMiLCJjYXRlZ29yeSI6IiIsImFjdGlvbiI6InBhZ2V2aWV3IiwibGFiZWwiOiIvYnVuZGxlcy83OWI1ZjkyN2M2OGEwYmM3ZjY0OGUwMTY0MDQ3MDVhYjRmODY3NzI0MDNiZmJkOWMwODkxOTRmYmViZTMwMjAzIn0=&_=1404290020835 107.21.251.25
hxxp://utclient.utorrent.com/offers/streaming/img/other.png 205.251.242.186
hxxp://utclient.utorrent.com/offers/streaming/offer.json?cid=AJ_YwRVi29RbUrz-&cc=82&l=-1 205.251.242.186
hxxp://d1m8s5h8cyrbdy.cloudfront.net/bittorrent/image/upload/f_jpg,w_1440,q_70/content-bundles/production-df0ec56d-0fbb-bc2c-11e7-354ff3af9c4e/53a0fc156e35310200e22f33/oigklpHfR96yCGJVAjuK_Zeds Dead Press Photo 2014.jpg 54.230.230.165
hxxp://engine.ap.bittorrent.com/i.gif?e=eyJhdiI6NTk1OTcsImF0Ijo5LCJjbSI6MTI3Mzg3LCJjaCI6ODc4NSwiY3IiOjM2OTUzMywiZGkiOiIwNDgyZmM0ODllOGI0OGQxOTcwZGU5Zjc0MDE5N2M1ZCIsImRtIjozLCJmYyI6NDU1MTcxLCJmbCI6MjMyOTE2LCJpcCI6IjE5My4xMzguMjQ0LjIzMSIsImt3IjoiY2xpZW50ZGF0YT11dG9ycmVudHwzLjQuMS4zMTEwNXw4MixpZXZlcnNpb249MTAsZmxhc2g9bm9uZSIsIm53Ijo1NjgyLCJwYyI6MC4xLCJwciI6MjM3NTUsInJ0IjozLCJzdCI6MzMwNDksInVrIjoidWUxLTZjZmRiY2RjYTQ0NjQ0NmZiMDFmZDE0NDgwZGViNjRhIiwidHMiOjE0MDQyOTAxOTc3NjIsImZxIjoxfQ&s=_dkqk6fdSoQAgWHd01Qej3p10WE 50.19.122.136
hxxp://crl.microsoft.com/pki/crl/products/WinPCA.crl 188.43.72.241
hxxp://apps.bittorrent.com/utorrent-onboarding/player.btapp 87.248.217.253
hxxp://bench.utorrent.com/e?i=32 107.21.251.25
hxxp://utclient.utorrent.com/offers/streaming/js/client2.js 205.251.242.186
hxxp://bundles.bittorrent.com/api/analytics?action=pageview&label=EmailGatePage&category=79b5f927c68a0bc7f648e016404705ab4f86772403bfbd9c089194fbebe30203&value=0 54.230.229.7
hxxp://d1mh11hmkkdpin.cloudfront.net/javascripts/public/public.b32f033b6c29a80cf06b5ef8d8265b05.gz.js 54.230.230.161
hxxp://utclient.utorrent.com/images/mobile-icon.png 205.251.242.186
hxxp://www.utorrent.com/scripts/dl.php?build=31105&ref=client&client=utorrent&sys_l=en&sel_l=0&tk=beta
hxxp://static.ap.bittorrent.com/Advertisers/39e6df9d0f9745dfa63fdd2cf5602a1a.jpg 93.184.220.20
hxxp://ll.download3.utorrent.com/beta/utorrent.32176.installer.exe?au=1&hash=dd9a941e25f0ad9b3f5562ca0e668f869503b1a4 87.248.217.254
hxxp://www.google-analytics.com/ga.js 173.194.113.201
hxxp://utclient.utorrent.com/offers/streaming/streaming-animation-icon.bmp 205.251.242.186
hxxp://ajax.googleapis.com/ajax/libs/jquery/2.0.3/jquery.min.js 173.194.70.95
hxxp://js-agent.newrelic.com/nr-411.min.js 23.235.43.175
hxxp://bundles.bittorrent.com/api/analytics?action=download&label=PublicTorrent&category=79b5f927c68a0bc7f648e016404705ab4f86772403bfbd9c089194fbebe30203&value=0 54.230.229.7
hxxp://utclient.utorrent.com/offers/streaming/index.html?port=10627&pair=AAF51F5F564AD28FFCFB5020BDB00283A1ED40A1&frameaddr=68242f8&plus=0&cid=AJ_YwRVi29RbUrz-&code=4 205.251.242.186
hxxp://d1mh11hmkkdpin.cloudfront.net/stylesheets/public.6e99eab4adc332040f74e65e06c4942b.gz.css 54.230.230.161
hxxp://bench.utorrent.com/e?callback=jQuery20309916557603343579_1404290020852&i=ContentBundles&e=eyJzZXF1ZW5jZUlEIjo2LCJ1bmlxdWVJRCI6IjVhY2ZhZWU3LWQ3MzMtNDBmZS05MzdlLWY5OTliNTg3NDZiYiIsInNzYiI6MCwiZXZlbnROYW1lIjoiQ29udGVudEJ1bmRsZXMiLCJhY3Rpb24iOiJJbkNsaWVudF9fSW5zdGFsbFBhdGhfUGFnZVZpZXctU3VjY2VlZCIsImxhYmVsIjoiRW1haWxHYXRlUGFnZSIsImNhdGVnb3J5IjoiNzliNWY5MjdjNjhhMGJjN2Y2NDhlMDE2NDA0NzA1YWI0Zjg2NzcyNDAzYmZiZDljMDg5MTk0ZmJlYmUzMDIwMyIsInZhbHVlIjowfQ==&_=1404290020853 107.21.251.25
hxxp://www.google-analytics.com/collect?v=1&_v=j23&a=36551962&t=event&_s=3&dl=http://bundles.bittorrent.com/bundles/79b5f927c68a0bc7f648e016404705ab4f86772403bfbd9c089194fbebe30203?starttime=1393282818000&port=10627&pair=ADFC36D802A98BEB8DDDFD9BE07E8897AB050C2B&frameaddr=38a30e0&download=true&dp=/bundles/79b5f927c68a0bc7f648e016404705ab4f86772403bfbd9c089194fbebe30203&ul=en-us&de=utf-8&dt=Somewhere Else | BitTorrent Bundle&sd=24-bit&sr=1716x901&vp=973x534&je=1&ec=79b5f927c68a0bc7f648e016404705ab4f86772403bfbd9c089194fbebe30203&ea=InClient__InstallPath_IeEngine&el=10.0&ev=10&_u=eKAAgIgS~&jid=&cid=f862f0b3-a9cb-437c-941f-9f54e60b13bf&tid=UA-43671923-1&z=1143596725 173.194.113.201
hxxp://ll.download3.utorrent.com/langpacks/langpack-3063504ut.win.zip 87.248.217.254
hxxp://ll.download3.utorrent.com/offers/ZedsDead_InstallPath.bmp 87.248.217.254
hxxp://download.microsoft.com/download/2/d/6/2d61c766-107b-409d-8fba-c39e61ca08e8/vcredist_x64.exe 212.30.134.183
hxxp://crl.microsoft.com/pki/crl/products/microsoftrootcert.crl 188.43.72.241
hxxp://crl.geotrust.com/crls/secureca.crl 23.43.133.163
hxxp://cdn.mypcbackup.com/MyPCBackup_Setup.exe 108.161.187.46
hxxp://ocsp.verisign.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBRIt2RJ89X++hEzqoBeQg8PymQ2UQQUANhaTCXBIuWLMe9tuvPMXynxDWECECUM6OAwYS6fK4n3BU18+P0= 23.43.139.27
hxxp://bundles.bittorrent.com/ 54.230.229.7
hxxp://utclient.utorrent.com/plus/utorrent/index.html 205.251.242.186
hxxp://www.utorrent.com/download/langpacks/dl.php?build=31105&ref=client&client=utorrent&sys_l=en&sel_l=0&tk=beta
hxxp://themes.googleusercontent.com/static/fonts/opensans/v8/MTP_ySUJH_bn48VBG8sNSnZ2MAKAc2x4R1uOSeegc5U.eot 173.194.113.203
hxxp://bundles.bittorrent.com/inclient/yes?starttime=1393282818000&port=10627&pair=ADFC36D802A98BEB8DDDFD9BE07E8897AB050C2B&frameaddr=38a30e0 54.230.229.7
hxxp://ocsp.verisign.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBS56bKHAoUD+Oyl+0LhPg9JxyQm4gQUf9Nlp8Ld7LvwMAnzQzn6Aq8zMTMCEFIA5aolVvwahu2WydRLM8c= 23.43.139.27
hxxp://media.opencandy.com/templates/3204/3301/30906.png 54.231.2.49
hxxp://apnmedia.ask.com/media/toolbar/everest/partners/BTR-V7/YY/Setup.ini 188.43.72.41
hxxp://www.google-analytics.com/collect?v=1&_v=j23&a=36551962&t=event&_s=1&dl=http://bundles.bittorrent.com/bundles/79b5f927c68a0bc7f648e016404705ab4f86772403bfbd9c089194fbebe30203?starttime=1393282818000&port=10627&pair=ADFC36D802A98BEB8DDDFD9BE07E8897AB050C2B&frameaddr=38a30e0&download=true&ul=en-us&de=utf-8&dt=Somewhere Else | BitTorrent Bundle&sd=24-bit&sr=1716x901&vp=973x534&je=1&ec=79b5f927c68a0bc7f648e016404705ab4f86772403bfbd9c089194fbebe30203&ea=InClient__InstallPath_TorrentDownload-Attempted&el=PublicTorrent&ev=0&_u=OKAAgIgS~&jid=899397547&cid=f862f0b3-a9cb-437c-941f-9f54e60b13bf&tid=UA-43671923-1&z=1077104819 173.194.113.201
hxxp://bundles.bittorrent.com/bundles/79b5f927c68a0bc7f648e016404705ab4f86772403bfbd9c089194fbebe30203?starttime=1393282818000&port=10627&pair=ADFC36D802A98BEB8DDDFD9BE07E8897AB050C2B&frameaddr=38a30e0&download=true 54.230.229.7
hxxp://ll.download3.utorrent.com/offers/APNSetup-en-20140416.exe 87.248.217.254
hxxp://utclient.utorrent.com/offers/streaming/img/paypal.png 205.251.242.186
hxxp://fonts.googleapis.com/css?family=Open Sans|Open Sans Condensed:700 173.194.70.95
hxxp://d1mh11hmkkdpin.cloudfront.net/img/bundle-logo-large.4a053bd30f5bb3329130cf4fc49d0d73.png 54.230.230.161
hxxp://bench.utorrent.com/e?i=29 107.21.251.25
hxxp://themes.googleusercontent.com/static/fonts/opensans/v8/DXI1ORHCpsQm3Vp6mXoaTXZ2MAKAc2x4R1uOSeegc5U.eot 173.194.113.203
hxxp://utclient.utorrent.com/offers/streaming/img/laptop-free.png 205.251.242.186
hxxp://apps.bittorrent.com/utorrent-onboarding/welcome-upsell.btapp 87.248.217.253
hxxp://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBSnR4FoxLLkI7vkvsUIFlZt+lGH3gQUWsS5eyoKo6XqcQPAYPkt9mV1DlgCEAyvGbEyaFTw/abLEQ3zC1w= 93.184.220.29
hxxp://utclient.utorrent.com/offers/streaming/js/main.js 205.251.242.186
hxxp://utclient.utorrent.com/offers/streaming/img/visa-mastercard.png 205.251.242.186
hxxp://www.google-analytics.com/collect?v=1&_v=j23&a=36551962&t=event&_s=5&dl=http://bundles.bittorrent.com/bundles/79b5f927c68a0bc7f648e016404705ab4f86772403bfbd9c089194fbebe30203?starttime=1393282818000&port=10627&pair=ADFC36D802A98BEB8DDDFD9BE07E8897AB050C2B&frameaddr=38a30e0&download=true&dp=/bundles/79b5f927c68a0bc7f648e016404705ab4f86772403bfbd9c089194fbebe30203&ul=en-us&de=utf-8&dt=Somewhere Else | BitTorrent Bundle&sd=24-bit&sr=1716x901&vp=973x534&je=1&ec=79b5f927c68a0bc7f648e016404705ab4f86772403bfbd9c089194fbebe30203&ea=InClient__InstallPath_ClientVersion&el=uTorrent_3_4_1_31105&ev=0&_u=eKAAgIgS~&jid=&cid=f862f0b3-a9cb-437c-941f-9f54e60b13bf&tid=UA-43671923-1&z=787819751 173.194.113.201
hxxp://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBT3xL4LQLXDRDM9P665TW442vrsUQQUReuir/SSy4IxLVGLp6chnfNtyA8CEAQJGBtf1btmdVNDtW+VUAg= 93.184.220.29
hxxp://www.google-analytics.com/analytics.js 173.194.113.201
hxxp://utclient.utorrent.com/offers/streaming/img/ribbon.png 205.251.242.186
hxxp://utclient.utorrent.com/offers/streaming/img/ut-premium-logo.png 205.251.242.186
hxxp://d2eri39gz1mfk5.cloudfront.net/bittorrent/image/upload/f_jpg,w_400,q_70/content-bundles/production-df0ec56d-0fbb-bc2c-11e7-354ff3af9c4e/53a0fc156e35310200e22f33/4nXTCoozQ8OBGW8wolSQ_zd_somewhere_else_final.jpg 54.230.228.233
hxxp://www.google-analytics.com/collect?v=1&_v=j23&a=36551962&t=event&_s=6&dl=http://bundles.bittorrent.com/bundles/79b5f927c68a0bc7f648e016404705ab4f86772403bfbd9c089194fbebe30203?starttime=1393282818000&port=10627&pair=ADFC36D802A98BEB8DDDFD9BE07E8897AB050C2B&frameaddr=38a30e0&download=true&dp=/bundles/79b5f927c68a0bc7f648e016404705ab4f86772403bfbd9c089194fbebe30203&ul=en-us&de=utf-8&dt=Somewhere Else | BitTorrent Bundle&sd=24-bit&sr=1716x901&vp=973x534&je=1&ec=79b5f927c68a0bc7f648e016404705ab4f86772403bfbd9c089194fbebe30203&ea=InClient__InstallPath_PageView-Succeed&el=EmailGatePage&ev=0&_u=eKAAgIgS~&jid=&cid=f862f0b3-a9cb-437c-941f-9f54e60b13bf&tid=UA-43671923-1&z=999524987 173.194.113.201
hxxp://cdn.ap.bittorrent.com/control/tags/ut.json 54.230.229.182
linkmaker.itunes.apple.com 23.215.104.154
stats.g.doubleclick.net 173.194.70.154
router.utorrent.com 82.221.103.244
router.bittorrent.com 67.215.242.138
bam.nr-data.net 50.31.164.165
phn.apnanalytics.com 199.36.100.187
tracker.openbittorrent.com 31.172.63.252


IDS verdicts (Suricata alerts: Emerging Threats ET ruleset)

SURICATA UDPv4 invalid checksum
SURICATA IPv4 invalid checksum
ET P2P BTWebClient UA uTorrent in use
ET MALWARE Adware.iBryte.B Install
ET MALWARE W32/OpenCandy Adware Checkin
ET SHELLCODE Possible TCP x86 JMP to CALL Shellcode Detected
ET P2P BitTorrent DHT ping request
ET P2P possible torrent download
ET P2P BitTorrent - Torrent File Downloaded
ET P2P BitTorrent DHT announce_peers request
ET TROJAN VMProtect Packed Binary Inbound via HTTP - Likely Hostile
GPL P2P BitTorrent announce request
ET P2P Bittorrent P2P Client User-Agent (uTorrent)
ET P2P Vuze BT UDP Connection (5)

Traffic

GET /content-bundles/production-df0ec56d-0fbb-bc2c-11e7-354ff3af9c4e/79b5f927c68a0bc7f648e016404705ab4f86772403bfbd9c089194fbebe30203/originals/Somewhere Else/01 - Zeds Dead (feat. Twin Shadow) - Lost You (Official Music Video).mp4 HTTP/1.1
Host: s3.amazonaws.com
User-Agent: BTWebClient/3410
Connection: keep-alive
Range: bytes=258994434-260043009

GET /content-bundles/production-df0ec56d-0fbb-bc2c-11e7-354ff3af9c4e/79b5f927c68a0bc7f648e016404705ab4f86772403bfbd9c089194fbebe30203/originals/Somewhere Else/01 - Zeds Dead (feat. Twin Shadow) - Lost You (Official Music Video).mp4 HTTP/1.1
Host: s3.amazonaws.com
User-Agent: BTWebClient/3410
Connection: close
Range: bytes=201322754-202371329


HTTP/1.1 403 Forbidden
x-amz-request-id: 4325F5B00667D18D
x-amz-id-2: 9r9ELxI7x0qVEaaPBJcYyc288bDr09wjXL EvEaiHOClf6DulEgKwCmSUMPF33IF
Content-Type: application/xml
Transfer-Encoding: chunked
Date: Wed, 02 Jul 2014 08:34:53 GMT
Server: AmazonS3
e7..<?xml version="1.0" encoding="UTF-8"?>.<Error><Code
>AccessDenied</Code><Message>Access Denied</Message&
gt;<RequestId>4325F5B00667D18D</RequestId><HostId>9r
9ELxI7x0qVEaaPBJcYyc288bDr09wjXL EvEaiHOClf6DulEgKwCmSUMPF33IF</Hos
tId></Error>..0..


GET /MFEwTzBNMEswSTAJBgUrDgMCGgUABBR0JBRnBp/14Jg/Xj4aa6BlKlQVdQQUAVmr5906C1mmZGPWzyAHV9WR52oCEE80nM4VX/CHBW0XphVyXfM= HTTP/1.1
Connection: Keep-Alive
Accept: */*
User-Agent: Microsoft-CryptoAPI/6.1
Host: sr.symcd.com


HTTP/1.1 200 OK
Last-Modified: Mon, 30 Jun 2014 13:26:52 GMT
Expires: Mon, 07 Jul 2014 13:26:52 GMT
Content-Type: application/ocsp-response
content-transfer-encoding: binary
Content-Length: 1636
Cache-Control: max-age=449677, public, no-transform, must-revalidate
Date: Wed, 02 Jul 2014 08:33:43 GMT
Connection: keep-alive
0..`......Y0..U.. .....0.....F0..B0........;091705..U....Symantec Clas
s 3 EV SSL CA - G3 OCSP Responder..20140630132652Z0s0q0I0... ........t
$.g.....?^>.k.e*T.u...Y...:.Y.dc.. .W...j..O4..._...m...r].....2014
0630132652Z....20140707132652Z0...*.H.............0:..'.z...A...r...g.
G..g.%..[...>...z... .J....DF..Z.@=K....H_jF.M.J..=YR.....$md...y..
..z..[......h.'...l........I....yI.7.[%u}J.....".....~.8...9S.w~......
....t.`... ...m}...........Gn..55.1...i.Lc.....<$...~.QtZM........j
K..7..e.5.F"....3...b..U....f......_0..[0..W0..?..........T@.B. ._....
j0...*.H........0w1.0...U....US1.0...U....Symantec Corporation1.0...U.
...Symantec Trust Network1(0&..U....Symantec Class 3 EV SSL CA - G30..
.140515000000Z..140813235959Z091705..U....Symantec Class 3 EV SSL CA -
G3 OCSP Responder0.."0...*.H.............0...........>...#....u7.'
#..9i6MQ...t.|(...Y..&4...K...x...%.Lr....X.p..8w..;....&...Z.p.^1....
..<.S\..f..5.WL..@...A.8.>.D.Y.P.......f..A.. ..t....&M.`.`(.<
;...f.....I.......z.....T...k|......V...c.^.X...5.T.Y,....u..........2
....Z[.6...~....v..8w;6G.0<......'..............0...0... .....0....
..0!..U....0...0.1.0...U....TGV-B-9070...U.#..0....Y...:.Y.dc.. .W...j
0...U.......S@...a..W_.r......v0...U.......0.0n..U. .g0e0c..`.H...E...
.0T0&.. .........hXXp://VVV.symauth.com/cps0*.. .......0... hXXp://ww
w.symauth.com/rpa0...U.%..0... .......0...U...........0...*.H.........
......OY...OG.8b*..5..~t.`.....PS.J.d.M.X=..S.......y.2.3F......w6}...
...*..KRF....~..$IzW4m...U7."...@>._..*dI.....4.......nua.k.*..

<<< skipped >>>

GET /vendor/modernizr.gz.js HTTP/1.1
Accept: */*
Referer: hXXp://bundles.bittorrent.com/bundles/79b5f927c68a0bc7f648e016404705ab4f86772403bfbd9c089194fbebe30203?starttime=1393282818000&port=10627&pair=ADFC36D802A98BEB8DDDFD9BE07E8897AB050C2B&frameaddr=38a30e0&download=true
Accept-Language: en-US
User-Agent: Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1; WOW64; Trident/6.0)
Accept-Encoding: gzip, deflate
Host: d1mh11hmkkdpin.cloudfront.net
Connection: Keep-Alive


HTTP/1.1 200 OK
Content-Type: application/javascript
Content-Length: 4451
Connection: keep-alive
Date: Sat, 21 Jun 2014 02:48:34 GMT
Cache-Control: max-age=31536000
Content-Encoding: gzip
Last-Modified: Thu, 19 Jun 2014 23:38:07 GMT
ETag: "a809d7b93b804d421b662961bc10e83a"
Accept-Ranges: bytes
Server: AmazonS3
Age: 971106
X-Cache: Hit from cloudfront
Via: 1.1 d84cd5311ccca1f37f90f1eed9f01585.cloudfront.net (CloudFront)
X-Amz-Cf-Id: MbG8yK8ZxsPqIGe61-lT7KI0c3HXRpq2ufOmx22YXgWwKpwT2nphJg==
...........Z[s.H.~._....Fi,Wu.D....ug:....{.A..@.HYF@..e.....Nr.......
.@..<y..9p.W.*.D....../.....R&.kU..?o......_...O}k.u._\..Y^../.l.&Y
.].8..:_d.J~........0H..u.V........Y..J.u.."..":.B. I."...L.R....TI-.T
........;W.....d....2...lx.qx\.!.:.i.............x.\...;.u..........-.
XgdOlw....m..O.|0Mos......=..>.`.?.m....i..%vto./5i...}PX.%S.....bV
.'2v.o...s.......8O.....<~.....w.......D.......z&...D..-p........bv
...N...I.......{..j..../\..[..]Og...(..J8.Hx*..p.]&9...Gy-..n.Q.z*O.v.
n.0........l...m...2.....i.5.[3z~MvE.`......(=c.{.J{J.c..z.H.z5)..I1..
.Y.}.9.B.I...K....S_..@{a!.->&b-R0..p.............<..g....;..J..
..Dha.M....h..'A(VY..........2...V.h-H...R."..........f......q...S|0f.
.^.m....Vr...6....J..<...&.%O.m#\H?..0...L.........T../.Z.,...."...
s.i..?x...(|..[.......by.j<._`...5.lI?[.Y...m..6E.....I..&.ga..Y...
.O.c....Y.%....D4.....A..?..`.c...d"......[:.d..T...r.C...^.WJ....9q..
..................:c%;..:c..o...O..v..tA...YMC?.h....q....6.q..r.Z..".
..E...6..<..E.'... .E".a....;~.'..v.].V.:!..{.z.!.s........3.l=3..O
.K\6..;......."p.....D$.......I.]..95.P..F.2n..?.D.(..~.....4.yVg:...*
KJ-&......H...-.~...EtC.O.. ..e..>..,....;..M.9.D...sY.c..{.@}.._..
E...z2.....SD$<.Bd..0{}.u..X..G;...m..p.d.L."......p@g.Sgz~...}j...
.4.3|f..B.J*R\......5.*.....u...E......>QP,M.T...ny$.,..q(..4....!.
d.....{.N.dL{....L?."...J...c.\.../.o".N."eg....V....ev.:.V..j....>
...T.vI...1.T.g.Yl........!.......c...9....,.:....e..-......~M.-).M...
eY".J.,......9gf...L..q$T.....T....br.s.[...`.<So..>Z.f.b..%

<<< skipped >>>

GET /javascripts/public/public.b32f033b6c29a80cf06b5ef8d8265b05.gz.js HTTP/1.1

Accept: */*
Referer: hXXp://bundles.bittorrent.com/bundles/79b5f927c68a0bc7f648e016404705ab4f86772403bfbd9c089194fbebe30203?starttime=1393282818000&port=10627&pair=ADFC36D802A98BEB8DDDFD9BE07E8897AB050C2B&frameaddr=38a30e0&download=true
Accept-Language: en-US
User-Agent: Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1; WOW64; Trident/6.0)
Accept-Encoding: gzip, deflate
Host: d1mh11hmkkdpin.cloudfront.net
Connection: Keep-Alive


HTTP/1.1 200 OK
Content-Type: application/javascript
Content-Length: 48179
Connection: keep-alive
Date: Wed, 25 Jun 2014 19:24:07 GMT
Cache-Control: max-age=31536000
Content-Encoding: gzip
Last-Modified: Wed, 25 Jun 2014 19:22:51 GMT
ETag: "9c215867800bed4fd5696565d0ce8409"
Accept-Ranges: bytes
Server: AmazonS3
Age: 565774
X-Cache: Hit from cloudfront
Via: 1.1 d84cd5311ccca1f37f90f1eed9f01585.cloudfront.net (CloudFront)
X-Amz-Cf-Id: t2be2lEKUG1D6SuXW3hDi54WTU4QhafwenU13g6iMFxN8fO3RE3GBA==
............y_.H.8...U.m.H.,..SD.!...!..d.3......D.<..a...SU}.u....
...bI}wW..]...13.$.&~......h....O.Q.gI.......%..M......^....~.Cf#O...y
g....ru..4*..d...0.../.Q.&..............V..4..y.......yj.c.b..X;)..i..
..g...........=.......G...........k.....S..I1....N..,5-;....].....E...
.l..........0..K.Ip..0.........2...f.<..%#.......vl.*.4.;.4........
.O*.k.].TON..g........rh......w2......k.qC5b.B/.<PFv"..j......6....
..!..!........a.....J....r.{.k=....@..W..H..../>............. ...8.
i....*....54.8..E,g.`W.X.:.....j.K....|....`...d...a9.<.s....I.l../
.F2...9c..w.....aG.#*ps..qC....5.Ayx8G7oy....ha..B..-.E0..u/#?.L#.;!{j
X.....x.......f.(......Lfs...b..e h.8d....'MK.K............n...;.s..j.
\.K...-&....0U...%.,5;..).}}....(................?.9s..(b~._fv....,f.?
$X.."."..Fa.Mf.d...@......d...b..B..8...} &:./F?.3....U.....]...v....*
.`.'a..........0.......".a..d...:=....VV..V._.47V...@B...m<N.......
.N....c...K'.h.-AZ.o{>.r....m.....%p.m... .h..F=Cvx.4~..?...b\.....
v..'F86....>....}.....0=..17r.$.......LR.f....N.....f.\.<.K..M.:
.X6v.....x.y({4.[c...ir..n...........e.b].i Y.2....q.E..a.X\...Q......
..}.v.................0....B..XL...5B.hL..a.<..a.......g..D... ....
>.....,.a...6*.p..X../......8.0.X..k... 5...m...Y8...._.......6.og.
`dw..!..1..J.F.G..z.=s..........!..$..)..4&.SBH...V.O..3..E...u...r...
..].....g........8...7.w......?....;5..N.@C|.....;.cC7P.........d.b`b.
.0.2`_a*.....9;.6.f.9.u<.u..,..,e.;Pn..S.'..iw`..4.\..,..)X....;.dr
1......Af(.5....v..H6...o9"..............V..pNMqn..8e.5...N.E3..n.

<<< skipped >>>

GET /checkupdate.php?s=1&cl=uTorrent&v=109279617&l=en&svp=4&svn_revno=31105&tk=beta&period=7&sids=0,0,0,0,0&lv=0_0_&c=US&w=1DB10106&t=3&h=AJ_YwRVi29RbUrz-&mts=31&gnc=1&nat_state=255&it=11&pc=21&sctl=1&shdi=1&xai=1&def_tor=1&w64=1&doainstalled=0&ie=9.10.9200.16521&xim=3&insvr=109279617&sss=1&rsb=2&rtsb=1&view=win32&cmp=82&ocmp=82&plus=3&pupsell=1&secp=AdKnowledge&secres=1&adc=1&ch_up=1?fg=1000&mt=1752&ssb=108&ssu=11644473707&xseq=0 HTTP/1.1
Host: update.utorrent.com
User-Agent: BTWebClient/3410(31105)
Accept-Encoding: gzip
Connection: Close


HTTP/1.1 200 OK
Server: nginx/1.4.7
Date: Wed, 02 Jul 2014 08:33:33 GMT
Content-Type: text/html
Content-Length: 2182
Connection: close
X-Powered-By: PHP/5.4.30
Expires: Thu, 21 Jul 1980 00:00:00 GMT
Cache-Control: private
Last-Modified: Wed, 02 Jul 2014 08:33:33 GMT
d5:u.url117:hXXp://ll.download3.utorrent.com/beta/utorrent.32176.insta
ller.exe?au=1&hash=dd9a941e25f0ad9b3f5562ca0e668f869503b1a45:u.sizi133
8704e5:u.veri109346224e5:u.sha20:....%...?Ub..f......5:u.sig256:..`.f.
7..`..=W.!.`...6,.(.....kUx..V.x:..._O.A..F.'...#.4....t.f_.....Z..=9.
......xJ.~>.RM.G.]..|t....-.........@...7.4...a.L.B..e.?...@.|A..[.
..5/...N..R .....$.....7..G.Zm........(..p...2...v.%........^.}g...E..
N2...).1.J.....O........-....E...j ..c|....5:l.url69:hXXp://ll.downloa
d3.utorrent.com/langpacks/langpack-3063504ut.win.zip5:l.sizi1315367e5:
l.veri3063504e5:l.sha20:d.\/f.....E9....S..L5:l.sig256:.........M..c.\
...K.~..7......%V.-8RE.S...].HE......e./.....ye<.\rZ,. ..~;.4..=..&
gt;.K...y....cA...v.s....iM.......D....Zy...NKt.i....x......g"..j.....
....O..-...c$<..D.$..XfY....CN...U.^./[.'8.."..........<..a.v{P.
|.g..VT.. .....E......x^"b..z.4...D..M..E.55:u.msg555:A new beta versi
on of ..Torrent 3.4.2 (build 32176) is available. Would you like to do
wnload and install it?..New in this version:..- Fixed RSS Bug..<a h
ref="hXXp://forum.utorrent.com/topic/88339-341-beta/">Click here to
view the complete list of changes in this release.</a>..By clic
king "Yes", you acknowledge that you have read and agree to the <a
href="hXXp://VVV.bittorrent.com/legal/eula">End User License Agreem
ent</a> and <a href="hXXp://VVV.bittorrent.com/legal/privacy"
>Privacy Policy</a>...This will also download the latest tran
slations.4:u.bvli28762ee6:silenti1e17:showupdatescreensi-1e10:adsE

<<< skipped >>>

GET /download/2/d/6/2d61c766-107b-409d-8fba-c39e61ca08e8/vcredist_x64.exe HTTP/1.0
Host: download.microsoft.com
User-Agent: NSISDL/1.2 (Mozilla)
Accept: */*


HTTP/1.0 200 OK
Content-Type: application/octet-stream
Last-Modified: Fri, 08 Aug 2008 21:48:10 GMT
Accept-Ranges: bytes
ETag: "df115773a0f9c81:0"
Server: Microsoft-IIS/8.5
Content-Disposition: attachment
Content-Length: 4961800
Date: Wed, 02 Jul 2014 08:33:54 GMT
Connection: close
MZ......................@.............................................
..!..L.!This program cannot be run in DOS mode....$...........K...K...
K.......D...K... ......._.......J.......J...RichK...........PE..L...{.
.B.................z..........rY... ........... ......................
........9.L.......... ..........................@...........t.........
....K..$...........!............................................... ..
.............................text....x... ...z.................. ..`.d
ata................~..............@....rsrc...t.........K.............
....@..@..............................................................
......................................................................
......................................................................
......................................................................
......................................................................
......................................................................
....................................................t...Z.............
......&...<...L............................................... ...:
...J...V...^...x.......................................&...<...J...
^...t.......................................(...:...R...b...p.........
..........................&...N...b...|...............r.......\...L...
:...,...........................................~...f.................
......z...............................&...0...D...:...............:...
........$...................{..B.............&..................Z.

<<< skipped >>>

POST /e?i=20 HTTP/1.1
Host: bench.utorrent.com
User-Agent: BTWebClient/3410(31105)
Accept-Encoding: gzip
Connection: Close
Content-Length: 293

{"h":"AJ_YwRVi29RbUrz-","cl":"uTorrent","v":109279617,"l":"en","w":"6.1","cts":1404290020,"eventName":"ap","fte":1,"lre":1,"ltic_0":0,"ltic_1":0,"lcic_0":0,"lcic_1":0,"laae":0,"lare":0,"laie":0,"lame":0,"name":"adrequest","errCode":0,"requestTime":1404290020,"action":"client.az.adrequest.ua"}
HTTP/1.1 200 OK
Content-Type: text/html
Date: Wed, 02 Jul 2014 08:33:49 GMT
Server: nginx/1.4.7
X-Powered-By: PHP/5.4.30
Content-Length: 21
Connection: Close
{"response_code":200}..


GET /ocsp/MEkwRzBFMEMwQTAJBgUrDgMCGgUABBTy4Gr5hYodjXCbSRkjeqm1Gih+ZAQUSt0GFhu89mi1dvWBtrtiGrpagS8CCEvtXZfXAf64 HTTP/1.1
Connection: Keep-Alive
Accept: */*
User-Agent: Microsoft-CryptoAPI/6.1
Host: clients1.google.com


HTTP/1.1 200 OK
Content-Type: application/ocsp-response
Date: Sun, 29 Jun 2014 10:52:51 GMT
Expires: Thu, 03 Jul 2014 10:52:51 GMT
Server: ocsp_responder
Content-Length: 463
X-XSS-Protection: 1; mode=block
X-Frame-Options: SAMEORIGIN
Cache-Control: public, max-age=345600
Age: 250853
Alternate-Protocol: 80:quic
0..........0..... .....0......0...0......J......h.v....b..Z./..2014062
9010613Z0k0i0A0... ..........j.....p.I.#z...(~d..J......h.v....b..Z./.
.K.].........20140629010613Z....20140706010613Z0...*.H.............4M.
.5.....$..s..`..$..'.8.c ;.uR....G.Yq..FO...y;,*...B2@.?...........R..
......$r....-.t. Dy..K:.f.y`.......>/..?|.=.g....I.X....7.L.... ..M
.....U....G........f.{M{... `..*..... ....Z^.>.9..odF.4..wU...^.;..
..}.5*$....*..y.]..7.,..1..!................u$s.>HTTP/1.1 200 OK..C
ontent-Type: application/ocsp-response..Date: Sun, 29 Jun 2014 10:52:5
1 GMT..Expires: Thu, 03 Jul 2014 10:52:51 GMT..Server: ocsp_responder.
.Content-Length: 463..X-XSS-Protection: 1; mode=block..X-Frame-Options
: SAMEORIGIN..Cache-Control: public, max-age=345600..Age: 250853..Alte
rnate-Protocol: 80:quic..0..........0..... .....0......0...0......J...
...h.v....b..Z./..20140629010613Z0k0i0A0... ..........j.....p.I.#z...(
~d..J......h.v....b..Z./..K.].........20140629010613Z....2014070601061
3Z0...*.H.............4M..5.....$..s..`..$..'.8.c ;.uR....G.Yq..FO...y
;,*...B2@.?...........R........$r....-.t. Dy..K:.f.y`.......>/..?|.
=.g....I.X....7.L.... ..M.....U....G........f.{M{... `..*..... ....Z^.
>.9..odF.4..wU...^.;....}.5*$....*..y.]..7.,..1..!................u
$s.>..

<<< skipped >>>

GET /utorrent-onboarding/player.btapp?h=AJ_YwRVi29RbUrz-&v=109279617&ol=en&ul=&tk=beta&c=uTorrent HTTP/1.1
Host: apps.bittorrent.com
User-Agent: BTWebClient/3410(31105)
Accept-Encoding: gzip
If-Modified-Since: Tue, 08 Oct 2013 00:53:35 GMT
Connection: Close


HTTP/1.1 304 Not Modified
Content-Type: binary/octet-stream
Age: 50210
Date: Wed, 02 Jul 2014 08:33:40 GMT
Connection: close


POST /api/v2 HTTP/1.1
Host: engine.ap.bittorrent.com
User-Agent: Mozilla/5.0 (compatible; MSIE 10.0 Windows NT 6.1; WOW64; Trident/6.0; EIE10; ENUSMSN)(31105)
Accept-Encoding: gzip
content-type: application/json
Connection: Close
Content-Length: 421

{ "keywords": [ "clientdata=utorrent|3.4.1.31105|82", "IEVersion=10", "flash=none" ], "placements": [ { "adTypes": [ 1224 ], "divName": "ft", "networkId": 5682, "properties": { "IEVersion": 10, "campaigncode": 82, "featurelevel": 0, "flash": "none", "major": 3, "minor": 4, "product": "utorrent", "tag": "", "tiny": 1, "version": 31105 }, "siteId": "33049" } ], "user": { "key": "ue1-6cfdbcdca446446fb01fd14480deb64a" } }
HTTP/1.1 200 OK
Access-Control-Allow-Headers: accept, origin, content-type, content-length
Access-Control-Allow-Methods: GET,PUT,POST,DELETE,OPTIONS
Access-Control-Allow-Origin: *
Content-Type: application/json
Date: Wed, 02 Jul 2014 08:37:58 GMT
ETag: "1063649004"
Server: nginx/1.1.19
Set-Cookie: azk=ue1-6cfdbcdca446446fb01fd14480deb64a; Path=/; Expires=Thu, 02 Jul 2015 08:37:58 GMT
x-powered-by: adzerk bifrost/
x-served-by: engine-us-east-1a-04
Content-Length: 2299
Connection: Close
{"user":{"key":"ue1-6cfdbcdca446446fb01fd14480deb64a"},"decisions":{"f
t":{"adId":450856,"creativeId":365239,"flightId":229920,"campaignId":1
05981,"clickUrl":"hXXp://engine.ap.bittorrent.com/r?e=eyJhdiI6NTEzMjAs
ImF0IjoxMjI0LCJjbSI6MTA1OTgxLCJjaCI6ODc4NSwiY3IiOjM2NTIzOSwiZGkiOiJiZj
QzY2NhNmEwMTg0MjQ5OWE1N2RkYTcyMDJlZTU1NyIsImRtIjozLCJmYyI6NDUwODU2LCJm
bCI6MjI5OTIwLCJpcCI6IjE5My4xMzguMjQ0LjIzMSIsImt3IjoiY2xpZW50ZGF0YT11dG
9ycmVudHwzLjQuMS4zMTEwNXw4MixpZXZlcnNpb249MTAsZmxhc2g9bm9uZSIsIm53Ijo1
NjgyLCJwYyI6MC4wMiwicHIiOjIzNzU1LCJydCI6Mywic3QiOjMzMDQ5LCJ1ayI6InVlMS
02Y2ZkYmNkY2E0NDY0NDZmYjAxZmQxNDQ4MGRlYjY0YSIsInRzIjoxNDA0MjkwMjc4MDQ1
LCJ1ciI6Imh0dHA6Ly93d3cucm91bGV0dGVib3QtcGx1cy5jb20vM2EwYTEubHAifQ&s=t
-EPls7bFRnkiwc3j3aRIi8fxzI","impressionUrl":"hXXp://engine.ap.bittorre
nt.com/i.gif?e=eyJhdiI6NTEzMjAsImF0IjoxMjI0LCJjbSI6MTA1OTgxLCJjaCI6ODc
4NSwiY3IiOjM2NTIzOSwiZGkiOiJiZjQzY2NhNmEwMTg0MjQ5OWE1N2RkYTcyMDJlZTU1N
yIsImRtIjozLCJmYyI6NDUwODU2LCJmbCI6MjI5OTIwLCJpcCI6IjE5My4xMzguMjQ0LjI
zMSIsImt3IjoiY2xpZW50ZGF0YT11dG9ycmVudHwzLjQuMS4zMTEwNXw4MixpZXZlcnNpb
249MTAsZmxhc2g9bm9uZSIsIm53Ijo1NjgyLCJwYyI6MC4wMiwicHIiOjIzNzU1LCJydCI
6Mywic3QiOjMzMDQ5LCJ1ayI6InVlMS02Y2ZkYmNkY2E0NDY0NDZmYjAxZmQxNDQ4MGRlY
jY0YSIsInRzIjoxNDA0MjkwMjc4MDQ1LCJmcSI6MX0&s=H8-CSOgax1FMdCtlLuH8RMCrA
Ws","contents":[{"type":"html","body":"<a href=\"hXXp://engine.ap.b
ittorrent.com/r?e=eyJhdiI6NTEzMjAsImF0IjoxMjI0LCJjbSI6MTA1OTgxLCJjaCI6
ODc4NSwiY3IiOjM2NTIzOSwiZGkiOiJiZjQzY2NhNmEwMTg0MjQ5OWE1N2RkYTcyMDJlZT
U1NyIsImRtIjozLCJmYyI6NDUwODU2LCJmbCI6MjI5OTIwLCJpcCI6IjE5My4xMzgu

<<< skipped >>>

GET /installstats.php?cl=uTorrent&v=109279617&h=AJ_YwRVi29RbUrz-&w=1DB10106&bu=0&pr=0&cmp=82&ocmp=82&gettbinstallresult&pid=1224&cau=0&tbinstallresult=3&cbsearch=1&cbhomepage=1&error=0&msg=&tb=ask-surf&url=http://ll.download3.utorrent.com/offers/APNSetup-en-20140416.exe&prog=100&t=&view=win32 HTTP/1.1
Accept-Encoding: gzip
User-Agent: uTorrent(31105)/3.4.1
Host: update.utorrent.com
Cache-Control: no-cache


HTTP/1.1 200 OK
Server: nginx/1.4.7
Date: Wed, 02 Jul 2014 08:33:45 GMT
Content-Type: text/html
Transfer-Encoding: chunked
Connection: close
X-Powered-By: PHP/5.4.30
0..


GET /ga.js HTTP/1.1
Accept: */*
Referer: hXXp://utclient.utorrent.com/offers/streaming/index.html?port=10627&pair=AAF51F5F564AD28FFCFB5020BDB00283A1ED40A1&frameaddr=68242f8&plus=0&cid=AJ_YwRVi29RbUrz-&code=4
Accept-Language: en-US
User-Agent: Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1; WOW64; Trident/6.0)
Accept-Encoding: gzip, deflate
Host: VVV.google-analytics.com
Connection: Keep-Alive


HTTP/1.1 200 OK
Date: Wed, 02 Jul 2014 01:08:12 GMT
Expires: Wed, 02 Jul 2014 13:08:12 GMT
Last-Modified: Tue, 17 Jun 2014 01:05:58 GMT
X-Content-Type-Options: nosniff
Content-Type: text/javascript
Vary: Accept-Encoding
Content-Encoding: gzip
Server: Golfe2
Content-Length: 15810
Age: 26736
Cache-Control: public, max-age=43200
Alternate-Protocol: 80:quic
...........}kW.:..w~....c...pk..f..-mii..%...e9..q.........$[NB.s.Y...
......h43v..Pd.d.z..|..y ."........(..a.B........1..Tf..K.L2....~...ep
...&y....MS...t9.....&..2... .Q.N.(o....8..q..L.!...a..0...$.pX..N&..a
. ..zB:l.8c9.p.....;l..x.$c.]BP\.....B...&..*pz.H.~......g...Ap..!....
K......V;l.H.....V.a.....s.$p....5.39...a.a7P'9.b.[H>N.$..A..... ..
^..;h.h...2l_......w9..d.@.`...N.....|....%.d.%........{.....&.A.I..:.
...F.;..c..{P*..~..JzP.Kl...F..y.U8(&.......}.BH@..ZC...Ty. u.Y...!..R
.h.F..`./>5...*{P..(..:A.}..v.} ..u...k......w\..d....he.q..U.u..yE
..J.Re.....Y.2!.J.a..i^R....p..LG4.d.6U..........E..%..5.kz<....[..
!2o.tV.V.....|..p7o..?N&..].o>.|...../..a.\...vL3].._....q.....C.].
JG..\.[9...hp....w.Y^1..>..`..Q..!w0.U..}x.;^.......w.I............
....R..aQ2R..<..%....A%|.E...j...L..j..\.\.D.<.g....^Y)...L.*D..
......2....-..%F.T..j..,F...C.....m_.$..2..2.g...B.{.....\c......*5..c
..J.{@...Q.....j..........E..Z...#>.....>...g{...t.....i1..Yk..@
m..v.Cf..)..7.....(.......$\.S.......>......a..r..N. ........o;>
...A..>...U...J'.....X....B.q..E....()..3. .... A".uss.;.......W...
..k-..zF.\`Qp?........\d..a..A.1....5......Z.H...M"tf.GM. .X[.YU...T..
_.lH......n@=1.5N....?Z...V>&."..Q$.....&.sS..Kq....].UySz=..3..$."
....".'.Iar\Y.WVt\....;k..h._.O..b...2....G=H9@...v0l)2!..xD7...T..Di.
v.RC`.m.8.\....J....h..uss.....p..)..O3.W....5....k...y.`^ ....&1..f".
.D.w.}.;D:d.F....p#... ......d...T..iU7n.;-hh..T..^P....U.....>...T
..m.^..fM....>..>d..Q..!....P1......7L...[.........;.>_W.

<<< skipped >>>

GET /__utm.gif?utmwv=5.5.3&utms=1&utmn=605500297&utmhn=utclient.utorrent.com&utmcs=windows-1252&utmsr=1716x901&utmvp=989x534&utmsc=24-bit&utmul=en-us&utmje=1&utmfl=-&utmhid=1032740853&utmr=-&utmp=/offers/streaming/index.html?port=10627&pair=AAF51F5F564AD28FFCFB5020BDB00283A1ED40A1&frameaddr=68242f8&plus=0&cid=AJ_YwRVi29RbUrz-&code=4&utmht=1404290027768&utmac=UA-41506357-17&utmcc=__utma=132793802.1493147085.1404290028.1404290028.1404290028.1;+__utmz=132793802.1404290028.1.1.utmcsr=(direct)|utmccn=(direct)|utmcmd=(none);&utmu=q~ HTTP/1.1

Accept: */*
Referer: hXXp://utclient.utorrent.com/offers/streaming/index.html?port=10627&pair=AAF51F5F564AD28FFCFB5020BDB00283A1ED40A1&frameaddr=68242f8&plus=0&cid=AJ_YwRVi29RbUrz-&code=4
Accept-Language: en-US
User-Agent: Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1; WOW64; Trident/6.0)
Accept-Encoding: gzip, deflate
Host: VVV.google-analytics.com
Connection: Keep-Alive


HTTP/1.1 200 OK
Pragma: no-cache
Expires: Wed, 19 Apr 2000 11:43:00 GMT
Last-Modified: Wed, 21 Jan 2004 19:51:30 GMT
X-Content-Type-Options: nosniff
Content-Type: image/gif
Date: Fri, 20 Jun 2014 03:06:21 GMT
Server: Golfe2
Content-Length: 35
Age: 1056447
Cache-Control: private, no-cache, no-cache=Set-Cookie, proxy-revalidate
Alternate-Protocol: 80:quic
GIF89a.............,...........D..;HTTP/1.1 200 OK..Pragma: no-cache..
Expires: Wed, 19 Apr 2000 11:43:00 GMT..Last-Modified: Wed, 21 Jan 200
4 19:51:30 GMT..X-Content-Type-Options: nosniff..Content-Type: image/g
if..Date: Fri, 20 Jun 2014 03:06:21 GMT..Server: Golfe2..Content-Lengt
h: 35..Age: 1056447..Cache-Control: private, no-cache, no-cache=Set-Co
okie, proxy-revalidate..Alternate-Protocol: 80:quic..GIF89a...........
..,...........D..;..


GET /e?callback=jQuery20309916557603343579_1404290020832&i=ContentBundles&e=eyJzZXF1ZW5jZUlEIjoxLCJ1bmlxdWVJRCI6IjVhY2ZhZWU3LWQ3MzMtNDBmZS05MzdlLWY5OTliNTg3NDZiYiIsInNzYiI6MCwiZXZlbnROYW1lIjoiQ29udGVudEJ1bmRsZXMiLCJhY3Rpb24iOiJJbkNsaWVudF9fSW5zdGFsbFBhdGhfVG9ycmVudERvd25sb2FkLUF0dGVtcHRlZCIsImxhYmVsIjoiUHVibGljVG9ycmVudCIsImNhdGVnb3J5IjoiNzliNWY5MjdjNjhhMGJjN2Y2NDhlMDE2NDA0NzA1YWI0Zjg2NzcyNDAzYmZiZDljMDg5MTk0ZmJlYmUzMDIwMyIsInZhbHVlIjowfQ==&_=1404290020833 HTTP/1.1
Accept: */*
Referer: hXXp://bundles.bittorrent.com/bundles/79b5f927c68a0bc7f648e016404705ab4f86772403bfbd9c089194fbebe30203?starttime=1393282818000&port=10627&pair=ADFC36D802A98BEB8DDDFD9BE07E8897AB050C2B&frameaddr=38a30e0&download=true
Accept-Language: en-US
User-Agent: Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1; WOW64; Trident/6.0)
Accept-Encoding: gzip, deflate
Host: bench.utorrent.com
Connection: Keep-Alive


HTTP/1.1 200 OK
Content-Type: text/html
Date: Wed, 02 Jul 2014 08:33:48 GMT
Server: nginx/1.4.7
X-Powered-By: PHP/5.4.30
Content-Length: 63
Connection: keep-alive
jQuery20309916557603343579_1404290020832({"response_code":200})
....



GET /e?callback=jQuery20309916557603343579_1404290020840&i=ContentBundles&e=eyJzZXF1ZW5jZUlEIjozLCJ1bmlxdWVJRCI6IjVhY2ZhZWU3LWQ3MzMtNDBmZS05MzdlLWY5OTliNTg3NDZiYiIsInNzYiI6MCwiZXZlbnROYW1lIjoiQ29udGVudEJ1bmRsZXMiLCJhY3Rpb24iOiJJbkNsaWVudF9fSW5zdGFsbFBhdGhfSWVFbmdpbmUiLCJsYWJlbCI6IjEwLjAiLCJ2YWx1ZSI6MTAsImNhdGVnb3J5IjoiNzliNWY5MjdjNjhhMGJjN2Y2NDhlMDE2NDA0NzA1YWI0Zjg2NzcyNDAzYmZiZDljMDg5MTk0ZmJlYmUzMDIwMyJ9&_=1404290020841 HTTP/1.1

Accept: */*
Referer: hXXp://bundles.bittorrent.com/bundles/79b5f927c68a0bc7f648e016404705ab4f86772403bfbd9c089194fbebe30203?starttime=1393282818000&port=10627&pair=ADFC36D802A98BEB8DDDFD9BE07E8897AB050C2B&frameaddr=38a30e0&download=true
Accept-Language: en-US
User-Agent: Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1; WOW64; Trident/6.0)
Accept-Encoding: gzip, deflate
Host: bench.utorrent.com
Connection: Keep-Alive


HTTP/1.1 200 OK
Content-Type: text/html
Date: Wed, 02 Jul 2014 08:33:48 GMT
Server: nginx/1.4.7
X-Powered-By: PHP/5.4.30
Content-Length: 63
Connection: keep-alive
jQuery20309916557603343579_1404290020840({"response_code":200})
....



GET /e?callback=jQuery20309916557603343579_1404290020844&i=ContentBundles&e=eyJzZXF1ZW5jZUlEIjo1LCJ1bmlxdWVJRCI6IjVhY2ZhZWU3LWQ3MzMtNDBmZS05MzdlLWY5OTliNTg3NDZiYiIsInNzYiI6MCwiZXZlbnROYW1lIjoiQ29udGVudEJ1bmRsZXMiLCJhY3Rpb24iOiJJbkNsaWVudF9fSW5zdGFsbFBhdGhfQ2xpZW50VmVyc2lvbiIsImxhYmVsIjoidVRvcnJlbnRfM180XzFfMzExMDUiLCJjYXRlZ29yeSI6Ijc5YjVmOTI3YzY4YTBiYzdmNjQ4ZTAxNjQwNDcwNWFiNGY4Njc3MjQwM2JmYmQ5YzA4OTE5NGZiZWJlMzAyMDMiLCJ2YWx1ZSI6MH0=&_=1404290020849 HTTP/1.1

Accept: */*
Referer: hXXp://bundles.bittorrent.com/bundles/79b5f927c68a0bc7f648e016404705ab4f86772403bfbd9c089194fbebe30203?starttime=1393282818000&port=10627&pair=ADFC36D802A98BEB8DDDFD9BE07E8897AB050C2B&frameaddr=38a30e0&download=true
Accept-Language: en-US
User-Agent: Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1; WOW64; Trident/6.0)
Accept-Encoding: gzip, deflate
Host: bench.utorrent.com
Connection: Keep-Alive


HTTP/1.1 200 OK
Content-Type: text/html
Date: Wed, 02 Jul 2014 08:33:46 GMT
Server: nginx/1.4.7
X-Powered-By: PHP/5.4.30
Content-Length: 63
Connection: keep-alive
jQuery20309916557603343579_1404290020844({"response_code":200})HTTP/1.
1 200 OK..Content-Type: text/html..Date: Wed, 02 Jul 2014 08:33:46 GMT
..Server: nginx/1.4.7..X-Powered-By: PHP/5.4.30..Content-Length: 63..C
onnection: keep-alive..jQuery20309916557603343579_1404290020844({"resp
onse_code":200})..


GET /offers/APNSetup-en-20140416.exe HTTP/1.1
Host: ll.download3.utorrent.com
User-Agent: BTWebClient/3410(31105)
Accept-Encoding: gzip
Connection: Close


HTTP/1.1 200 OK
Server: nginx/1.4.7
Content-Type: application/octet-stream
Cache-Control: max-age=14400
Accept-Ranges: bytes
Age: 10510
Date: Wed, 02 Jul 2014 08:33:36 GMT
Last-Modified: Thu, 01 May 2014 00:10:04 GMT
Expires: Wed, 02 Jul 2014 09:38:26 GMT
Content-Length: 522704
Connection: close
MZ......................@.............................................
..!..L.!This program cannot be run in DOS mode....$........*...K...K..
.K.......K...3...K...38..K...3?..K....?..K.......K...K...I...31..K....
/..K...3*..K..Rich.K..................PE..L....j4S....................
.L....................@..........................p......l.....@.......
...................................p...[.......................K.. ...
............................0?..@...............t...x...@.............
.......text............................... ..`.rdata..40.......2......
............@..@.data...@........(..................@....rsrc....[...p
...\..................@..@.reloc...............J..............@..B....
......................................................................
......................................................................
......................................................................
......................................................................
............................................j.h.bE.d.....PV...F.3.P.D$
.d......t$..D$......D$....P....E..P.......F..D$...D$$...P.8....L$(...j
.j.....F..D$,j.j.Q.F..F......F.........E..F...u...`.E..F..D$...D$.....
P........I........P.B....D$......D$ ....H........J........P.B......L$.
d......Y^...........V........D$..t.V..........^.....V...F.....E...t.P.
...E..F.....H........J........P.B....F.....H........J^........P.B.....
........j.h.sE.d.....P..B....(.....F.3...$.B..SUVW...F.3.P..$.B..d....
...$.B.....D$..F..D$...3.;.......j8.L$<SQ.T...h......$....3.SPf

<<< skipped >>>

GET /offers/streaming/streaming-animation-icon.bmp HTTP/1.1
Host: utclient.utorrent.com
User-Agent: BTWebClient/3410(31105)
Accept-Encoding: gzip
Connection: Close


HTTP/1.1 200 OK
x-amz-id-2: go/RIFwcWxhOWq9YgXaLSmEogAeLHdeec4gHe0JEH6FIBVaWHuIoU8ThWmxwHYP 
x-amz-request-id: C8AD696A3F25E33F
Date: Wed, 02 Jul 2014 08:33:42 GMT
x-amz-meta-s3cmd-attrs: uid:107/gname:nogroup/uname:jenkins/gid:65534/mode:33188/mtime:1395949858/atime:1395949858/md5:0244802336a6def6d6fddc4d8e71aa12/ctime:1395949858
Content-Encoding: UTF-8
Last-Modified: Thu, 27 Mar 2014 19:51:01 GMT
ETag: "0244802336a6def6d6fddc4d8e71aa12"
Content-Type: image/x-ms-bmp
Content-Length: 34616
Server: AmazonS3
BM8.......6...(..........................................qrqjkjjkjjkjj
kj.................................qsrjlkjlkjlkjlk....................
.............swulqnlqnlqnlqn.................................t|xnvqnvq
nvqnvq.................................v.|o}uo}uo}uo}u................
.................w..q.zq.zq.zq.z.................................w..q.
~q.~q.~q.~.................................x..q..q..q..q..............
.....................x..q..q..q..q...................................w
..q..q..q..q...................................w..p..p..p..p..........
.........................w..p..p..p..p................................
...v..o..o..o..o...................................u..n..n..n..n......
.............................u..n..n..n..n............................
.......t..n..n..n..n...................................t..m..m..m..m..
.................................t..n..n..n..n........................
...........t..m..m..m..m...................................t..m..m..m.
.m...................................t..m..m..m..m....................
...............t..m..m..m..m...................................t..m..m
..m..m...................................t..m..m..m..m................
...................t..m..m..m..m...................................t..
n..n..n..n...................................t..n..n..n..n............
.......................t..n..n..n..n..................................
.v..o..o..o..o...................................v..o..o..o..o........
...........................w..p..p..p..p..........................

<<< skipped >>>

GET /offers/streaming/img/amex-discover.png HTTP/1.1
Accept: */*
Referer: hXXp://utclient.utorrent.com/offers/streaming/index.html?port=10627&pair=AAF51F5F564AD28FFCFB5020BDB00283A1ED40A1&frameaddr=68242f8&plus=0&cid=AJ_YwRVi29RbUrz-&code=4
Accept-Language: en-US
User-Agent: Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1; WOW64; Trident/6.0)
Accept-Encoding: gzip, deflate
Host: utclient.utorrent.com
Connection: Keep-Alive


HTTP/1.1 200 OK
x-amz-id-2: jLh th3TgKjZ//q4u2hWLVQYGJDy4heDA4CGwfSZSQn3TEJ3DNased/bSTcpDUr9
x-amz-request-id: 0060B1A7F61A9298
Date: Wed, 02 Jul 2014 08:33:46 GMT
x-amz-meta-s3cmd-attrs: uid:107/gname:nogroup/uname:jenkins/gid:65534/mode:33188/mtime:1397098235/atime:1397256192/md5:5c6a94fa9ea773310fddaf0017ad14ae/ctime:1397098235
Content-Encoding: UTF-8
Last-Modified: Fri, 11 Apr 2014 23:16:10 GMT
ETag: "5c6a94fa9ea773310fddaf0017ad14ae"
Content-Type: image/png
Content-Length: 6336
Server: AmazonS3
.PNG........IHDR...h...#.....x.O.....IDATh..Z.xUE.._...BXB....].......
. 6b."...hk.....3......m...::h..4...B.}..".K...Y..Y...[....{_.Faf.....
V...U.....Su....#.W5.. r.He.%P....e1.9.U.5....w&..?...n.p8...$e..Qrr.}
..0..)...$.....(.....;g.j*.w..o..s||.5 W........Q..B..!LY!.kRf.}..0.`^
..Yf.{<......3g.p..........z..{...<).....v:.p...;.P.........IB..
... c..;..1.k .<....~4..,Z-......u...6l.$o.OA.I'..OY..fz..E......2.
..4....Z."33s.5c..U4(....S.Q{...d.H.P-.0...p.b1.....r....'&R@..?...3.x
.....{.k..o..[.~.G.y.....'l( ..d,....p..,#.....dmZd2...t2...g... 734i.
....H..`p.9B...#...TH:..x.{d.e.J....0.9.U..$..(:.AD.6j...........zi..'
...a..X.....; ..A|....D o.Ab..!...u.! .......8...@>...GA"@.EF .@C.`
.........`..}...h.....\.....Ah.Z..........1..pF............2.}.D.U..j.
..P..!.^. ._...4H.*..;.lK.U..]n.8.5.I....._............t...).P..m.e...
...%6.B..*.J..1q:.d2.... =.?...@cj.a.hI..z..61..G...{....o.......#2...
.....e..#....k.A..}.....u...h...~T-)...`..s=0B4...4.b)g.i.L.&.e...B.Q{
Bt`BF..jP3t.c..:.0..!..'<...-z.[I......-)$(.8..3.....H..4...U...{8.
9.)0#.`}$.N. ....~.s.s"u.H......JC...%H....8......0....@.r8....D.E....
...}@4..D..%.r...%.......9W..S. .['...z...UHLL....r.oJ.......'S(,.....
......e.."#..t......tI..:......L...Z.U\,..H...~....N.!.c;...j...N...m.
........]..A...VyTQ!..H.2lla.%.....$.../=.......2....0..N$...5^D.."...
*eE/..]..........b..~X.|;.l9eto.....>.@Qe..;....CPv..........q.q...
X..AvG...E....[&......:....E\.R..R..x...0e. t..3.............C.~G.:.w.
8.n..o.....hL.......'......[...X..Ks.,1..P@Ld,.(.V...HN,KtL.CLL4oL

<<< skipped >>>

GET /offers/streaming/img/paypal.png HTTP/1.1

Accept: */*
Referer: hXXp://utclient.utorrent.com/offers/streaming/index.html?port=10627&pair=AAF51F5F564AD28FFCFB5020BDB00283A1ED40A1&frameaddr=68242f8&plus=0&cid=AJ_YwRVi29RbUrz-&code=4
Accept-Language: en-US
User-Agent: Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1; WOW64; Trident/6.0)
Accept-Encoding: gzip, deflate
Host: utclient.utorrent.com
Connection: Keep-Alive


HTTP/1.1 200 OK
x-amz-id-2: Ne3qi6GGY/HiBa8acSvaTEZgzoUCLm0dU6wuraJXmkmrCv2XcS000NlLfKNS7pli
x-amz-request-id: 9A80CCFFAAA1244D
Date: Wed, 02 Jul 2014 08:33:46 GMT
x-amz-meta-s3cmd-attrs: uid:107/gname:nogroup/uname:jenkins/gid:65534/mode:33188/mtime:1397098235/atime:1397256192/md5:8ceb22be1cb9524e763372f4e3c653dc/ctime:1397098235
Content-Encoding: UTF-8
Last-Modified: Fri, 11 Apr 2014 23:16:11 GMT
ETag: "8ceb22be1cb9524e763372f4e3c653dc"
Content-Type: image/png
Content-Length: 2697
Server: AmazonS3
.PNG........IHDR...1...#.....=......PIDATX..Y.l...~..7zz......\..R..h.
.N.2.e.1.%.L.Le....-..d...%j.e:..S.12.Q' .* F..RpPJ...9=....<....i.
..%C>....}..}......B9..z.s;s..dN...c.eN2[.ojj...m..g..D.X,..9.J..Va
&.............?.E.T2Vzh..r..9....#..B.3o..}CWW..BW..<5<.x$.UH9..
.;4..f...X...p@c"Q(...UU.D..`...C...I(9.......(.'...w...|...f.J.P8.K."
DB.v..}......J..r...F..."...^.{..Q...x..|.f~.O...O.dQr.F.p.p$8IqE2A$}.
...ln..."P.....(.<O..FBs\.....=....S.;I....N.........'..E.yA.P.{:..
.mlz..v...G....Iy.9!..!S....<..=Q..M.<]....8....A<FI.tB.L).:I
.p*{B......R....3=.<....F#hi.E....1.q....(p....o`(...*.........4.6.
.....C.....PWS....~p...>u"........-.....)...p..0.y...l.l|.{..X6.S..
......{}...p......gFLp:.Cr8..2L._@2......y.GX.l...,..uU....x...e..1.5.
. ..1....t/..........Si...q..c$...$.....!.......!.....Y-xy.~z#....D..)
X~.cXrV.....U....<..b..Z.>...k..w..F,.....X..e.?s2..m?.......gt.
..~.....@R...?.Ki...!\.=...0F.!.7O f...'......n0.".b...xmg...?..K.....
L..k.J4.xcc....y...?.:f.......C...;..........O..5,.5.....Ni.7Y7..y$R..
..J4.U#^_......U1.)KV....x..=...N.8.D...dh^/J...Fmlo..z...........C4..
=7..............?.{.......\0...=.]s..<.....F,g...5....=...>9N.E.
...X4{2*"!..u/><..=.5qB..Zx..@y3...<...*"...0......=.<..N.
'".t...67...P.!.....d.].OD.C...v........c......_..8..g.....a`(.9...f!.
2.o^...Y2. r.<V`.......O....>..w^....q....&D1LY.w...3;.......p..
..H.^..t....^..=."b..R.m}.X....0yj.~\...<...h..tn.t\x.$.J..5.....:.
..<....o ....h...'.z...w...0E.6....[...^;.....s&b.......L.{.R..

<<< skipped >>>

GET /offers/streaming/img/other.png HTTP/1.1

Accept: */*
Referer: hXXp://utclient.utorrent.com/offers/streaming/index.html?port=10627&pair=AAF51F5F564AD28FFCFB5020BDB00283A1ED40A1&frameaddr=68242f8&plus=0&cid=AJ_YwRVi29RbUrz-&code=4
Accept-Language: en-US
User-Agent: Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1; WOW64; Trident/6.0)
Accept-Encoding: gzip, deflate
Host: utclient.utorrent.com
Connection: Keep-Alive


HTTP/1.1 200 OK
x-amz-id-2: UOfJlAZGtHMxE9G6cAnwspl WXbsYVL4hAZSxyTabhF4Csx1Fw3sKaA2n aulcdf
x-amz-request-id: 3B19665AFB8262AC
Date: Wed, 02 Jul 2014 08:33:46 GMT
x-amz-meta-s3cmd-attrs: uid:107/gname:nogroup/uname:jenkins/gid:65534/mode:33188/mtime:1397098235/atime:1397256192/md5:72ca452488fb2a2a46c0e06de775de32/ctime:1397098235
Content-Encoding: UTF-8
Last-Modified: Fri, 11 Apr 2014 23:16:11 GMT
ETag: "72ca452488fb2a2a46c0e06de775de32"
Content-Type: image/png
Content-Length: 1213
Server: AmazonS3
.PNG........IHDR...B.................IDATX....Qc;...]S....C.C0!..L....
.C.......C.!......t........].*..Z....z.F.....l.5.jwwwr||.d.........].x
..c.Nc,..E;..*..l/........D....-..............c......:.dM...... .2..3@
%..#...U.*.8<..NO...|.E3..n3..f..m4.G.....;..f.WfQN...aF....:k.[..k
%uM"..d..n^.c..7.....J........8..c...%S..7..9...'''...i.............A.
.vN.:K.l&.m|Tp.Lk........".)..G.;d........q...6.......K..o..F.\rfG.l..
.@..1....F&,..../3^.2m7........KC..f.=..c...;...n.......G.k....}#.....
.KG-...}.Y....y..A..er.MVluj....:...s..k&.cS..QY.5.....:..s...fY1..^3.
...S6..[......O..<.l8..u..m.c..................u.........N..)../..t
|.N......wL..Z_r<*OOO..y..n......*.!.1.....Q..'..H.b......3.# ..>
;<.....N/Ni....E..L.....x}....b.\.....d....x...................(.m.
.`.X..2...=e.Ek.nh.......3.25.|..$4"..-:..J. .K.7.....'&.'...Cf.3<.
_.X:q.J...........{Y.m4...}..f......<....y:........c."..Q...(..Kxqd
OlY.YZ.1&f.k.'...{..".iFa.Y.@xD.....Q..3..?..,.....{_A..lkS.\F...i..e.
..x.E..K_.)._.qx.n.,..W...2...y.@.Q...j.....-..{.|.....^.y.....3f..>
;.p6....&.;.......Q..z.W......$x...K..M..........0.....I.9...).._..U4.
,.I.[YGf.=....d..........o..v...3.....{..5S.o.~.x..[.....tr.9.Of......
.!?.nV.-)...Ve.G...^9...:..,F.s........IEND.B`.
....

<<< skipped >>>

GET /offers/streaming/bower_components/jquery/dist/jquery.min.js HTTP/1.1

Accept: */*
Referer: hXXp://utclient.utorrent.com/offers/streaming/index.html?port=10627&pair=AAF51F5F564AD28FFCFB5020BDB00283A1ED40A1&frameaddr=68242f8&plus=0&cid=AJ_YwRVi29RbUrz-&code=4
Accept-Language: en-US
User-Agent: Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1; WOW64; Trident/6.0)
Accept-Encoding: gzip, deflate
Host: utclient.utorrent.com
Connection: Keep-Alive


HTTP/1.1 200 OK
x-amz-id-2: vdn6vfyar0yQ1E cbjY4k/wtHvw2oK/IL3jA4sVgmTFF8bPwSNKuxoUKnfru2 FM
x-amz-request-id: 9C2C4EC5E8CC4304
Date: Wed, 02 Jul 2014 08:33:47 GMT
Last-Modified: Tue, 25 Mar 2014 19:18:48 GMT
ETag: "397754ba49e9e0cf4e7c190da78dda05"
Content-Type: text/javascript
Content-Length: 92629
Server: AmazonS3
/*! jQuery v1.9.1 | (c) 2005, 2012 jQuery Foundation, Inc. | jquery.or
g/license.//@ sourceMappingURL=jquery.min.map.*/(function(e,t){var n,r
,i=typeof t,o=e.document,a=e.location,s=e.jQuery,u=e.$,l={},c=[],p="1.
9.1",f=c.concat,d=c.push,h=c.slice,g=c.indexOf,m=l.toString,y=l.hasOwn
Property,v=p.trim,b=function(e,t){return new b.fn.init(e,t,r)},x=/[ -]
?(?:\d*\.|)\d (?:[eE][ -]?\d |)/.source,w=/\S /g,T=/^[\s\uFEFF\xA0] |[
\s\uFEFF\xA0] $/g,N=/^(?:(<[\w\W] >)[^>]*|#([\w-]*))$/,C=/^&l
t;(\w )\s*\/?>(?:<\/\1>|)$/,k=/^[\],:{}\s]*$/,E=/(?:^|:|,)(?:
\s*\[) /g,S=/\\(?:["\\\/bfnrt]|u[\da-fA-F]{4})/g,A=/"[^"\\\r\n]*"|true
|false|null|-?(?:\d \.|)\d (?:[eE][ -]?\d |)/g,j=/^-ms-/,D=/-([\da-z])
/gi,L=function(e,t){return t.toUpperCase()},H=function(e){(o.addEventL
istener||"load"===e.type||"complete"===o.readyState)&&(q(),b.ready())}
,q=function(){o.addEventListener?(o.removeEventListener("DOMContentLoa
ded",H,!1),e.removeEventListener("load",H,!1)):(o.detachEvent("onready
statechange",H),e.detachEvent("onload",H))};b.fn=b.prototype={jquery:p
,constructor:b,init:function(e,n,r){var i,a;if(!e)return this;if("stri
ng"==typeof e){if(i="<"===e.charAt(0)&&">"===e.charAt(e.length-1
)&&e.length>=3?[null,e,null]:N.exec(e),!i||!i[1]&&n)return!n||n.jqu
ery?(n||r).find(e):this.constructor(n).find(e);if(i[1]){if(n=n instanc
eof b?n[0]:n,b.merge(this,b.parseHTML(i[1],n&&n.nodeType?n.ownerDocume
nt||n:o,!0)),C.test(i[1])&&b.isPlainObject(n))for(i in n)b.isFunction(
this[i])?this[i](n[i]):this.attr(i,n[i]);return this}if(a=o.getEle

<<< skipped >>>

GET /installstats.php?cl=uTorrent&v=109279617&h=AJ_YwRVi29RbUrz-&w=1DB10106&bu=0&pr=0&cmp=82&ocmp=82&showinstall&pid=1224&cau=0&au=0&view=win32 HTTP/1.1
Accept-Encoding: gzip
User-Agent: uTorrent(31105)/3.4.1
Host: update.utorrent.com
Cache-Control: no-cache


HTTP/1.1 200 OK
Server: nginx/1.4.7
Date: Wed, 02 Jul 2014 08:29:28 GMT
Content-Type: text/html
Transfer-Encoding: chunked
Connection: close
X-Powered-By: PHP/5.4.30
0..


POST /e?i=20 HTTP/1.1
Host: bench.utorrent.com
User-Agent: BTWebClient/3410(31105)
Accept-Encoding: gzip
Connection: Close
Content-Length: 296

{"h":"AJ_YwRVi29RbUrz-","cl":"uTorrent","v":109279617,"l":"en","w":"6.1","cts":1404290019,"eventName":"ap","fte":1,"lre":1,"ltic_0":0,"ltic_1":0,"lcic_0":0,"lcic_1":0,"laae":0,"lare":0,"laie":0,"lame":0,"name":"Ads Enabled","errCode":0,"requestTime":1404290019,"action":"client.az.adsenabled.ua"}
HTTP/1.1 200 OK
Content-Type: text/html
Date: Wed, 02 Jul 2014 08:33:45 GMT
Server: nginx/1.4.7
X-Powered-By: PHP/5.4.30
Content-Length: 21
Connection: Close
{"response_code":200}..


GET /inclient/yes?starttime=1393282818000&port=10627&pair=ADFC36D802A98BEB8DDDFD9BE07E8897AB050C2B&frameaddr=38a30e0 HTTP/1.1
Accept: */*
Accept-Language: en-US
User-Agent: Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1; WOW64; Trident/6.0)
Accept-Encoding: gzip, deflate
Host: bundles.bittorrent.com
Connection: Keep-Alive


HTTP/1.1 302 Moved Temporarily
Content-Type: text/plain; charset=utf-8
Content-Length: 220
Connection: keep-alive
Cache-Control: private, no-cache, max-age=0
Date: Wed, 02 Jul 2014 08:33:40 GMT
Location: /bundles/79b5f927c68a0bc7f648e016404705ab4f86772403bfbd9c089194fbebe30203?starttime=1393282818000&port=10627&pair=ADFC36D802A98BEB8DDDFD9BE07E8897AB050C2B&frameaddr=38a30e0&download=true
Vary: Accept-Encoding
X-Cache: Miss from cloudfront
Via: 1.1 d84cd5311ccca1f37f90f1eed9f01585.cloudfront.net (CloudFront)
X-Amz-Cf-Id: Fma49Z7LdNsV9-1ys0g7f-DGQUaeylfbcGE4E2Fm1yRNGvmUKYJv7w==
Moved Temporarily. Redirecting to /bundles/79b5f927c68a0bc7f648e016404
705ab4f86772403bfbd9c089194fbebe30203?starttime=1393282818000&port=106
27&pair=ADFC36D802A98BEB8DDDFD9BE07E8897AB050C2B&frameaddr=38a30e0&dow
nload=true
....



GET /bundles/79b5f927c68a0bc7f648e016404705ab4f86772403bfbd9c089194fbebe30203?starttime=1393282818000&port=10627&pair=ADFC36D802A98BEB8DDDFD9BE07E8897AB050C2B&frameaddr=38a30e0&download=true HTTP/1.1

Accept: */*
Accept-Language: en-US
User-Agent: Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1; WOW64; Trident/6.0)
Accept-Encoding: gzip, deflate
Host: bundles.bittorrent.com
Connection: Keep-Alive


HTTP/1.1 200 OK
Content-Type: text/html; charset=utf-8
Transfer-Encoding: chunked
Connection: keep-alive
Cache-Control: public, max-age=300
Content-Encoding: gzip
Date: Wed, 02 Jul 2014 08:29:25 GMT
ETag: W/"abb8-4046434016"
Set-Cookie: connect.sid=eyJwYXNzcG9ydCI6e319--5f19a0dc71d1127c1494f9a84f91312152a2ef2e; Path=/; Expires=Wed, 02 Jul 2014 12:29:25 GMT; HttpOnly
Vary: Accept-Encoding
Age: 255
X-Cache: Hit from cloudfront
Via: 1.1 d84cd5311ccca1f37f90f1eed9f01585.cloudfront.net (CloudFront)
X-Amz-Cf-Id: 7tEMdz-hbjtRp6zItlWNFA4TO3BMP_Rwh_ffSZkB-lL4zucGUiWL1g==
2d55.............}.r.8...3O...J..).~..de[.L|.$..u.@...K....8...5..s^n.
.t..D.b;...fgR3..4..F_..~.d.d..........//.....q..;hs..K..{...3$q.....)
...............Qy..xrN.....a.......@k>.......w."I.cZ...re..$G.%/W `
=.B....../.#......'\r3..JB.$...g..VR@...V........!.......\.....O...V.n
g..o58....j......v.bD..9...4iV&.'..b. I...m..nV..g-a;....{H .......A.I
.K.;.(...TB..(.|...8..B.k.M.M.~..*......?....!C@T...|Y,..4b...h.a._...
....e...N.....*.m.Nk.....^.....K ...|..v[..uD..Sw..F...$...:L:_.)...xz
#.%p..Q.F[3(2....$.....H...5..j..TSwMY..2.C%.....TdC.....?.....uYU...$
..b.`.1........u............GgW...[...x.....v.K....M...(5>.D/..@y0.
..y.7.].Y.n.dt..5.C....c........6*go..w.........v[o.&.Y.........E..M.6
.j.S>....\T.'..>...E..3......[..E.n.N.......u..a5.gU..-..2@...^l
F4.D.C.*l.....Y..4.....).Q.QV.M.......e..e.^.U.....EP...2.l....`x..EmF
..z 5...(.b.....0..QG..<..I3z.4.:..M..fp._ 8.0.O...r.9...'.u...j.=.
T.......E...T..<....x.....tt.S..{...../Ie...k..A#...O..t..N/x.8..0i
:L....mF...DhJ....W...o.@....!..A....qA~.j...".H6.d..|X%..d.J..j.'.|..
..b....1.N3....Cr....N.\.r.u}lG....h......q8..z.9l..`..`...y...CM.*.u.
$.V....o.F8M.=.V.$p.b.x...^.IH.Z..!..0`..0<...C.T. ..G.p...\.>k|
.!.... L...YY..D7..(...>V:.....n...'......>}ZM.R.O.2L.....x~...(
...I.{.4.*.......{....8y...\.Ga....../v...5d.X..0:..@.B.q.ME.6..'..R..
e..&.d....M!.C.........w...B..O'/E.P(v...E >...b.L2..D..".t.=.S....
..Px...ZC.......4*;...........Y_..a..SY..@....!qPS..g..Dt.~....."T@...
<U....L.%..*.....&.^..#.!..i>.'......:Hff....:L.7}`.....u...

<<< skipped >>>

POST /e?i=27 HTTP/1.1
Host: bench.utorrent.com
User-Agent: BTWebClient/3410(31105)
Accept-Encoding: gzip
Connection: Close
Content-Length: 127

{"h":"AJ_YwRVi29RbUrz-","cl":"uTorrent","v":109279617,"l":"en","w":"6.1","cts":1404290018,"eventName":"embeddedIE","version":9}
HTTP/1.1 200 OK
Content-Type: text/html
Date: Wed, 02 Jul 2014 08:33:43 GMT
Server: nginx/1.4.7
X-Powered-By: PHP/5.4.30
Content-Length: 21
Connection: Close
{"response_code":200}..


GET /update_event.php?cl=uTorrent&v=109279617&l=en&svp=4&svn_revno=31105&tk=beta&c=US&w=1DB10106&h=AJ_YwRVi29RbUrz-&auexit=1 HTTP/1.1
Host: update.utorrent.com
User-Agent: BTWebClient/3410(31105)
Accept-Encoding: gzip
Connection: Close


HTTP/1.1 200 OK
Server: nginx/1.4.7
Date: Wed, 02 Jul 2014 08:33:34 GMT
Content-Type: text/html
Transfer-Encoding: chunked
Connection: close
X-Powered-By: PHP/5.4.30
Expires: Thu, 21 Jul 1980 00:00:00 GMT
Cache-Control: private
Last-Modified: Wed, 02 Jul 2014 08:33:34 GMT
0..


GET /installstats.php?cl=uTorrent&v=109279617&h=AJ_YwRVi29RbUrz-&w=1DB10106&bu=0&pr=0&cmp=82&ocmp=82&showtbexists&pid=1224&cau=0&tbe=0&cd=0&view=win32 HTTP/1.1
Accept-Encoding: gzip
User-Agent: uTorrent(31105)/3.4.1
Host: update.utorrent.com
Cache-Control: no-cache


HTTP/1.1 200 OK
Server: nginx/1.4.7
Date: Wed, 02 Jul 2014 08:32:01 GMT
Content-Type: text/html
Transfer-Encoding: chunked
Connection: close
X-Powered-By: PHP/5.4.30
0..


GET /MFEwTzBNMEswSTAJBgUrDgMCGgUABBS56bKHAoUD+Oyl+0LhPg9JxyQm4gQUf9Nlp8Ld7LvwMAnzQzn6Aq8zMTMCEH7hSm9v7/LTfz+tZU062rQ= HTTP/1.1
Connection: Keep-Alive
Accept: */*
User-Agent: Microsoft-CryptoAPI/6.1
Host: s2.symcb.com


HTTP/1.1 200 OK
Last-Modified: Mon, 30 Jun 2014 10:06:29 GMT
Expires: Mon, 07 Jul 2014 10:06:29 GMT
Content-Type: application/ocsp-response
content-transfer-encoding: binary
Content-Length: 1895
Cache-Control: max-age=437786, public, no-transform, must-revalidate
Date: Wed, 02 Jul 2014 08:33:43 GMT
Connection: keep-alive
0..c......\0..X.. .....0.....I0..E0...........0..1.0...U....US1.0...U.
...Symantec Corporation1.0...U....Symantec Trust Network1?0=..U...6Sym
antec Class 3 PCA - G5 OCSP Responder Certificate 2..20140630100629Z0s
0q0I0... ...................B.>.I.$&.....e......0..C9...313..~.Joo.
...?.eM:......20140630100629Z....20140707100629Z0...*.H..............R
wq..3&"..F.b.{.8.z......fR.|^.F....cb;....5-...1....O...0.bL....:.....
....<U.Y$.dh....d'Q....q....Z.....cy..L..WY~Zd. .6.....{a...%V...)y
.PC2.........F....f_.......IBv...W..I~..:....j.g.>...|........7.w8.
...2...._.sqn....J|,..sB.....G..*..i3.CB..[...b.R.....0...0...0.......
...U..3....2.......0...*.H........0..1.0...U....US1.0...U....VeriSign,
Inc.1.0...U....VeriSign Trust Network1:08..U...1(c) 2006 VeriSign, In
c. - For authorized use only1E0C..U...<VeriSign Class 3 Public Prim
ary Certification Authority - G50...131112000000Z..141212235959Z0..1.0
...U....US1.0...U....Symantec Corporation1.0...U....Symantec Trust Net
work1?0=..U...6Symantec Class 3 PCA - G5 OCSP Responder Certificate 20
.."0...*.H.............0.........2...#.522.K.....G.....].........5....
..1.mW.....k....zz.5.....ts.o..v.....QtN.W.zO....t....B...:.......GVd.
'=...........6.Lg../......`.. .U..V ...6......Y....e.)....o....._.b...
..1......[.<.j.hT3..f......vJ>...Q.7....U...W3....i!...hu.JK...`
.L...S..@.~N...........0...0...U.......0.0l..U. .e0c0a..`.H...E....0R0
&.. .........hXXp://VVV.symauth.com/cps0(.. .......0...hXXp://VVV.syma
uth.com/rpa0...U.%..0... .......0...U...........0... .....0......0

<<< skipped >>>

GET /utorrent-onboarding/welcome-upsell.btapp?h=AJ_YwRVi29RbUrz-&v=109279617&ol=en&ul=&tk=beta&c=uTorrent HTTP/1.1
Host: apps.bittorrent.com
User-Agent: BTWebClient/3410(31105)
Accept-Encoding: gzip
If-Modified-Since: Tue, 08 Oct 2013 00:54:05 GMT
Connection: Close


HTTP/1.1 304 Not Modified
Content-Type: binary/octet-stream
Age: 128810
Date: Wed, 02 Jul 2014 08:33:40 GMT
Connection: close


POST /e?i=21 HTTP/1.1
Host: bench.utorrent.com
User-Agent: BTWebClient/3410(31105)
Accept-Encoding: gzip
Connection: Close
Content-Length: 367

{"h":"AJ_YwRVi29RbUrz-","cl":"uTorrent","v":109279617,"l":"en","w":"6.1","cts":1404290018,"eventName":"silent_autoupdate","launched_target":0,"updated":0,"relocated":0,"versions": [{"path":"updates\\3.4.1_31105.exe","version":"109279617","blacklisted":"0","crash_count":"0","opt_out":"0","running":""}], "action":"Initial download", "g_version":109279617, "no_sau":0}
HTTP/1.1 200 OK
Content-Type: text/html
Date: Wed, 02 Jul 2014 08:33:47 GMT
Server: nginx/1.4.7
X-Powered-By: PHP/5.4.30
Content-Length: 21
Connection: Close
{"response_code":200}..


GET /control/tags/ut.json HTTP/1.1
Host: cdn.ap.bittorrent.com
User-Agent: BTWebClient/3410(31105)
Accept-Encoding: gzip
Accept-Language: en-US
Connection: Close


HTTP/1.1 200 OK
Content-Type: application/json
Content-Length: 3745
Connection: close
Date: Wed, 25 Jun 2014 22:11:49 GMT
Last-Modified: Wed, 25 Jun 2014 22:00:47 GMT
ETag: "607ec9a501a357c414533bc97b9aee1c"
Accept-Ranges: bytes
Server: AmazonS3
Age: 37311
X-Cache: Hit from cloudfront
Via: 1.1 0649e44351acca7ddb57083f12587a23.cloudfront.net (CloudFront)
X-Amz-Cf-Id: b__TKKvnU-zDHtb-NsDfEpv4BYrLfrAl5BiU6kOxAXvvV77-iD6GJg==
{..    "version": 37,..    "adrules": [..        {..            "name"
: "default",.. "contactRate": 60,.. "adRefreshRa
te": 360,.. "lrecRefreshRate": 360,.. "ftRefresh
Rate": 360,.. "resetAds": 0,.. "rollout": 100,..
"enabled": 1,.. "ftEnabled": 1,.. "l
recEnabled": 1,.. "sendConversion": 0.. },..
{.. "name": "refresh_360",.. "adRefreshRate": 36
0,.. "lrecRefreshRate": 360,.. "ftRefreshRate":
360,.. "adRefreshRatePattern":[21600],.. "resetA
ds": 0,.. "rollout": 100,.. "enabled": 1,..
"ftEnabled": 1,.. "lrecEnabled": 1,.. "se
ndConversion": 0,.. "countries": "cn,ee,es,hk,iq,ir,kr,kz,p
r,tw,ua,ua,co,ve".. },.. {.. "name": "refresh
_60",.. "adRefreshRate": 60,.. "lrecRefreshRate"
: 60,.. "ftRefreshRate": 60,.. "adRefreshRatePat
tern":[3600],.. "resetAds": 0,.. "rollout": 100,
.. "enabled": 1,.. "ftEnabled": 1,..
"lrecEnabled": 1,.. "sendConversion": 0,.. "coun
tries": "bg,hu,jp,lt,ph,pk,ro,rs,sa,th,eg".. },.. {..
"name": "refresh_30",.. "adRefreshRate": 30,..
"lrecRefreshRate": 30,.. "ftRefreshRate": 30,..
"adRefreshRatePattern":[1800],.. "rollout": 100

<<< skipped >>>

POST /e?i=29 HTTP/1.1
Host: bench.utorrent.com
User-Agent: BTWebClient/3410(31105)
Accept-Encoding: gzip
Connection: Close
Content-Length: 136

{"h":"AJ_YwRVi29RbUrz-","cl":"uTorrent","v":109279617,"l":"en","w":"6.1","cts":1404290018,"eventName":"flash", "flash version": "none" }
HTTP/1.1 200 OK
Content-Type: text/html
Date: Wed, 02 Jul 2014 08:33:36 GMT
Server: nginx/1.4.7
X-Powered-By: PHP/5.4.30
Content-Length: 21
Connection: Close
{"response_code":200}..


POST /e?i=20 HTTP/1.1
Host: bench.utorrent.com
User-Agent: BTWebClient/3410(31105)
Accept-Encoding: gzip
Connection: Close
Content-Length: 299

{"h":"AJ_YwRVi29RbUrz-","cl":"uTorrent","v":109279617,"l":"en","w":"6.1","cts":1404290020,"eventName":"ap","fte":1,"lre":1,"ltic_0":0,"ltic_1":0,"lcic_0":0,"lcic_1":0,"laae":0,"lare":0,"laie":0,"lame":0,"name":"siteId","errCode":0,"requestTime":1404290020,"action":"client.az.error.badsiteid.33049"}
HTTP/1.1 200 OK
Content-Type: text/html
Date: Wed, 02 Jul 2014 08:33:38 GMT
Server: nginx/1.4.7
X-Powered-By: PHP/5.4.30
Content-Length: 21
Connection: Close
{"response_code":200}..


GET /time.php HTTP/1.1
Host: update.bittorrent.com
User-Agent: BTWebClient/3410(31105)
Accept-Encoding: gzip
Connection: Close


HTTP/1.1 404 Not Found
Server: nginx/1.4.7
Date: Wed, 02 Jul 2014 08:30:25 GMT
Content-Type: text/html
Content-Length: 168
Connection: close
<html>..<head><title>404 Not Found</title><
/head>..<body bgcolor="white">..<center><h1>404 N
ot Found</h1></center>..<hr><center>nginx/1.4.
7</center>..</body>..</html>....


GET /nr-411.min.js HTTP/1.1
Accept: */*
Referer: hXXp://bundles.bittorrent.com/bundles/79b5f927c68a0bc7f648e016404705ab4f86772403bfbd9c089194fbebe30203?starttime=1393282818000&port=10627&pair=ADFC36D802A98BEB8DDDFD9BE07E8897AB050C2B&frameaddr=38a30e0&download=true
Accept-Language: en-US
User-Agent: Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1; WOW64; Trident/6.0)
Accept-Encoding: gzip, deflate
Host: js-agent.newrelic.com
Connection: Keep-Alive


HTTP/1.1 200 OK
x-amz-id-2: rO1ZoxKkmnz9Vdg5TrCnJ5DazLgM74j84B47XT7cuBroUk0Jyoo9AGuSx5c5HmTJ
x-amz-request-id: 043E980466E21A92
Cache-Control: public, max-age=315360000
Expires: Thu, 31 Dec 2037 23:55:55 GMT
Last-Modified: Thu, 01 May 2014 23:15:58 GMT
ETag: "9050946217be03f42647b3f708ef10d3"
Content-Type: application/javascript
Server: AmazonS3
Content-Encoding: gzip
Content-Length: 5773
Accept-Ranges: bytes
Date: Wed, 02 Jul 2014 08:33:41 GMT
Via: 1.1 varnish
Age: 1500413
Connection: keep-alive
X-Served-By: cache-ams4125-AMS
X-Cache: HIT
X-Cache-Hits: 32388667
X-Timer: S1404290021.123782396,VS0,VE0
Vary: Accept-Encoding
...........[mw.6....B..*....8NB.V.4......fv?Hj.M....TA..G.............
I../.....Y\f.J.......V.=.(...$v..L-L)...@.J.UM...........|/..e"E....P.
../])T).^...F...U]n..J..{...{ e...&..\..$.z.<*S......}..=a........\
.......u6Z.. M.`hA.^.0..}.p....."".|.{.....=....TU.>.~f....<.G..
F.S.-.j....v|.,......{.6....&.............I.D&$K..G.Z.qz...?..........
.7.....4.w.'Qo....~./....G.v...Mg.b.s..o...6 ......m.*?...@...S.....d.
.J&a..0.........'0...a^f..a.1...?.1Z............n....N.......4...P.u..
w...E^....Col...Q1.1..-Px...V...F....<.A1.LU.Q.6.Se.....-..~.n.G..m
.d ..SP.d..g.....&.x0'..4...fr.. .\.........H.B..5..H..2M.....rf~....;
.D#.....)Z....0...2..T......!.T.7...p)..d-..(.U[.,4O.J.#l..0.........S
..a.....R....c...^r...2.....<.}...4B.-T.....>...@.K.7...r;.W.x..
..D..S"VoW...lA. ..g...\*O..2Oda.......|..3....J.I.P8)$.H.*.R..,4...{$
.........nE...a.&..=..oy.9.....k.x.....U....$.&A]..lAF%......k....&iX.
.>).d.,..hRVX.9....;...p.)..S.............l.Z.9s.....0RVyG..<..*
...e.....l a.<..=.,..[.....a..>...JT...[./.t5B.K]w..g...(M......
.1D9l.W..{bS...........v..l...X...^.e..J.......'...^Y.,.....{....Z...2
...E.m....].zj......x....2M.......<,.`.a(....T... B.l.^.....xP.....
..f.!4t=.].=...Fd..U.F.9......F~...bb..v...vR.V.0..|x'.0.....R...Z..!I
w.u...([.s....U..r..|..)...t.M.1..aw.}..H..C9Nd....`.vq...H.y.u.E.A.(_
..3E...../H..0v.~.X..^P-Rbh<..^...v...%`c.C0c..].W..7V.h5 .........
vP..e..mhY............5..7..o$....V...Kl.....:-...o*..hCc......A......
-...\......0,...;........3[..q.l....b.......]x.Yp.,.F..?.ES.[....F

<<< skipped >>>

GET /css?family=Open Sans:400,300,600 HTTP/1.1
Accept: */*
Referer: hXXp://bundles.bittorrent.com/bundles/79b5f927c68a0bc7f648e016404705ab4f86772403bfbd9c089194fbebe30203?starttime=1393282818000&port=10627&pair=ADFC36D802A98BEB8DDDFD9BE07E8897AB050C2B&frameaddr=38a30e0&download=true
Accept-Language: en-US
User-Agent: Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1; WOW64; Trident/6.0)
Accept-Encoding: gzip, deflate
Host: fonts.googleapis.com
Connection: Keep-Alive


HTTP/1.1 200 OK
Content-Type: text/css
Timing-Allow-Origin: *
Expires: Wed, 02 Jul 2014 08:33:40 GMT
Date: Wed, 02 Jul 2014 08:33:40 GMT
Cache-Control: private, max-age=86400
Content-Encoding: gzip
Content-Length: 400
X-Content-Type-Options: nosniff
X-Frame-Options: SAMEORIGIN
X-XSS-Protection: 1; mode=block
Server: GSE
Alternate-Protocol: 80:quic
............MO.@........K."4.....b.R....L?.~......n.(z &....fg.L.L/.L.
a....!....)L.8)0..L(g_.....1...l. H.X.Ho6........b)SS.d..D#.<"...p.
..l`N5!..`..#4^N..@mihW...gb_.....i..x0...........I....>...e}3.p...
7=..........Mpp.ro..eM.:....j.M.)..'......|....$V...Qc.....z)....z;U..
K5....._d....._d..z...[:.=.z0...u`....jl.b'.. ..u..35...;.........w.W.
...K.F..S.z..i.....e.;...R.@.9'.m..gvp.=....o.......K.....


GET /inclient/yes?starttime=1393282818000&port=10627&pair=ADFC36D802A98BEB8DDDFD9BE07E8897AB050C2B&frameaddr=38a30e0 HTTP/1.1
Accept: */*
Accept-Language: en-US
User-Agent: Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1; WOW64; Trident/6.0)
Accept-Encoding: gzip, deflate
Host: content.bittorrent.com
Connection: Keep-Alive


HTTP/1.1 302 Moved Temporarily
Content-Type: text/plain
Date: Wed, 02 Jul 2014 08:33:40 GMT
Location: hXXp://bundles.bittorrent.com/inclient/yes?starttime=1393282818000&port=10627&pair=ADFC36D802A98BEB8DDDFD9BE07E8897AB050C2B&frameaddr=38a30e0
Vary: Accept
X-Powered-By: Express
Content-Length: 175
Connection: keep-alive
Moved Temporarily. Redirecting to hXXp://bundles.bittorrent.com/inclie
nt/yes?starttime=1393282818000&port=10627&pair=ADFC36D802A98BEB8DDDFD9
BE07E8897AB050C2B&frameaddr=38a30e0HTTP/1.1 302 Moved Temporarily..Con
tent-Type: text/plain..Date: Wed, 02 Jul 2014 08:33:40 GMT..Location:
hXXp://bundles.bittorrent.com/inclient/yes?starttime=1393282818000&por
t=10627&pair=ADFC36D802A98BEB8DDDFD9BE07E8897AB050C2B&frameaddr=38a30e
0..Vary: Accept..X-Powered-By: Express..Content-Length: 175..Connectio
n: keep-alive..Moved Temporarily. Redirecting to hXXp://bundles.bittor
rent.com/inclient/yes?starttime=1393282818000&port=10627&pair=ADFC36D8
02A98BEB8DDDFD9BE07E8897AB050C2B&frameaddr=38a30e0..


GET /img/social-sprite.3c63010ad741960298c76cf7aabd3627.png HTTP/1.1
Accept: */*
Referer: hXXp://bundles.bittorrent.com/bundles/79b5f927c68a0bc7f648e016404705ab4f86772403bfbd9c089194fbebe30203?starttime=1393282818000&port=10627&pair=ADFC36D802A98BEB8DDDFD9BE07E8897AB050C2B&frameaddr=38a30e0&download=true
Accept-Language: en-US
User-Agent: Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1; WOW64; Trident/6.0)
Accept-Encoding: gzip, deflate
Host: d1mh11hmkkdpin.cloudfront.net
Connection: Keep-Alive


HTTP/1.1 200 OK
Content-Type: image/png
Content-Length: 3722
Connection: keep-alive
Date: Sat, 21 Jun 2014 02:51:02 GMT
Cache-Control: max-age=31536000
Last-Modified: Thu, 19 Jun 2014 23:38:05 GMT
ETag: "3c63010ad741960298c76cf7aabd3627"
Accept-Ranges: bytes
Server: AmazonS3
Age: 970961
X-Cache: Hit from cloudfront
Via: 1.1 868e7340556a0aa2e4d1bad048f6f8e1.cloudfront.net (CloudFront)
X-Amz-Cf-Id: EiuLm_W04eI714TZGBPxainG1lIYXpDA1NBN2fuNR-c_djqQ4cTwlQ==
.PNG........IHDR...,......... ..'....tEXtSoftware.Adobe ImageReadyq.e&
lt;...siTXtXML:com.adobe.xmp.....<?xpacket begin="..." id="W5M0MpCe
hiHzreSzNTczkc9d"?> <x:xmpmeta xmlns:x="adobe:ns:meta/" x:xmptk=
"Adobe XMP Core 5.5-c014 79.151481, 2013/03/13-12:09:15 "> &
lt;rdf:RDF xmlns:rdf="hXXp://VVV.w3.org/1999/02/22-rdf-syntax-ns#">
<rdf:Description rdf:about="" xmlns:xmpMM="hXXp://ns.adobe.com/xap
/1.0/mm/" xmlns:stRef="hXXp://ns.adobe.com/xap/1.0/sType/ResourceRef#"
xmlns:xmp="hXXp://ns.adobe.com/xap/1.0/" xmpMM:OriginalDocumentID="xm
p.did:ed1fd58e-303f-4c9b-8d2e-a9a9d051e6f2" xmpMM:DocumentID="xmp.did:
B9FE0B616DBA11E3A46EC0A9C6415F84" xmpMM:InstanceID="xmp.iid:B9FE0B606D
BA11E3A46EC0A9C6415F84" xmp:CreatorTool="Adobe Photoshop CC (Macintosh
)"> <xmpMM:DerivedFrom stRef:instanceID="xmp.iid:3a362413-e9d7-4
47a-9c72-63a37f6ee87a" stRef:documentID="xmp.did:ed1fd58e-303f-4c9b-8d
2e-a9a9d051e6f2"/> </rdf:Description> </rdf:RDF> </x
:xmpmeta> <?xpacket end="r"?>yK......IDATx..\..........p ....
. F...`..H..$.RQH..C.S.U...2..`.X....!...%.H.%.Q..........<^J(r....
.|.....fg.g.*.LW}.....~.......3.l6....V.Y9..w.?.TJ.4..e...(.......#v..
...U.z.53.^...@_ru.:..r.6.......<..G.7E.Q........|}9.LL.W..].(....\
Sb.....I1..\.c......p.'...s`:...u....k........h]p.....;w~|..m.665.....
B.su..........[Cx...v....w..~]^l..K....E....^T....2............-..i."~
%........._.#.f.2N...e...m~....k.....9...BT..C....=.v...\.g.j...S..w..
r......;]S.....^......B...W.......v..o...b$.....;..[c.2..K.ci.]...

<<< skipped >>>

GET /i.gif?e=eyJhdiI6NTk1OTcsImF0Ijo5LCJjbSI6MTI3Mzg3LCJjaCI6ODc4NSwiY3IiOjM2OTUzMywiZGkiOiIwNDgyZmM0ODllOGI0OGQxOTcwZGU5Zjc0MDE5N2M1ZCIsImRtIjozLCJmYyI6NDU1MTcxLCJmbCI6MjMyOTE2LCJpcCI6IjE5My4xMzguMjQ0LjIzMSIsImt3IjoiY2xpZW50ZGF0YT11dG9ycmVudHwzLjQuMS4zMTEwNXw4MixpZXZlcnNpb249MTAsZmxhc2g9bm9uZSIsIm53Ijo1NjgyLCJwYyI6MC4xLCJwciI6MjM3NTUsInJ0IjozLCJzdCI6MzMwNDksInVrIjoidWUxLTZjZmRiY2RjYTQ0NjQ0NmZiMDFmZDE0NDgwZGViNjRhIiwidHMiOjE0MDQyOTAxOTc3NjIsImZxIjoxfQ&s=_dkqk6fdSoQAgWHd01Qej3p10WE HTTP/1.1
Host: engine.ap.bittorrent.com
User-Agent: Mozilla/5.0 (compatible; MSIE 10.0 Windows NT 6.1; WOW64; Trident/6.0; EIE10; ENUSMSN)(31105)
Accept-Encoding: gzip
Accept-Language: en-US
Connection: Close


HTTP/1.1 200 OK
Access-Control-Allow-Headers: accept, origin, content-type, content-length
Access-Control-Allow-Methods: GET,PUT,POST,DELETE,OPTIONS
Access-Control-Allow-Origin: *
Content-Type: image/gif
Date: Wed, 02 Jul 2014 08:32:00 GMT
Server: nginx/1.1.19
Set-Cookie: azk=ue1-6cfdbcdca446446fb01fd14480deb64a; Path=/; Expires=Thu, 02 Jul 2015 08:32:00 GMT
x-powered-by: adzerk bifrost/
x-served-by: engine-us-east-1e-19
Content-Length: 43
Connection: Close
GIF89a.............!.......,...........D..;..


POST /e?i=21 HTTP/1.1
Host: bench.utorrent.com
User-Agent: BTWebClient/3410(31105)
Accept-Encoding: gzip
Connection: Close
Content-Length: 246

{"h":"AJ_YwRVi29RbUrz-","cl":"uTorrent","v":109279617,"l":"en","w":"6.1","cts":1404290018,"eventName":"silent_autoupdate","launched_target":0,"updated":0,"relocated":0,"versions": [], "action":"RunningElevated", "g_version":109279617, "no_sau":0}
HTTP/1.1 200 OK
Content-Type: text/html
Date: Wed, 02 Jul 2014 08:33:43 GMT
Server: nginx/1.4.7
X-Powered-By: PHP/5.4.30
Content-Length: 21
Connection: Close
{"response_code":200}..


GET /favicon.ico HTTP/1.1
Host: VVV.mininova.org
User-Agent: BTWebClient/3410(31105)
Accept-Encoding: gzip
If-Modified-Since: Sun, 1 Jan 1982 00:00:00 GMT
Connection: Close


HTTP/1.1 200 OK
Cache-control: public, max-age=25920000
Expires: Tue, 28 Apr 2015 08:33:40 GMT
Content-Type: image/x-icon
Accept-Ranges: bytes
ETag: "103585109"
Last-Modified: Sat, 30 Oct 2010 22:57:22 GMT
Content-Length: 318
Connection: close
Date: Wed, 02 Jul 2014 08:33:40 GMT
..............(.......(....... .......................................
.p6......J .......f.......M...|..............v?.......W.DDDDDDDDA.....
..A.......A.......A"q...".A"q...".A"q...".A"..%.".A"ar#.(.A"/..m .A..(
U...A.......A.......A.......A.......DDDDDDDD..........................
........................................


GET /download/langpacks/dl.php?build=31105&ref=client&client=utorrent&sys_l=en&sel_l=0&tk=beta HTTP/1.1
Host: utorrent.com
User-Agent: BTWebClient/3410(31105)
Accept-Encoding: gzip
Connection: Close


HTTP/1.1 301 Moved Permanently
Server: nginx/1.4.7
Date: Wed, 02 Jul 2014 08:33:40 GMT
Content-Type: text/html
Content-Length: 184
Connection: close
Location: hXXp://VVV.utorrent.com/download/langpacks/dl.php?build=31105&ref=client&client=utorrent&sys_l=en&sel_l=0&tk=beta
<html>..<head><title>301 Moved Permanently</title
></head>..<body bgcolor="white">..<center><h1&
gt;301 Moved Permanently</h1></center>..<hr><cent
er>nginx/1.4.7</center>..</body>..</html>....


POST /e?i=20 HTTP/1.1
Host: bench.utorrent.com
User-Agent: BTWebClient/3410(31105)
Accept-Encoding: gzip
Connection: Close
Content-Length: 299

{"h":"AJ_YwRVi29RbUrz-","cl":"uTorrent","v":109279617,"l":"en","w":"6.1","cts":1404290019,"eventName":"ap","fte":1,"lre":1,"ltic_0":0,"ltic_1":0,"lcic_0":0,"lcic_1":0,"laae":0,"lare":0,"laie":0,"lame":0,"name":"siteId","errCode":0,"requestTime":1404290019,"action":"client.az.error.badsiteid.33049"}
HTTP/1.1 200 OK
Content-Type: text/html
Date: Wed, 02 Jul 2014 08:33:51 GMT
Server: nginx/1.4.7
X-Powered-By: PHP/5.4.30
Content-Length: 21
Connection: Close
{"response_code":200}..


POST /e?i=27 HTTP/1.1
Host: bench.utorrent.com
User-Agent: BTWebClient/3410(31105)
Accept-Encoding: gzip
Connection: Close
Content-Length: 127

{"h":"AJ_YwRVi29RbUrz-","cl":"uTorrent","v":109279617,"l":"en","w":"6.1","cts":1404290018,"eventName":"embeddedIE","version":9}
HTTP/1.1 200 OK
Content-Type: text/html
Date: Wed, 02 Jul 2014 08:33:49 GMT
Server: nginx/1.4.7
X-Powered-By: PHP/5.4.30
Content-Length: 21
Connection: Close
{"response_code":200}..


POST /e?i=27 HTTP/1.1
Host: bench.utorrent.com
User-Agent: BTWebClient/3410(31105)
Accept-Encoding: gzip
Connection: Close
Content-Length: 127

{"h":"AJ_YwRVi29RbUrz-","cl":"uTorrent","v":109279617,"l":"en","w":"6.1","cts":1404290018,"eventName":"embeddedIE","version":9}
HTTP/1.1 200 OK
Content-Type: text/html
Date: Wed, 02 Jul 2014 08:33:44 GMT
Server: nginx/1.4.7
X-Powered-By: PHP/5.4.30
Content-Length: 21
Connection: Close
{"response_code":200}..


POST /api/analytics?action=pageview&label=EmailGatePage&category=79b5f927c68a0bc7f648e016404705ab4f86772403bfbd9c089194fbebe30203&value=0 HTTP/1.1
X-Requested-With: XMLHttpRequest
Accept: */*
Referer: hXXp://bundles.bittorrent.com/bundles/79b5f927c68a0bc7f648e016404705ab4f86772403bfbd9c089194fbebe30203?starttime=1393282818000&port=10627&pair=ADFC36D802A98BEB8DDDFD9BE07E8897AB050C2B&frameaddr=38a30e0&download=true
Accept-Language: en-us
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/5.0 (compatible; MSIE 10.0; Windows NT 6.1; WOW64; Trident/6.0)
Host: bundles.bittorrent.com
Content-Length: 0
Connection: Keep-Alive
Cache-Control: no-cache
Cookie: connect.sid=eyJwYXNzcG9ydCI6e319--5f19a0dc71d1127c1494f9a84f91312152a2ef2e


HTTP/1.1 200 OK
Content-Type: application/json; charset=utf-8
Content-Length: 2
Connection: keep-alive
Cache-Control: private, no-cache, max-age=0
Date: Wed, 02 Jul 2014 08:33:42 GMT
Set-Cookie: connect.sid=eyJwYXNzcG9ydCI6e319--5f19a0dc71d1127c1494f9a84f91312152a2ef2e; Path=/; Expires=Wed, 02 Jul 2014 12:33:42 GMT; HttpOnly
Vary: Accept-Encoding
X-Cache: Miss from cloudfront
Via: 1.1 2789f57a191cda188474bba6a2541f3a.cloudfront.net (CloudFront)
X-Amz-Cf-Id: 1ySXU5Wx_SXB8knTNoL8AtLEahAepqOX3KcYSK9u2TzLN1UGjIJIMA==
{}HTTP/1.1 200 OK..Content-Type: application/json; charset=utf-8..Cont
ent-Length: 2..Connection: keep-alive..Cache-Control: private, no-cach
e, max-age=0..Date: Wed, 02 Jul 2014 08:33:42 GMT..Set-Cookie: connect
.sid=eyJwYXNzcG9ydCI6e319--5f19a0dc71d1127c1494f9a84f91312152a2ef2e; P
ath=/; Expires=Wed, 02 Jul 2014 12:33:42 GMT; HttpOnly..Vary: Accept-E
ncoding..X-Cache: Miss from cloudfront..Via: 1.1 2789f57a191cda188474b
ba6a2541f3a.cloudfront.net (CloudFront)..X-Amz-Cf-Id: 1ySXU5Wx_SXB8knT
NoL8AtLEahAepqOX3KcYSK9u2TzLN1UGjIJIMA==..{}..


GET /MEQwQjBAMD4wPDAJBgUrDgMCGgUABBSxtDkXkBa3l3lQEfFgudSiPNvt7gQUAPkqw0GRtsnCuD5V8sCXEROgByACAwI6aQ== HTTP/1.1
Connection: Keep-Alive
Accept: */*
User-Agent: Microsoft-CryptoAPI/6.1
Host: gtglobal-ocsp.geotrust.com


HTTP/1.1 200 OK
Last-Modified: Sun, 29 Jun 2014 17:46:21 GMT
Expires: Sun, 06 Jul 2014 17:46:21 GMT
Content-Type: application/ocsp-response
content-transfer-encoding: binary
Content-Length: 1459
Cache-Control: max-age=378919, public, no-transform, must-revalidate
Date: Wed, 02 Jul 2014 08:33:44 GMT
Connection: keep-alive
0..........0..... .....0......0...0........Y0W1.0...U....US1.0...U....
GeoTrust Inc.100...U...'GeoTrust Global CA TGV OCSP Responder 2..20140
629174621Z0f0d0<0... ..........9.....yP..`...<.......*.A.....>
;U....... ...:i....20140629174621Z....20140706174621Z0...*.H..........
...W.u.|rp>.#.O..s~.<G.(.k./.I4AoL.>..!.;.gWi;h^.&]*.a...>
..AwZ.7...2.'G$1......o..&...d.v.I|..>.LP.;......o...a....._.....^y
1..Az.2*..mW./.N}...4j..sK..A!F..$0"..... OR6..|5.../..Wv...H.....|.3.
#J..ojT($\}..J.... )@..fK.)/1*..\.&.....3.Y&..U.N....h..............0.
..0...0..}........:p0...*.H........0B1.0...U....US1.0...U....GeoTrust
Inc.1.0...U....GeoTrust Global CA0...131122231748Z..141212231748Z0W1.0
...U....US1.0...U....GeoTrust Inc.100...U...'GeoTrust Global CA TGV OC
SP Responder 20.."0...*.H.............0...........b0..?.qg.M.Z0..$N.O.
o..Nz.a..I..x...:z....&.=...........6n.q.....V.e..*2:\..T..v..S8.z].."
. ...~9.....%#..Z..LF..........,.Z. .K.p...5".T....7b....ET..)7..|..C.
w@-.-8fT..F|..T....@XT...b.n`hx...& d^.&....?Q{`N..5g.4.~..6Bg...r|..]
. ..->.....3z...4}.a.C}.......0}0...U.#..0....z.h.....d..}.}e...N0.
.. .....0......0...U.%..0... .......0...U...........0$..U....0...0.1.0
...U....2048-TGV-4790...*.H.............z^..V.....<.%..eI(.....?...
.AT.v......gt..=........L0..1...uL}6..t......8}...?..Oi./..z.).....?G.
'lz.P....l.W....<."(.i] ...A/.z.$.j....2...D..7..GADZ....$.=....i..
.>.g $.3#.....t\...|U.<.....-..0....<....8$.KL.w....r......%.
.rJ.XL.juh....8.o.]..l....^D.....

<<< skipped >>>

GET /plus/utorrent/index.html HTTP/1.1
Host: utclient.utorrent.com
User-Agent: BTWebClient/3410(31105)
Accept-Encoding: gzip
Connection: Close


HTTP/1.1 200 OK
x-amz-id-2: jE71Za7yh0LceKYC9AZypMIWS46VbpT1q5ed1sSv Hbwc gDs A3RHjiNgrJr8l2
x-amz-request-id: F899E5248A4556BC
Date: Wed, 02 Jul 2014 08:33:43 GMT
Last-Modified: Fri, 18 Apr 2014 23:42:47 GMT
ETag: "ae4de37a73f20b44bc195a1b12d3a7c5"
Content-Type: text/html
Content-Length: 796
Server: AmazonS3
<html>...<head>....<script type='text/javascript' src='
../commonjs/jq.js'> </script>....<script type='text/javasc
ript' src='../commonjs/plusactive.js?ver=1'></script>....<
script type="text/javascript">.....$.ajax({......url: "hXXp://VVV.u
torrent.com/scripts/headers.php",......dataType: 'jsonp',......success
: function(headers) {.......country = headers['Geoip-Country-Code'];..
.....// Redirect US visitors.......if(country == 'US'){........setToUS
();.......}......}.....});....</script>....<script src="//cdn
.optimizely.com/js/240758443.js"></script>....<link href="
../commoncss/index.css" rel="stylesheet" type="text/css"/>....<m
eta charset=utf-8>....<title>Default : Plus Upgrade App</t
itle>...</head>...<body>....<iframe id='ifr' width='
100%' height='100%'> </iframe>...</body>..</html>
....


GET /bittorrent/image/upload/f_jpg,w_400,q_70/content-bundles/production-df0ec56d-0fbb-bc2c-11e7-354ff3af9c4e/53a0fc156e35310200e22f33/4nXTCoozQ8OBGW8wolSQ_zd_somewhere_else_final.jpg HTTP/1.1
Accept: */*
Referer: hXXp://bundles.bittorrent.com/bundles/79b5f927c68a0bc7f648e016404705ab4f86772403bfbd9c089194fbebe30203?starttime=1393282818000&port=10627&pair=ADFC36D802A98BEB8DDDFD9BE07E8897AB050C2B&frameaddr=38a30e0&download=true
Accept-Language: en-US
User-Agent: Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1; WOW64; Trident/6.0)
Accept-Encoding: gzip, deflate
Host: d2eri39gz1mfk5.cloudfront.net
Connection: Keep-Alive


HTTP/1.1 200 OK
Content-Type: image/jpeg
Content-Length: 52378
Connection: keep-alive
Accept-Ranges: bytes
Access-Control-Allow-Headers: X-Requested-With
Access-Control-Allow-Origin: *
ETag: "c1e78a884345a09eefead8e7e9557a5c"
Last-Modified: Thu, 19 Jun 2014 18:04:40 GMT
Server: cloudinary
Cache-Control: public, max-age=2592000
Date: Mon, 30 Jun 2014 18:25:31 GMT
Age: 137291
X-Cache: Hit from cloudfront
Via: 1.1 3ba457b8dbcd42a85d6e93515e26caad.cloudfront.net (CloudFront)
X-Amz-Cf-Id: -uZ_MGDMArn7CxiTKfMjdh4o-evT6y_8UjLVBlIBva54RlY0Na9S-g==
......JFIF.....,.,.....C...........................#.%$"."!& 7/&)4)!"0
A149;>>>%.DIC<H7=>;...C...........;("(;;;;;;;;;;;;;;;;;
;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;.....................................
...............L.........................!.1A.Qa.."2q....Vu...#5BR....
.br..$3....C.Dc%4Ss.................................;.................
......!..1..AQSq."2Bar........3R.#.C4b..............?..._..Fe.c. ..e..
....H..._9.....b....G..URI.........7........hx..\....x...>.....:...
hx..9..^.....7.........?.._...}/s....A........s..%..K...}..|..r.......
..x...>.....:...hx..9..^.....7.........?.._...}/s....A........s..%.
.K...}..|..r.........x...>.....:...hx..9..^.....7.........?.._...}/
s....A........s..%..K...}..|..r.........x...>.....:...hx..9..^.....
7.........?.._...}/s....A........s..%..K...}..|..r.........x...>...
..:...hx..9..^.....7.........?.._...}/s....A........s..%..K...}..|..r.
........x...>.....:...hx..9..^.....7.........?.._...}/s....A.......
.s..%..K...}..|..r.........x...>.....:...hx..9..^.....7.........?..
_...}/s....A........s..%..K...}..|..r.........x...>.....:...hx..9..
^.....7.........?.._...}/s....A........s..%..K...}..|..r.........x...&
gt;.....:...hx..9..^.....7.........?.._...}/s....A........s..%..K...}.
.|..r.........x...>.....:...hx..9..^.....7.........?.._...}/s....A.
.......s..%..K...}..|..r.........x...>.....:...hx..9..^.....7......
...?.._...}/s....A........s..%..K...}..|..r.........x...>.....:...h
x..9..^.....7.........?.._...}/s....A........s..%.hX...........vn7

<<< skipped >>>

GET /collect?v=1&_v=j23&a=36551962&t=pageview&_s=2&dl=http://bundles.bittorrent.com/bundles/79b5f927c68a0bc7f648e016404705ab4f86772403bfbd9c089194fbebe30203?starttime=1393282818000&port=10627&pair=ADFC36D802A98BEB8DDDFD9BE07E8897AB050C2B&frameaddr=38a30e0&download=true&dp=/bundles/79b5f927c68a0bc7f648e016404705ab4f86772403bfbd9c089194fbebe30203&ul=en-us&de=utf-8&dt=Somewhere Else | BitTorrent Bundle&sd=24-bit&sr=1716x901&vp=973x534&je=1&_u=eKAAgIgS~&jid=&cid=f862f0b3-a9cb-437c-941f-9f54e60b13bf&tid=UA-43671923-1&z=628595388 HTTP/1.1
Accept: */*
Referer: hXXp://bundles.bittorrent.com/bundles/79b5f927c68a0bc7f648e016404705ab4f86772403bfbd9c089194fbebe30203?starttime=1393282818000&port=10627&pair=ADFC36D802A98BEB8DDDFD9BE07E8897AB050C2B&frameaddr=38a30e0&download=true
Accept-Language: en-US
User-Agent: Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1; WOW64; Trident/6.0)
Accept-Encoding: gzip, deflate
Host: VVV.google-analytics.com
Connection: Keep-Alive


HTTP/1.1 200 OK
Pragma: no-cache
Expires: Mon, 07 Aug 1995 23:30:00 GMT
Access-Control-Allow-Origin: *
Last-Modified: Sun, 17 May 1998 03:00:00 GMT
X-Content-Type-Options: nosniff
Content-Type: image/gif
Date: Fri, 20 Jun 2014 03:06:23 GMT
Server: Golfe2
Content-Length: 35
Age: 1056440
Cache-Control: private, no-cache, no-cache=Set-Cookie, proxy-revalidate
Alternate-Protocol: 80:quic
GIF89a.............,...........D..;HTTP/1.1 200 OK..Pragma: no-cache..
Expires: Mon, 07 Aug 1995 23:30:00 GMT..Access-Control-Allow-Origin: *
..Last-Modified: Sun, 17 May 1998 03:00:00 GMT..X-Content-Type-Options
: nosniff..Content-Type: image/gif..Date: Fri, 20 Jun 2014 03:06:23 GM
T..Server: Golfe2..Content-Length: 35..Age: 1056440..Cache-Control: pr
ivate, no-cache, no-cache=Set-Cookie, proxy-revalidate..Alternate-Prot
ocol: 80:quic..GIF89a.............,...........D..;..


POST /api/analytics?action=download&label=PublicTorrent&category=79b5f927c68a0bc7f648e016404705ab4f86772403bfbd9c089194fbebe30203&value=0 HTTP/1.1
X-Requested-With: XMLHttpRequest
Accept: */*
Referer: hXXp://bundles.bittorrent.com/bundles/79b5f927c68a0bc7f648e016404705ab4f86772403bfbd9c089194fbebe30203?starttime=1393282818000&port=10627&pair=ADFC36D802A98BEB8DDDFD9BE07E8897AB050C2B&frameaddr=38a30e0&download=true
Accept-Language: en-us
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/5.0 (compatible; MSIE 10.0; Windows NT 6.1; WOW64; Trident/6.0)
Host: bundles.bittorrent.com
Content-Length: 0
Connection: Keep-Alive
Cache-Control: no-cache
Cookie: connect.sid=eyJwYXNzcG9ydCI6e319--5f19a0dc71d1127c1494f9a84f91312152a2ef2e


HTTP/1.1 200 OK
Content-Type: application/json; charset=utf-8
Content-Length: 2
Connection: keep-alive
Cache-Control: private, no-cache, max-age=0
Date: Wed, 02 Jul 2014 08:33:42 GMT
Set-Cookie: connect.sid=eyJwYXNzcG9ydCI6e319--5f19a0dc71d1127c1494f9a84f91312152a2ef2e; Path=/; Expires=Wed, 02 Jul 2014 12:33:42 GMT; HttpOnly
Vary: Accept-Encoding
X-Cache: Miss from cloudfront
Via: 1.1 d84cd5311ccca1f37f90f1eed9f01585.cloudfront.net (CloudFront)
X-Amz-Cf-Id: bPV2mozagicH0oMTL85YYiBHZ4IxVb-EtWFvot4VjFsisybQFaUfXQ==
{}HTTP/1.1 200 OK..Content-Type: application/json; charset=utf-8..Cont
ent-Length: 2..Connection: keep-alive..Cache-Control: private, no-cach
e, max-age=0..Date: Wed, 02 Jul 2014 08:33:42 GMT..Set-Cookie: connect
.sid=eyJwYXNzcG9ydCI6e319--5f19a0dc71d1127c1494f9a84f91312152a2ef2e; P
ath=/; Expires=Wed, 02 Jul 2014 12:33:42 GMT; HttpOnly..Vary: Accept-E
ncoding..X-Cache: Miss from cloudfront..Via: 1.1 d84cd5311ccca1f37f90f
1eed9f01585.cloudfront.net (CloudFront)..X-Amz-Cf-Id: bPV2mozagicH0oMT
L85YYiBHZ4IxVb-EtWFvot4VjFsisybQFaUfXQ==..{}..


GET /offers/streaming/img/visa-mastercard.png HTTP/1.1
Accept: */*
Referer: hXXp://utclient.utorrent.com/offers/streaming/index.html?port=10627&pair=AAF51F5F564AD28FFCFB5020BDB00283A1ED40A1&frameaddr=68242f8&plus=0&cid=AJ_YwRVi29RbUrz-&code=4
Accept-Language: en-US
User-Agent: Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1; WOW64; Trident/6.0)
Accept-Encoding: gzip, deflate
Host: utclient.utorrent.com
Connection: Keep-Alive


HTTP/1.1 200 OK
x-amz-id-2: pr8wCPCAeNVTvdp4azJwSDk8iad5IsnQAaZZTAxfUY0RMzeVkQ4q6FWydhCnDkpo
x-amz-request-id: 351B230771A33EE7
Date: Wed, 02 Jul 2014 08:33:46 GMT
x-amz-meta-s3cmd-attrs: uid:107/gname:nogroup/uname:jenkins/gid:65534/mode:33188/mtime:1397098235/atime:1397256192/md5:e566e67bca2dc3e2bdad0ed379046eea/ctime:1397098235
Content-Encoding: UTF-8
Last-Modified: Fri, 11 Apr 2014 23:16:11 GMT
ETag: "e566e67bca2dc3e2bdad0ed379046eea"
Content-Type: image/png
Content-Length: 6222
Server: AmazonS3
.PNG........IHDR...d...#.....b.......IDATh..Z..]Uy....;w....f2I...@"..
$"..D...V(..V).b...j].W]..-...%............"...y'.Lf2..}.....9w....".=
..>g.........{...d...u....W.......|...<....pM.h.........[F....^.
..Z.....q..-..^}..X,V3.........2}......{...../.......i...Ko=;.Hv....x.
..H%...~..M U.....z.T...O. *..B.\v.A92....'..#.P(.WD8m.y...7...k.\R*..
....3...i.m..LQ.,E..&*.[....B..;........W...u..oj.C.....H..p..2.....S
..xi...HL.! ...J...j..a...Pa..?....$.\.z......&"9.T....cr..../..cF...v
Af.e.../..U...O.P(rU...{...B.G....k.. *RU.C.}...........>..E.h.8r."
.]6..?....$.\.....b.4Jg..r"0...v..~?T..Q..#.x..,9..Ow........\..h".J..
..J.*.....X2..k.}.....f..e.... m=....J..1pY....Lz..r@......^.R..7..W..
.14..p.RF.PB.X.J..9..B..4t.T)....@~b..|....... .K!..C<...'.>=...
$.C...".M 6./.qV....e..B...%.......27P...3..,.J.......0*...d`f2@.FE..1
.[.%.U&..5...Ed.z..9.K.9..-cq..&..ru.."....F=<t2.r.\$.fs..p.( 3|...
alX~..-.Eg.8..E..(N.Fp.?...Z.m.<...H..F. W.....H.....I..H....P.&..4
....>.CZ&@.,.....h!S.)....?....!.. .I....Q$........,...D.RW.......K
..t.....w^<.J....0..~..X...p.%_..C...7.F...^.y..^..6?...{r....6j[.e
Y.e.8Z%....B.B)......Y...8C.L..$.g.....U...Y.L.......l.....`..<....
.Z..g.9.....s....a...2.....w.@....q..XW..'.z....E{. .#ydhn!y.? .....".
J3....38...|..1.e..Z.Z.[.eX...R.Z.\V..p..a!.#pz.L..n......*.p.a...,D..
n...a....=..S{........8..A......"...Y...G...0w.z\Ww.sk.P*.P.......2S.
.Y...;:.....Yt4../W=.....q...m....E..i.ZH.`.....k..'o&...K.3...;.(`T."
...*\4.K..\..1...w............9 4(..z..^A..r|.ob...lAj.Jt}.. n.(..

<<< skipped >>>

GET /offers/streaming/img/mobile-payment.png HTTP/1.1

Accept: */*
Referer: hXXp://utclient.utorrent.com/offers/streaming/index.html?port=10627&pair=AAF51F5F564AD28FFCFB5020BDB00283A1ED40A1&frameaddr=68242f8&plus=0&cid=AJ_YwRVi29RbUrz-&code=4
Accept-Language: en-US
User-Agent: Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1; WOW64; Trident/6.0)
Accept-Encoding: gzip, deflate
Host: utclient.utorrent.com
Connection: Keep-Alive


HTTP/1.1 200 OK
x-amz-id-2: ATXrZyG6z551LRyB3ttnrO t4ktqvymBIUq/BmpnNp9nfawN9ahksS0ctlAdY3UL
x-amz-request-id: 367424F4C375B924
Date: Wed, 02 Jul 2014 08:33:46 GMT
x-amz-meta-s3cmd-attrs: uid:107/gname:nogroup/uname:jenkins/gid:65534/mode:33188/mtime:1397098235/atime:1397256192/md5:bb13ae5a763b3c8b787bd17bb4a2aee2/ctime:1397098235
Content-Encoding: UTF-8
Last-Modified: Fri, 11 Apr 2014 23:16:11 GMT
ETag: "bb13ae5a763b3c8b787bd17bb4a2aee2"
Content-Type: image/png
Content-Length: 1601
Server: AmazonS3
.PNG........IHDR...J..."......wOF....IDATh....kdE...L.dAD....0{../.w..
...{q....E..._....X...a.z...{59x...x.....I..........................._
.cj.....,...C..!.:.......z.4..~..D.xB=....~...X...~......?....=}@..4.E
Q....6j../F.(.D'........TD..=(XF...j.....%.7....?...e._..eu...e.q.U.M.
8...G.~<....R..W@..I&.. )..........LweeE..P..ZjP..!....l..k...:.e.E
:..Vv.....y......:??.g...z.....\:[..B~.HG....}dz|.Jf$[.>....l.c.P..
..... .-. .*..E.. ..X..Rs.'...!4........H..l......"8....z.>'..C..R
/.Y.h.*.M)g.g v..#...."..Z....)-..?.u%...Q......b. u..=u.LN.r....ls`..
..t.8.6%#..W;*..E.........4..j.......7.......y.*.H=.%Lp.@.Y.Pn./5.k.8.
f...0w..a.A_*.X.M.(.@.....F...I....6b.Q.Y.I.....fQ..Nu.7..f..h>....
R@..n............`.6...].JCE.....Qzy}S..e.K..N..I...D....R............
..;..A...;D.....L..C.`.x.6.%...........@R.d;k...)*.9..[v......=w..b<
;...:.8........3.rsJ}a.#DQ.$/.....b...E}#.....0...8.zc]PU.........?kR.
...].._...lL...?.......k.foz.'.E..M.Z}L......q?..[YD...q.....~.;M.h..O
t......tZ.=/l....'.....x...\wD...!..........K..^.qs...ve@1.....|c.O,c.
.f.].-|mmMG.]u.....................N...=....l...%h.j.Q...K:..&..k.,H..
.@x.....t./....`z...x..J....b......Z;W.pt...<.|....u.s.q.$.T.Q,."#D
....;<1........:o.(.....f.k.H6z....L{..............D...R9P.k.~...41
.....u.....AD.E.6...%..wa....i..{}\.T....P..e.....,..<..N..r_,i.(..
.....H..p.,x.M.p...."E.... ....S....|...>}*..(..l`&.(....M...>.M
)..~.....Q4...wCl2.7D.XW..t.4u_]G....Lp...E.K...H..i.Ei.....y.E@...{h.
u.~.[i...M.[../^...iJ...O.x...Kk....b.FX...2.E....U...S......E.Q.p

<<< skipped >>>

GET /offers/streaming/img/devices-02.png HTTP/1.1

Accept: */*
Referer: hXXp://utclient.utorrent.com/offers/streaming/index.html?port=10627&pair=AAF51F5F564AD28FFCFB5020BDB00283A1ED40A1&frameaddr=68242f8&plus=0&cid=AJ_YwRVi29RbUrz-&code=4
Accept-Language: en-US
User-Agent: Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1; WOW64; Trident/6.0)
Accept-Encoding: gzip, deflate
Host: utclient.utorrent.com
Connection: Keep-Alive


HTTP/1.1 200 OK
x-amz-id-2: oqFlO95lrdDADTGEjFEkPGGQa6RJcAi2zomhD5SDlqBHiw0tbZi6DeachrW3AZ0V
x-amz-request-id: 1BE03C2F41BE911D
Date: Wed, 02 Jul 2014 08:33:46 GMT
x-amz-meta-s3cmd-attrs: uid:107/gname:nogroup/uname:jenkins/gid:65534/mode:33188/mtime:1395949858/atime:1395949858/md5:fcdb4ec7ff65c03f54f3ce0d2757ba47/ctime:1395949858
Content-Encoding: UTF-8
Last-Modified: Thu, 27 Mar 2014 19:51:01 GMT
ETag: "fcdb4ec7ff65c03f54f3ce0d2757ba47"
Content-Type: image/png
Content-Length: 9348
Server: AmazonS3
.PNG........IHDR...............8...$KIDATx...g...u.OO..MX`.....@.$..Q.
.H...)..-..d..~..e.....r...P../..-.r..$K.(R.I..I. ......s..4..9M.rgw.'
...;.....N.........\.\J###..3....O.........l.D...}....L....M.l..o&....
7d...m..4.W....O...g..4.>..=0>..../...*. ..%../.GY4..TB...!..*_.
.t...D`.L.......i.o.)..?.X..\..*L2........8::..b..|.b..Pq.Z..}.4MK ...
..x......|.. `...k...C"...>_.....UTTP0.......N> N*...M.....N....
....t^..........8%.I...4.&q.....*8.E.0(m..I.....*...:.....$......n@8..
....g-.nFRKs.....2..K ...u$....$.5...6.1.DVmo.T0* ..m[;ez1.p..[YUA..g_
s.j._....\.d5..@..t'......?..H..."l.....@0t.A......`....@@w....k......
....)......u.A.......-.O.zl..f.*.U......tP8.v../....e...R .O.hp..].{.
"...E..1-u....Nj..I{..NB0.T...d.LE.....X-..B.......O[.....q....=..5.ax
...K..........*...>.2@....-olG..}..............o.....\$..x~.k..]*8.
..B0T.E.eE`a}....^.e.....#.........(.z....C...w..#_\......C...]..!..H.
...tF...u..e.pe..J..L.=9....;........E....tk.......f#.J.<....aU.jC.
.#..$_.x2*1.......R.....{.....Mo.J_.td.......?x.u5.L.'.@#..6........j.
?..>.n.`.D:._*..In..D.y"...e..o..mM...?..l@....E.K.. .T..Gwu~..7.No
.?MK.3..-....>..".C...l..u.:{.n..#..k...........P{C?.o... .....s...
..M2%..#.H.......H..f.,6b...6#.NB0...;.Y/ .VWf_.D2..r^...4a.......>
....y...n.t...-..>e......$.e....PP.2$....g\?P.....Hz.O...u6.(& <
...P0....&E$.O>K........).b.C0.%...A.-.wS..a.|.A.]..Sm. ...:p..."..
2d.U.#.k.Y].../....y...H.;..<..........2.y#....>BA.U...M..<..
.`.5 ....5.C..z...e../&..t.Xv...a8.\.*...-......#...e......:.....Z

<<< skipped >>>

GET /offers/streaming/js/client2.js HTTP/1.1

Accept: */*
Referer: hXXp://utclient.utorrent.com/offers/streaming/index.html?port=10627&pair=AAF51F5F564AD28FFCFB5020BDB00283A1ED40A1&frameaddr=68242f8&plus=0&cid=AJ_YwRVi29RbUrz-&code=4
Accept-Language: en-US
User-Agent: Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1; WOW64; Trident/6.0)
Accept-Encoding: gzip, deflate
Host: utclient.utorrent.com
Connection: Keep-Alive


HTTP/1.1 200 OK
x-amz-id-2: j otd8J1P8 AWlMbSx7tQ7RtwF zOAZWWVQ3x5jvDpZGMxpGKGfU7OJg9DLe7WUg
x-amz-request-id: 2B2C3B0F4011C88E
Date: Wed, 02 Jul 2014 08:33:47 GMT
x-amz-meta-s3cmd-attrs: uid:107/gname:nogroup/uname:jenkins/gid:65534/mode:33188/mtime:1397258161/atime:1397258161/md5:0040b4fa3e7d5cc2a00b403b4101b63c/ctime:1397258161
Content-Encoding: UTF-8
Last-Modified: Fri, 11 Apr 2014 23:16:11 GMT
ETag: "0040b4fa3e7d5cc2a00b403b4101b63c"
Content-Type: application/javascript
Content-Length: 7804
Server: AmazonS3
var TorrentClient = {..    //list of listeners added using TorrentClie
nt.on. listeners: {. 'addtorrent': {. all: [].
},. 'torrentchange': {. all: []. },.
'removetorrent': {. all: []. },. 'filedow
nload': {. all: []. }. },.. //convert torrentA
rray, an array sent by the client describing a torrent. //into a Ja
vaScript object with the correct property names. _torrentArrayToObj
ect: function(torrentArray) {. var cur = Date.now();. re
turn {. "hash": torrentArray[0],. "last": cur,.
"fcount": 0,. "status": torrentArray[1],.
"name": torrentArray[2],. "size": torrentArray[3],.
"progress": torrentArray[4] / 10.0,. "downloaded":
torrentArray[5],. "uploaded": torrentArray[6],.
"ratio": torrentArray[7],. "upspeed": torrentArray[8],.
"downspeed": torrentArray[9],. "eta": torrentArray
[10],. "label": torrentArray[11],. "numpeers": t
orrentArray[12],. "swpeers": torrentArray[13],.
"numseeds": torrentArray[14],. "swseeds": torrentArray[15],
. "avail": torrentArray[16],. "queue": torrentAr
ray[17],. "remaining": torrentArray[18],. "files
": []. };. },.. _fileArrayToObject: function(fileArray) {
. return {. 'name': fileArray[0],. 's

<<< skipped >>>

GET /offers/streaming/js/main.js HTTP/1.1

Accept: */*
Referer: hXXp://utclient.utorrent.com/offers/streaming/index.html?port=10627&pair=AAF51F5F564AD28FFCFB5020BDB00283A1ED40A1&frameaddr=68242f8&plus=0&cid=AJ_YwRVi29RbUrz-&code=4
Accept-Language: en-US
User-Agent: Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1; WOW64; Trident/6.0)
Accept-Encoding: gzip, deflate
Host: utclient.utorrent.com
Connection: Keep-Alive


HTTP/1.1 200 OK
x-amz-id-2: zPlAiVNNla3wEvGh8zaiKF5shbtwBU5fph5PNcEwO0JvLZRacgVpGv37FL3us5CT
x-amz-request-id: 118C047FF0839EB5
Date: Wed, 02 Jul 2014 08:33:47 GMT
x-amz-meta-s3cmd-attrs: uid:107/gname:nogroup/uname:jenkins/gid:65534/mode:33188/mtime:1397258161/atime:1397258161/md5:6ea5ff2e8aee09fa1b49d77afe09fd12/ctime:1397258161
Content-Encoding: UTF-8
Last-Modified: Fri, 11 Apr 2014 23:16:11 GMT
ETag: "6ea5ff2e8aee09fa1b49d77afe09fd12"
Content-Type: application/javascript
Content-Length: 314
Server: AmazonS3
'use strict';.if (!window.btapp) {.    window.btapp = {.        'fake'
: true,. 'erase_offer': function() {. alert('dismiss
offer page');. },. 'reveal_offer': function() {}. };
.}..$(document).ready(function() {. btapp.reveal_offer(true, 0);.
jQuery.support.cors = true;.});.
....



GET /offers/streaming/js/streaming.js HTTP/1.1

Accept: */*
Referer: hXXp://utclient.utorrent.com/offers/streaming/index.html?port=10627&pair=AAF51F5F564AD28FFCFB5020BDB00283A1ED40A1&frameaddr=68242f8&plus=0&cid=AJ_YwRVi29RbUrz-&code=4
Accept-Language: en-US
User-Agent: Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1; WOW64; Trident/6.0)
Accept-Encoding: gzip, deflate
Host: utclient.utorrent.com
Connection: Keep-Alive


HTTP/1.1 200 OK
x-amz-id-2: TG50yALkHdNYAUErJzdU 6t6kZezrgwDhX3cKXHwgIk/895kG83jwUGjg4kO3OAx
x-amz-request-id: 5842FF6DDBE0CC91
Date: Wed, 02 Jul 2014 08:33:47 GMT
x-amz-meta-s3cmd-attrs: uid:107/gname:jenkins/uname:jenkins/gid:120/mode:33188/mtime:1402612153/atime:1402612153/md5:70b712d7e53faecd4663e2459d1ce8db/ctime:1402612153
Last-Modified: Thu, 12 Jun 2014 22:29:19 GMT
ETag: "70b712d7e53faecd4663e2459d1ce8db"
Content-Type: application/javascript
Content-Length: 2534
Server: AmazonS3
'use strict';..var reveal_interval;..function waitAndDisableOffer(sour
ce) {. setTimeout(function() {. clearInterval(reveal_interva
l);. // We don't have a way to signal 'never again' in this lay
out. btapp.erase_offer(false);. }, 300);.}..function sendGaq
PageView(pageView) {. if (_gaq && typeof _gaq.push === 'function')
{. _gaq.push(['_trackPageview', pageView]). }.}.var frame =
0;..function animateThumbnail() {. frame = (frame 1) % 45;. bt
app.reveal_offer(false, frame);.}..function torrentClientCallback (fil
e) {..if(isMediaFile(file)) {...setInterval(animateThumbnail, 67);...T
orrentClient.off('filedownload', torrentClientCallback);..}.}..functio
n isMediaFile(file) {. var mediaExt = ['avi', 'mp4', 'mov', 'mpg',
'mp3', 'ac3', 'wma', 'wmv', 'asf', 'mkv', 'flv'];. var file_ext = f
ile.name.split('.');. file_ext = file_ext[file_ext.length - 1];.
return mediaExt.indexOf(file_ext) !== -1;.}..$(document).ready(functi
on($) {. jQuery.support.cors = true;.. btapp.reveal_offer(true,
0);.. $('#premium').click(function() {. $('#page1').hide();.
$('#page2').show();. sendGaqPageView('premiumButton');.
});. $('#free').click(function() {. waitAndDisableOffer(
);. sendGaqPageView('freeButton');. });. $('#page_3_close
').click(function() {. waitAndDisableOffer();. sendGaqPa
geView('backToUTorrentButton');. });. $('#page1-no-x').click(fun
ction() {. waitAndDisableOffer();. sendGaqPageView('

<<< skipped >>>

GET /beta/utorrent.32176.installer.exe?au=1&hash=dd9a941e25f0ad9b3f5562ca0e668f869503b1a4 HTTP/1.1
Host: ll.download3.utorrent.com
User-Agent: BTWebClient/3410(31105)
Accept-Encoding: gzip
Connection: Close


HTTP/1.1 200 OK
Server: nginx/1.4.7
Content-Type: application/octet-stream
Cache-Control: max-age=86400
Accept-Ranges: bytes
Age: 7866
Date: Wed, 02 Jul 2014 08:33:41 GMT
Last-Modified: Tue, 01 Jul 2014 06:18:09 GMT
Expires: Thu, 03 Jul 2014 06:22:35 GMT
Content-Length: 1338704
Connection: close
MZ......................@................................... .........
..!..L.!This program cannot be run in DOS mode....$..........B........
....;t_.....T.U.....T.W.....T.V.....&........:V.n.....................
..........5....:W......:Q..............:T.....Rich....................
........PE..L....E.S.................p........$..n6...$...6...@.......
...................p8.............................................._8.
......6..............T..P...........................................@z
6.H...........................................UPX0......$.............
................UPX1.....p....$..l..................@....rsrc.........
6......p..............@...............................................
......................................................................
......................................................................
......................................................................
......................................................................
.......3.00.UPX!....X....QcI.H6.v^....2.I...... ?..@D`.?..JP{:........
:)..;(...n.q:PC.8P.....K"...$&........Yv.....|.]F .........o.h..O]...s
.....2....>t.......n...=......9t2R...f0..R[...<:.C8.....`.~..,.L
.?.F9OF.xw.....z.....8t.*..m.s.......$..[...;.E....4...1l..q..E..!...:
...l.v.O Jx}1...}|....^...|...I.72'.........Zq.....%...^/.e ...$n.8.e.
F.J....6....kN..3...Y...T...||....A..).@}.~.'..|d..l...;.~.....lj.C...
.. .v..........F5..d$....0.GxE.5.R.G...(.].....x7........g4`.6m.....1.
...>.....c..:.`......0J..--X..........M.).y....IF.I.!...`......

<<< skipped >>>

POST /api/v2 HTTP/1.1
Host: engine.ap.bittorrent.com
User-Agent: Mozilla/5.0 (compatible; MSIE 10.0 Windows NT 6.1; WOW64; Trident/6.0; EIE10; ENUSMSN)(31105)
Accept-Encoding: gzip
content-type: application/json
Connection: Close
Content-Length: 361

{ "keywords": [ "clientdata=utorrent|3.4.1.31105|82", "IEVersion=10", "flash=none" ], "placements": [ { "adTypes": [ 9 ], "divName": "lrec", "networkId": 5682, "properties": { "IEVersion": 10, "campaigncode": 82, "featurelevel": 0, "flash": "none", "major": 3, "minor": 4, "product": "utorrent", "tag": "", "tiny": 1, "version": 31105 }, "siteId": "33049" } ] }
HTTP/1.1 200 OK
Access-Control-Allow-Headers: accept, origin, content-type, content-length
Access-Control-Allow-Methods: GET,PUT,POST,DELETE,OPTIONS
Access-Control-Allow-Origin: *
Content-Type: application/json
Date: Wed, 02 Jul 2014 08:36:37 GMT
ETag: "-1318872250"
Server: nginx/1.1.19
Set-Cookie: azk=ue1-6cfdbcdca446446fb01fd14480deb64a; Path=/; Expires=Thu, 02 Jul 2015 08:36:37 GMT
x-powered-by: adzerk bifrost/
x-served-by: engine-us-east-1a-10
Content-Length: 2299
Connection: Close
{"user":{"key":"ue1-6cfdbcdca446446fb01fd14480deb64a"},"decisions":{"l
rec":{"adId":455171,"creativeId":369533,"flightId":232916,"campaignId"
:127387,"clickUrl":"hXXp://engine.ap.bittorrent.com/r?e=eyJhdiI6NTk1OT
csImF0Ijo5LCJjbSI6MTI3Mzg3LCJjaCI6ODc4NSwiY3IiOjM2OTUzMywiZGkiOiIwNDgy
ZmM0ODllOGI0OGQxOTcwZGU5Zjc0MDE5N2M1ZCIsImRtIjozLCJmYyI6NDU1MTcxLCJmbC
I6MjMyOTE2LCJpcCI6IjE5My4xMzguMjQ0LjIzMSIsImt3IjoiY2xpZW50ZGF0YT11dG9y
cmVudHwzLjQuMS4zMTEwNXw4MixpZXZlcnNpb249MTAsZmxhc2g9bm9uZSIsIm53Ijo1Nj
gyLCJwYyI6MC4xLCJwciI6MjM3NTUsInJ0IjozLCJzdCI6MzMwNDksInVrIjoidWUxLTZj
ZmRiY2RjYTQ0NjQ0NmZiMDFmZDE0NDgwZGViNjRhIiwidHMiOjE0MDQyOTAxOTc3NjIsIn
VyIjoiaHR0cDovL3d3dy5jYXNpbm8uY29tL3J1Lz9TSUQ9MjA1MDc0JnA9MSJ9&s=3fCkP
O66-fICqkJEYUIrA9JWDc0","impressionUrl":"hXXp://engine.ap.bittorrent.c
om/i.gif?e=eyJhdiI6NTk1OTcsImF0Ijo5LCJjbSI6MTI3Mzg3LCJjaCI6ODc4NSwiY3I
iOjM2OTUzMywiZGkiOiIwNDgyZmM0ODllOGI0OGQxOTcwZGU5Zjc0MDE5N2M1ZCIsImRtI
jozLCJmYyI6NDU1MTcxLCJmbCI6MjMyOTE2LCJpcCI6IjE5My4xMzguMjQ0LjIzMSIsImt
3IjoiY2xpZW50ZGF0YT11dG9ycmVudHwzLjQuMS4zMTEwNXw4MixpZXZlcnNpb249MTAsZ
mxhc2g9bm9uZSIsIm53Ijo1NjgyLCJwYyI6MC4xLCJwciI6MjM3NTUsInJ0IjozLCJzdCI
6MzMwNDksInVrIjoidWUxLTZjZmRiY2RjYTQ0NjQ0NmZiMDFmZDE0NDgwZGViNjRhIiwid
HMiOjE0MDQyOTAxOTc3NjIsImZxIjoxfQ&s=_dkqk6fdSoQAgWHd01Qej3p10WE","cont
ents":[{"type":"html","body":"<a href=\"hXXp://engine.ap.bittorrent
.com/r?e=eyJhdiI6NTk1OTcsImF0Ijo5LCJjbSI6MTI3Mzg3LCJjaCI6ODc4NSwiY3IiO
jM2OTUzMywiZGkiOiIwNDgyZmM0ODllOGI0OGQxOTcwZGU5Zjc0MDE5N2M1ZCIsImRtIjo
zLCJmYyI6NDU1MTcxLCJmbCI6MjMyOTE2LCJpcCI6IjE5My4xMzguMjQ0LjIzMSIsI

<<< skipped >>>

GET /offers/mediaCaster_default_grey.bmp HTTP/1.1
Host: ll.download3.utorrent.com
User-Agent: BTWebClient/3410(31105)
Accept-Encoding: gzip
Connection: Close


HTTP/1.1 404 Not Found
Server: nginx/1.4.7
Content-Type: text/html
Age: 4
Date: Wed, 02 Jul 2014 08:31:59 GMT
Expires: Wed, 02 Jul 2014 08:32:05 GMT
Content-Length: 168
Connection: close
<html>..<head><title>404 Not Found</title><
/head>..<body bgcolor="white">..<center><h1>404 N
ot Found</h1></center>..<hr><center>nginx/1.4.
7</center>..</body>..</html>....


GET / HTTP/1.1
Host: bundles.bittorrent.com
User-Agent: BTWebClient/3410(31105)
Accept-Encoding: gzip
Connection: Close


HTTP/1.1 200 OK
Content-Type: text/html; charset=utf-8
Transfer-Encoding: chunked
Connection: close
Cache-Control: public, max-age=300
Content-Encoding: gzip
Date: Wed, 02 Jul 2014 08:29:48 GMT
ETag: W/"4b3c-3136939183"
Set-Cookie: connect.sid=eyJwYXNzcG9ydCI6e319--5f19a0dc71d1127c1494f9a84f91312152a2ef2e; Path=/; Expires=Wed, 02 Jul 2014 12:29:48 GMT; HttpOnly
Vary: Accept-Encoding
Age: 227
X-Cache: Hit from cloudfront
Via: 1.1 d84cd5311ccca1f37f90f1eed9f01585.cloudfront.net (CloudFront)
X-Amz-Cf-Id: gNjI4Y1TtW2aDK9sTJE8HhsdutXqG6mqvsrOHcp6Cm5vWyp6l97DxQ==
1c3b.............<.S...?.....UJ...."l."...Z...R....d....u]....g&.^.
9.....uN...t...s&....].....i0.]... ....0..zM8{.....8*.3..5.q..}.H.DU..
,.y.~...3.B.p0$.i[..t.=.._.........|....;..l.i?".b..I.......(.tz}.....
.H.>>..g/.!xY.M... .]...^...? .z...}Vf.....(S......G..i.#Ix....n
p..(.Z1.2..#.aN.]0....@........i.,.....C.....t../..xFD.p..80.^..9!.1..
9..5...]...</\/H.z..`....m.4m...v..r...}...,t.?7..>.h[.>4...%
.{.!.....V.6h....O.u%...b;...{....'...~..*.y...6...g./]PU..U`.eqLtX...
.tn.......U....@a.......$q|rO^`.8>/.O.b..F.....~..a0.;;..n...9.K..r
.fs...x......t...?.J....tS......6.5...K.$|..*.e..'.l:...P..K......)...
$P:.$...h......6K....y.1.n. ..j.*......".F.7.P.<.YK.. ..Dv...-x)h.V
....G......... .....^W.r.=....*2K....#.$.J...!y,{$XzH..tKDZ.....V|.I..
.C.Q...j.ZBr!.... [..b..e.....3..e..X....G).e.zUK..4...... ...!jOs...
.k.......ee_s..#...*.%0._,.K.>\>*.Z/).(.\....).H..$........,...d
.b.{].68G......b....^]...dn.%g.._W.r....2.[.l....YZ^...Z.Rh].<.....
..c...4..4.".?...c..K..6.....to......T:P.U.C....9.}..-x{.CH..=8.`*8...
......^..S..e:.w..A...FX..v...........)\....I...-8. \.}.R.TwLp.....:.`
.......m.u(w...*....LX.... a....4%y}"..<.....j..).....s.......E...)
..~..O.....a*H....r.- ....y..!*.........|D.K.q....6D...p..,<7pq_..(
...@AB1d.....kv..(D..UH.>p.<.T..%......<.I................ 1.
.py.E..$A.....I..H...a....A............/..B.T>)..iI-.LcJ.......e..%
...W.j&.q...'p...3.........G......(.i..hS......#.VQ.ST.Pi.28^........n
r.B.j.........L...].A.6fG.g.f-.....y....14.:..-!..?C...O..:....=}.

<<< skipped >>>

GET /announce?info_hash=Nu=û|¤Š³)¯hþ¿ «U&peer_id=-UT341-yа"M
c=&port=10627&uploaded=0&downloaded=0&left=295942403&corrupt=0&key=31975450&event=started&numwant=200&compact=1&no_peer_id=1&ipv6=2001:0:5ef5:79fb:44e:a454:3e75:b18 HTTP/1.1
Host: tracker.bundles.bittorrent.com
User-Agent: uTorrent/341(109279617)(31105)
Accept-Encoding: gzip
Connection: Close


HTTP/1.1 404 Object Not Found
Cache-Control: no-cache, no-store
Content-Type: text/html; charset=utf-8
Date: Wed, 02 Jul 2014 08:33:58 GMT
Server: MochiWeb/1.0 (Any of you quaids got a smint?)
Content-Length: 2960
Connection: Close
<!DOCTYPE html>.    <html>.    <head>.      <titl
e>Heroku | No such app</title>. <style type='text/css
'>. body {. background-color: white;. color: #33
3333;. font-family: Arial, sans-serif;. margin: 0;.
padding: 36px;. line-height: 1;. font-size: 14px; }
.. .section {. margin-bottom: 36px; }. .section.fri
endly {. color: #222222; }. .section.friendly h1 {.
font-size: 26px;. background-color: #dad8e4;.
padding: 18px 22px 15px 22px;. margin: 0;.
overflow: hidden; }. .section.friendly h1 strong {.
display: inline-block;. float: left; }.
.section.friendly h1 small {. display: inline-block;.
float: right;. text-align: right;.
font-size: 18px;. padding-top: 4px;. co
lor: #333333; }. .section.friendly .article {. bor
der: 4px solid #dad8e4;. padding: 24px 18px 18px 18px; }.
.section.friendly .article h3 {. font-size: 20p
x;. margin: 0 0 18px 0; }. .section.friendly .
article a {. color: #6b6ceb; }. .section.fri
endly .article a:visited {. color: #1d1d3b; }.
.section.friendly .article p {. font-size: 14px; }.
.section.friendly<!DOCTYPE html>. <html>.

<<< skipped >>>

POST /e?i=29 HTTP/1.1
Host: bench.utorrent.com
User-Agent: BTWebClient/3410(31105)
Accept-Encoding: gzip
Connection: Close
Content-Length: 171

{"h":"AJ_YwRVi29RbUrz-","cl":"uTorrent","v":109279617,"l":"en","w":"6.1","cts":1404290018,"eventName":"dimensions", "appsize": [ 1200, 600 ], "screensize": [ 1716, 901 ] }
HTTP/1.1 200 OK
Content-Type: text/html
Date: Wed, 02 Jul 2014 08:33:44 GMT
Server: nginx/1.4.7
X-Powered-By: PHP/5.4.30
Content-Length: 21
Connection: Close
{"response_code":200}..


GET /templates/3204/3301/30906.png HTTP/1.1
Host: media.opencandy.com
Accept: */*


HTTP/1.1 200 OK
x-amz-id-2: xCFBRvhlo MX70/FcKEEtkCuXWlg7hN6lxKBSWnDwOrL7izRiEspJOzyHOVI6nqPvU R9pihkRg=
x-amz-request-id: 7A96B31AF88AAAAD
Date: Wed, 02 Jul 2014 08:31:59 GMT
Cache-Control: max-age=300
Last-Modified: Wed, 15 Jan 2014 20:08:27 GMT
ETag: "13af98c25b689e7fc9414e1cfa840e3a"
Accept-Ranges: bytes
Content-Type: image/png
Content-Length: 13044
Server: AmazonS3
.PNG........IHDR............."4.... .IDATx...{..U..?..&..bD.c...D."...
G...LD.0*".".3<|....Y....?..12. 8..O.........(..B.Gx.H ........u...
.....I...ju.y...uN..m...B.!......!....R.B.!D.H..!..5#.*..B.....B.Q3R.B
.!D.H..!..5#.*..B.....B.Q3R.B.!D.H..!..5#.*..B.....B.Q3R.B.!D.H..!..5#
.*..B.....B.Q3R.B.!D.H..!..5#.*..B.....B.Q3R.B.!D.H..!..5#.*..B.....B.
Q3R.B.!D.H..!..5#.*..B.....B.Q3R.B.!D.H..!.0.[....k......`f?3.....3[af
...\b..#.jf.......3{.....3qp.ff...</1..j.....H.....Ra.H..gf.T.i$I..
y....J3.''..3;..n.u.&..23;..&T..c:.....l.. u........Z.vT....K...D..`f.
._.{.........=..r5.9.]...N..@?...=p..{3..F9...k..'....=!..@r....?;R..H
..>......IO3;.....0.P...T`o.<.....$.w,p.X....).....Q....M...K...
..#......\.lG.2.`...x..7.K...?u.vU....O.N..J..D.W..E#)K........a..Kf..
......L.~......^..W.sb....[.}&a..S...q.4w.Z.....a=`4.........5./Du....
...x.....3.8..%..5.]./.s.../.]...D.....y...$........03.....X...%.0....
,...........-....g.....d?/...........oJ.]...1..J.yv......5.....D...4Ry
.....k...?....U1..D.............4.L...&..r............7.....^W..X..1.*
..o.`.............]......~Yt....e[......t.......i..U.[W.W..0=.y.,.o7.O
`.k.a;.#....b".3.NyJ*..1..|^..L..T.$.....3'....0...")...5v.r}8........
:~..$.F...W....S...W;.zeA.....Q.f.........1a../..3 .....7... ..|.8.}.[
.......-...7....n.J.....*[.;.~_....M.. ..X..........8.._....z..m.~.M6.
....7...<H..k.2.p....>.ey;....|..MoW.6t....2...p70 ..m.W.o33;...
...ul.o..6..".#|..f.9a... .....U...._....w^..c.I.a.]..ad.........KX...
....F..I.'...|3....._....rK...f34.$I....-..F|.v!.....x............

<<< skipped >>>

POST /e?i=21 HTTP/1.1
Host: bench.utorrent.com
User-Agent: BTWebClient/3410(31105)
Accept-Encoding: gzip
Connection: Close
Content-Length: 246

{"h":"AJ_YwRVi29RbUrz-","cl":"uTorrent","v":109279617,"l":"en","w":"6.1","cts":1404289912,"eventName":"silent_autoupdate","launched_target":0,"updated":0,"relocated":0,"versions": [], "action":"RunningElevated", "g_version":109279617, "no_sau":0}
HTTP/1.1 200 OK
Content-Type: text/html
Date: Wed, 02 Jul 2014 08:31:59 GMT
Server: nginx/1.4.7
X-Powered-By: PHP/5.4.30
Content-Length: 21
Connection: Close
{"response_code":200}..


GET /plus/utorrent/index.html HTTP/1.1
Host: utclient.utorrent.com
User-Agent: BTWebClient/3410(31105)
Accept-Encoding: gzip
Connection: Close


HTTP/1.1 200 OK
x-amz-id-2: NxxPupxNDdEOIRYQUT8khjPmxsXsYv8LzQkUKD9cIq1X6q2Ri1XyG9kAwWoyVcfG
x-amz-request-id: 0C3E6321F0BEC36E
Date: Wed, 02 Jul 2014 08:33:36 GMT
Last-Modified: Fri, 18 Apr 2014 23:42:47 GMT
ETag: "ae4de37a73f20b44bc195a1b12d3a7c5"
Content-Type: text/html
Content-Length: 796
Server: AmazonS3
<html>...<head>....<script type='text/javascript' src='
../commonjs/jq.js'> </script>....<script type='text/javasc
ript' src='../commonjs/plusactive.js?ver=1'></script>....<
script type="text/javascript">.....$.ajax({......url: "hXXp://VVV.u
torrent.com/scripts/headers.php",......dataType: 'jsonp',......success
: function(headers) {.......country = headers['Geoip-Country-Code'];..
.....// Redirect US visitors.......if(country == 'US'){........setToUS
();.......}......}.....});....</script>....<script src="//cdn
.optimizely.com/js/240758443.js"></script>....<link href="
../commoncss/index.css" rel="stylesheet" type="text/css"/>....<m
eta charset=utf-8>....<title>Default : Plus Upgrade App</t
itle>...</head>...<body>....<iframe id='ifr' width='
100%' height='100%'> </iframe>...</body>..</html>
....


GET /installstats.php?cl=uTorrent&v=109279617&h=AJ_YwRVi29RbUrz-&w=1DB10106&bu=0&pr=0&cmp=82&ocmp=82&installresult&pid=1224&cau=0&installresult=0&exit=1&au=0&view=win32 HTTP/1.1
Accept-Encoding: gzip
User-Agent: uTorrent(31105)/3.4.1
Host: update.utorrent.com
Cache-Control: no-cache


HTTP/1.1 200 OK
Server: nginx/1.4.7
Date: Wed, 02 Jul 2014 08:33:29 GMT
Content-Type: text/html
Transfer-Encoding: chunked
Connection: close
X-Powered-By: PHP/5.4.30
0..


GET /content-bundles/production-df0ec56d-0fbb-bc2c-11e7-354ff3af9c4e/79b5f927c68a0bc7f648e016404705ab4f86772403bfbd9c089194fbebe30203/originals/Somewhere Else/01 - Zeds Dead (feat. Twin Shadow) - Lost You (Official Music Video).mp4 HTTP/1.1
Host: s3.amazonaws.com
User-Agent: BTWebClient/3410
Connection: keep-alive
Range: bytes=60813570-61862145

GET /content-bundles/production-df0ec56d-0fbb-bc2c-11e7-354ff3af9c4e/79b5f927c68a0bc7f648e016404705ab4f86772403bfbd9c089194fbebe30203/originals/Somewhere Else/01 - Zeds Dead (feat. Twin Shadow) - Lost You (Official Music Video).mp4 HTTP/1.1
Host: s3.amazonaws.com
User-Agent: BTWebClient/3410
Connection: close
Range: bytes=212857090-213905665


HTTP/1.1 403 Forbidden
x-amz-request-id: C6CAD0D3B9E5504C
x-amz-id-2: Nqf7M /C8as5RhhVBO5A/l50zqxa7E5hLjxRfxG6fJNO8Ctx0XHSFS/iCViwpKHs
Content-Type: application/xml
Transfer-Encoding: chunked
Date: Wed, 02 Jul 2014 08:34:16 GMT
Server: AmazonS3
e7..<?xml version="1.0" encoding="UTF-8"?>.<Error><Code
>AccessDenied</Code><Message>Access Denied</Message&
gt;<RequestId>C6CAD0D3B9E5504C</RequestId><HostId>Nq
f7M /C8as5RhhVBO5A/l50zqxa7E5hLjxRfxG6fJNO8Ctx0XHSFS/iCViwpKHs</Hos
tId></Error>....


GET /MFEwTzBNMEswSTAJBgUrDgMCGgUABBT3xL4LQLXDRDM9P665TW442vrsUQQUReuir/SSy4IxLVGLp6chnfNtyA8CEAQJGBtf1btmdVNDtW+VUAg= HTTP/1.1
Connection: Keep-Alive
Accept: */*
User-Agent: Microsoft-CryptoAPI/6.1
Host: ocsp.digicert.com


HTTP/1.1 200 OK
Accept-Ranges: bytes
Cache-Control: max-age=512165
Content-Type: application/ocsp-response
Date: Wed, 02 Jul 2014 08:34:04 GMT
Etag: "53b3a2b4-1d7"
Expires: Tue, 08 Jul 2014 20:34:04 GMT
Last-Modified: Wed, 02 Jul 2014 06:12:04 GMT
Server: ECS (ams/D1BF)
X-Cache: HIT
Content-Length: 471
0..........0..... .....0......0...0......E.......1-Q...!..m....2014070
1170000Z0s0q0I0... ............@..D3=?..Mn8...Q..E.......1-Q...!..m...
....._..fuSC.o.P.....20140701170000Z....20140708170000Z0...*.H........
.....O..X./..4.r....6..o.......#....`...b.a...c..a..6Bo.....~b..E....r
....51w`..<.r%e..w.e.....e...V..GVZ.H...MC'.<.....0n^.w.:....*&g
t;.{N...S...|Gl........j.?9.i\..5}..5d3.gML....\?..m.9SH........G=q..W
...v......].18......r>.....Pq1.g,.k$......r.c..z....J.......

....



GET /MFEwTzBNMEswSTAJBgUrDgMCGgUABBSnR4FoxLLkI7vkvsUIFlZt+lGH3gQUWsS5eyoKo6XqcQPAYPkt9mV1DlgCEAyvGbEyaFTw/abLEQ3zC1w= HTTP/1.1

Connection: Keep-Alive
Accept: */*
User-Agent: Microsoft-CryptoAPI/6.1
Host: ocsp.digicert.com


HTTP/1.1 200 OK
Accept-Ranges: bytes
Cache-Control: max-age=514641
Content-Type: application/ocsp-response
Date: Wed, 02 Jul 2014 08:34:04 GMT
Etag: "53b3aa4f-1d7"
Expires: Tue, 08 Jul 2014 20:34:04 GMT
Last-Modified: Wed, 02 Jul 2014 06:44:31 GMT
Server: ECS (ams/D1C4)
X-Cache: HIT
Content-Length: 471
0..........0..... .....0......0...0......Z..{*....q..`.-.eu.X..2014070
2062900Z0s0q0I0... .........G.h...#......Vm.Q....Z..{*....q..`.-.eu.X.
.....2hT........\....20140702062900Z....20140709064400Z0...*.H........
..........L.N...h...3Q..415O..."...e......."...l..q.o..m...j.nA Z.....
.S....'w..t..Gy..p...6.cT...D.;...?...pNh......l....^.9....Oz..,5{....
...J}.9.g..3.1.n.......!|.Qr.Rwvk.x.X/Pw.j....;t...6............9.}...
Y..p...RL.F....K.eC..;[...G...{e..nR.iz.uY. O~i >..HTTP/1.1 200 OK.
.Accept-Ranges: bytes..Cache-Control: max-age=514641..Content-Type: ap
plication/ocsp-response..Date: Wed, 02 Jul 2014 08:34:04 GMT..Etag: "5
3b3aa4f-1d7"..Expires: Tue, 08 Jul 2014 20:34:04 GMT..Last-Modified: W
ed, 02 Jul 2014 06:44:31 GMT..Server: ECS (ams/D1C4)..X-Cache: HIT..Co
ntent-Length: 471..0..........0..... .....0......0...0......Z..{*....q
..`.-.eu.X..20140702062900Z0s0q0I0... .........G.h...#......Vm.Q....Z.
.{*....q..`.-.eu.X......2hT........\....20140702062900Z....20140709064
400Z0...*.H..................L.N...h...3Q..415O..."...e......."...l..q
.o..m...j.nA Z......S....'w..t..Gy..p...6.cT...D.;...?...pNh......l...
.^.9....Oz..,5{.......J}.9.g..3.1.n.......!|.Qr.Rwvk.x.X/Pw.j....;t...
6............9.}...Y..p...RL.F....K.eC..;[...G...{e..nR.iz.uY. O~i >
;....

<<< skipped >>>

GET /MEQwQjBAMD4wPDAJBgUrDgMCGgUABBSxtDkXkBa3l3lQEfFgudSiPNvt7gQUAPkqw0GRtsnCuD5V8sCXEROgByACAwI6Yw== HTTP/1.1
Connection: Keep-Alive
Accept: */*
User-Agent: Microsoft-CryptoAPI/6.1
Host: ocsp.geotrust.com


HTTP/1.1 200 OK
Last-Modified: Sun, 29 Jun 2014 06:46:06 GMT
Expires: Sun, 06 Jul 2014 06:46:06 GMT
Content-Type: application/ocsp-response
content-transfer-encoding: binary
Content-Length: 1459
Cache-Control: max-age=339313, public, no-transform, must-revalidate
Date: Wed, 02 Jul 2014 08:34:42 GMT
Connection: keep-alive
0..........0..... .....0......0...0........Y0W1.0...U....US1.0...U....
GeoTrust Inc.100...U...'GeoTrust Global CA TGV OCSP Responder 2..20140
629064606Z0f0d0<0... ..........9.....yP..`...<.......*.A.....>
;U....... ...:c....20140629064606Z....20140706064606Z0...*.H..........
...5&....U..l...19...(.8...a9.3..Y..$.P#...{(.S........`..L..a..K..No.
..93f...ES..{.&..}.U..H....q5."..f.&......aw.?.....8..f?.._....MA.%...
.`L..@U.oik.P....J..V..E.._~Cl..x.0.S........j....6......F.>.......
.m.-...>o<...... 1.............Q....#.w.....k...b9:.....0...0...
0..}........:p0...*.H........0B1.0...U....US1.0...U....GeoTrust Inc.1.
0...U....GeoTrust Global CA0...131122231748Z..141212231748Z0W1.0...U..
..US1.0...U....GeoTrust Inc.100...U...'GeoTrust Global CA TGV OCSP Res
ponder 20.."0...*.H.............0...........b0..?.qg.M.Z0..$N.O.o..Nz.
a..I..x...:z....&.=...........6n.q.....V.e..*2:\..T..v..S8.z]..". ...~
9.....%#..Z..LF..........,.Z. .K.p...5".T....7b....ET..)7..|..C.w@-.-8
fT..F|..T....@XT...b.n`hx...& d^.&....?Q{`N..5g.4.~..6Bg...r|..]. ..-&
gt;.....3z...4}.a.C}.......0}0...U.#..0....z.h.....d..}.}e...N0... ...
..0......0...U.%..0... .......0...U...........0$..U....0...0.1.0...U..
..2048-TGV-4790...*.H.............z^..V.....<.%..eI(.....?....AT.v.
.....gt..=........L0..1...uL}6..t......8}...?..Oi./..z.).....?G.'lz.P.
...l.W....<."(.i] ...A/.z.$.j....2...D..7..GADZ....$.=....i...>.
g $.3#.....t\...|U.<.....-..0....<....8$.KL.w....r......%..rJ.XL
.juh....8.o.]..l....^D.....

<<< skipped >>>

GET /Advertisers/a97299ec28da43eba71d3439887cf621.jpg HTTP/1.1
Host: static.ap.bittorrent.com
User-Agent: BTWebClient/3410(31105)
Accept-Encoding: gzip
If-Modified-Since: Sun, 1 Jan 1982 00:00:00 GMT
Connection: Close


HTTP/1.1 200 OK
Accept-Ranges: bytes
Content-Type: image/jpeg
Date: Wed, 02 Jul 2014 08:33:44 GMT
Etag: "0827f7fe90a45760b6cea69ab97f13a3"
Expires: Tue, 02 Jul 2024 08:32:44 GMT
Last-Modified: Tue, 01 Jul 2014 04:37:13 GMT
Server: ECS (ams/49C9)
x-amz-id-2: qf9i3uMMht07dgDM4U FHVwOQz0gtEF6BZ i VfsYEyefhDUPzpxI /yOa0jENq/
x-amz-request-id: 4305C8E7F3367829
X-Cache: HIT
Content-Length: 25236
Connection: close
......Exif..II*.................Ducky.......P.....ohXXp://ns.adobe.com
/xap/1.0/.<?xpacket begin="..." id="W5M0MpCehiHzreSzNTczkc9d"?>
<x:xmpmeta xmlns:x="adobe:ns:meta/" x:xmptk="Adobe XMP Core 5.3-c01
1 66.145661, 2012/02/06-14:56:27 "> <rdf:RDF xmlns:rdf="h
ttp://VVV.w3.org/1999/02/22-rdf-syntax-ns#"> <rdf:Description rd
f:about="" xmlns:xmpMM="hXXp://ns.adobe.com/xap/1.0/mm/" xmlns:stRef="
hXXp://ns.adobe.com/xap/1.0/sType/ResourceRef#" xmlns:xmp="hXXp://ns.a
dobe.com/xap/1.0/" xmpMM:OriginalDocumentID="xmp.did:5CF0F8650455E3119
F8FAFBAE0EF7A31" xmpMM:DocumentID="xmp.did:2172BDD8B41E11E39CC08AD9933
CD99E" xmpMM:InstanceID="xmp.iid:2172BDD7B41E11E39CC08AD9933CD99E" xmp
:CreatorTool="Adobe Photoshop CS6 (Windows)"> <xmpMM:DerivedFrom
stRef:instanceID="xmp.iid:18EE9C935AB3E3118FC7E56065901FD8" stRef:doc
umentID="xmp.did:5CF0F8650455E3119F8FAFBAE0EF7A31"/> </rdf:Descr
iption> </rdf:RDF> </x:xmpmeta> <?xpacket end="r"?&g
t;....Adobe.d.........................................................
......................................................................
......................................................................
..............................................!1.".AQ...2aqBR#...3....
r.C.$4.bS...G..s.d%EW.....................!..1..AQa".q......2B...Rb...
..r#Sc.....C.%....3s..$............?.D..D.....?.<.<.).......(.."
.v.0vD.....3./S../.O...;..sC.....]q..&.*..^..J.tl......?&.."kz..vJm.w.
..W...n}a%..]..!......)....R......6...C..}5..k...G.}_id....z.e....

<<< skipped >>>

POST /e?i=20 HTTP/1.1
Host: bench.utorrent.com
User-Agent: BTWebClient/3410(31105)
Accept-Encoding: gzip
Connection: Close
Content-Length: 299

{"h":"AJ_YwRVi29RbUrz-","cl":"uTorrent","v":109279617,"l":"en","w":"6.1","cts":1404290019,"eventName":"ap","fte":1,"lre":1,"ltic_0":0,"ltic_1":0,"lcic_0":0,"lcic_1":0,"laae":0,"lare":0,"laie":0,"lame":0,"name":"siteId","errCode":0,"requestTime":1404290019,"action":"client.az.error.badsiteid.33049"}
HTTP/1.1 200 OK
Content-Type: text/html
Date: Wed, 02 Jul 2014 08:33:37 GMT
Server: nginx/1.4.7
X-Powered-By: PHP/5.4.30
Content-Length: 21
Connection: Close
{"response_code":200}..


GET /offers/ZedsDead_InstallPath.bmp HTTP/1.1
Host: ll.download3.utorrent.com
User-Agent: BTWebClient/3410(31105)
Accept-Encoding: gzip
Connection: Close


HTTP/1.1 200 OK
Server: nginx/1.4.7
Content-Type: image/x-ms-bmp
Cache-Control: max-age=3600
Accept-Ranges: bytes
Age: 3586
Date: Wed, 02 Jul 2014 08:31:59 GMT
Last-Modified: Tue, 01 Jul 2014 17:49:05 GMT
Expires: Wed, 02 Jul 2014 08:32:13 GMT
Content-Length: 82440
Connection: close
BM.B......2...(....................=..........................&%Z.....
y]..jF..5.<.T.Y.................$#$."!".*)*.)().('(.'&'.&%&.212..-.
., ,.767.434.............v(m..Rx......JZ.....u...S...A...V"".F...a .4
...G%%.H22.....JII.VUU......ec.jOM.....}>5..;...........X$..h?.c=..
......j...Y...R...=...m.weP.............iT4.........C3..........JB0...
..............<<(.........................$$#.""!.**).(('.&&%...
-.,, . *.........S^S.....................#$#.!"!.)*).'('.%&%./0/.-.-.
, .;<;.BCB.ABA......77......... ,,........................./AF.@Xc
.....Vhq.................w...............[...U...p...2FY.........8r...
5P..U..9X~.........l~.......A..>\..]f..$3k.CFi...r...V...:.##=.11G.
!!".))*. ,.LLM.......................................................
......................................................................
........VVV.ooo.ggg.```.[[[.XXX.TTT.SSS.RRR.QQQ.NNN.LLL.KKK.HHH.EEE.DD
D.CCC.BBB.@@@.???.===.<<<.;;;.:::.999.888.444.333.333.222.000
.///.....---.,,,. .***.))).(((.'''.&&&.%%%.$$$.###.""".!!!. ......
......................................................................
.......... ......*.***......).........................................
....".................................................................
......................................................................
..................2.............................m.....................
..................i...................................................
.......................................e..........................

<<< skipped >>>

GET /crls/secureca.crl HTTP/1.1
Connection: Keep-Alive
Accept: */*
User-Agent: Microsoft-CryptoAPI/6.1
Host: crl.geotrust.com


HTTP/1.1 200 OK
Server: Apache
ETag: "8d969e806152eb92feac9c4876e532fc:1404289216"
Last-Modified: Wed, 02 Jul 2014 08:20:16 GMT
Accept-Ranges: bytes
Content-Length: 1736
Date: Wed, 02 Jul 2014 08:33:43 GMT
Connection: keep-alive
Content-Type: application/pkix-crl
0...0..-0...*.H........0N1.0...U....US1.0...U....Equifax1-0 ..U...$Equ
ifax Secure Certificate Authority..140702080300Z..140712080300Z0...0..
...&..120627171036Z0........140521155053Z0.....-..140617185011Z0......
..120627171058Z0....``..120627171034Z0.....3..020515130611Z0....j...14
0226123519Z0........120627171039Z0........120627171002Z0........120627
171038Z0....i...120627171035Z0........100301134531Z0........1006231417
52Z0........120627171026Z0.....)..140617185515Z0........120627171025Z0
........120627171050Z0.....#..140606204021Z0....S...120627170949Z0....
H...120627171011Z0........120627171026Z0....._..120627171036Z0........
140618143145Z0....7...140416231149Z0....%...020514181157Z0........1406
05215230Z0........120627171058Z0........140618224415Z0....x...14050720
4001Z0....}...120627170911Z0.....8..120627171035Z0....."..120627171030
Z0....]E..140618144819Z0........140429180917Z0........100729164439Z0..
..x...130924204342Z0....M\..140430000442Z0.....D..120627171051Z0.....N
..100623141726Z0....X...140427081922Z0........120627171036Z0....7...12
0627171052Z0..../(..120627171032Z0....zo..120627171025Z0....v...140618
150003Z0........120627171039Z0........120627171031Z0....*...1206271710
32Z0........100729164732Z0........120627171017Z0........120627171030Z0
........120627171031Z0........140618143256Z0....hA..120627171034Z0....
~...120627171035Z0........120627171003Z0.....$..120627171037Z0....V...
140624123102Z0....x=..120627171055Z0........140416233935Z0....t6..1404
25041720Z0....S...140423105438Z0....jp..120627171034Z0........1406

<<< skipped >>>

POST /e?i=20 HTTP/1.1
Host: bench.utorrent.com
User-Agent: BTWebClient/3410(31105)
Accept-Encoding: gzip
Connection: Close
Content-Length: 123

{"h":"AJ_YwRVi29RbUrz-","cl":"uTorrent","v":109279617,"l":"en","w":"6.1","cts":1404290027,"eventName":"client404offerShow"}
HTTP/1.1 200 OK
Content-Type: text/html
Date: Wed, 02 Jul 2014 08:33:53 GMT
Server: nginx/1.4.7
X-Powered-By: PHP/5.4.30
Content-Length: 21
Connection: Close
{"response_code":200}..


GET /installoffer.php?h=AJ_YwRVi29RbUrz-&v=109279617&w=1DB10106&l=en&c=US&w64=1&db=iexplore.exe&cl=uTorrent&tsub=1&svp=4&cmp=82&ocmp=82 HTTP/1.1
Accept-Encoding: gzip
User-Agent: uTorrent(31105)/3.4.1
Host: update.utorrent.com
Cache-Control: no-cache


HTTP/1.1 200 OK
Server: nginx/1.4.7
Date: Wed, 02 Jul 2014 08:32:00 GMT
Content-Type: text/html
Transfer-Encoding: chunked
Connection: close
X-Powered-By: PHP/5.4.30
Expires: Thu, 21 Jul 1980 00:00:00 GMT
Cache-Control: private
Last-Modified: Wed, 02 Jul 2014 08:32:00 GMT
bf9..d16:secondary_offersl3:adk2:oce2:oci1e3:adki1e16:content_offer_id
8:ZedsDead17:content_offer_img24:ZedsDead_InstallPath.bmp17:content_of
fer_url113:hXXp://apps.bittorrent.com/featuredcontent/featuredcontent.
btapp?offer=hXXp://content.bittorrent.com/inclient/yes21:content_offer
_alttext116:Zeds Dead..Download the new music exclusive...You Get:..Un
released tracks..Re-mixable stems..<i>Fresh Beets</i> LP22
:content_offer_checkbox41:Yes, I'd love to check out this download!21:
content_offer_checkedi1e22:content_offer_autoexeci0e19:content_offer_t
itle32:Check out our new Bundle Release22:content_offer_subtitle34:Spe
cial Offer for BitTorrent Users20:content_offer_footer240:By clicking
"Next" and installing this torrent bundle, you agree to the BitTorrent
, Inc. <a href="hXXps://bundles.bittorrent.com/publish#!/terms">
Terms of Service</a> and <a href="hXXp://VVV.bittorrent.com/l
egal/privacy">Privacy Policy</a>.8:toolbar0d5:title17:Recomme
nded Offer8:subtitle26:Install MediaCaster by Ask9:body_text8:Not used
11:footer_text304:By clicking "Accept Offer" and installing this appli
cation you agree to the <a href="hXXp://apnstatic.ask.com/static/bi
ttorrentapp/documents/legal/en/ask_eula.html">End User License Agre
ement</a> and <a href="hXXp://about.ask.com/privacy-policy/"&
gt;Privacy Policy</a>. MediaCaster is a product of APN, LLC.2:id
8:ask-surf9:image_url68:hXXp://ll.download3.utorrent.com/offers/mediaC
aster_default_grey.bmp10:image_hash20:.r.....I...: .c.S.7.9:image_

<<< skipped >>>

GET /installstats.php?cl=uTorrent&v=109279617&h=AJ_YwRVi29RbUrz-&w=1DB10106&bu=0&pr=0&cmp=82&ocmp=82&offerapicurrentoffer&pid=1224&cau=0&OfferProvider=AdKnowledge&Offer=NotProvided&Accepted=1&view=win32 HTTP/1.1
Accept-Encoding: gzip
User-Agent: uTorrent(31105)/3.4.1
Host: update.utorrent.com
Cache-Control: no-cache


HTTP/1.1 200 OK
Server: nginx/1.4.7
Date: Wed, 02 Jul 2014 08:30:20 GMT
Content-Type: text/html
Transfer-Encoding: chunked
Connection: close
X-Powered-By: PHP/5.4.30
0..


GET /content-bundles/production-df0ec56d-0fbb-bc2c-11e7-354ff3af9c4e/79b5f927c68a0bc7f648e016404705ab4f86772403bfbd9c089194fbebe30203/originals/Somewhere Else/01 - Zeds Dead (feat. Twin Shadow) - Lost You (Official Music Video).mp4 HTTP/1.1
Host: s3.amazonaws.com
User-Agent: BTWebClient/3410
Connection: keep-alive
Range: bytes=89125122-90173697

GET /content-bundles/production-df0ec56d-0fbb-bc2c-11e7-354ff3af9c4e/79b5f927c68a0bc7f648e016404705ab4f86772403bfbd9c089194fbebe30203/originals/Somewhere Else/01 - Zeds Dead (feat. Twin Shadow) - Lost You (Official Music Video).mp4 HTTP/1.1
Host: s3.amazonaws.com
User-Agent: BTWebClient/3410
Connection: close
Range: bytes=179302658-180351233


HTTP/1.1 403 Forbidden
x-amz-request-id: 68E3938AC8962BA6
x-amz-id-2: GXxRag o3ftmMrz1GcD9zb/Jigk9FsTi6LuY63G1sWezqjRKjhz4coPpiRRF4QsW
Content-Type: application/xml
Transfer-Encoding: chunked
Date: Wed, 02 Jul 2014 08:33:46 GMT
Server: AmazonS3
e7..<?xml version="1.0" encoding="UTF-8"?>.<Error><Code
>AccessDenied</Code><Message>Access Denied</Message&
gt;<RequestId>68E3938AC8962BA6</RequestId><HostId>GX
xRag o3ftmMrz1GcD9zb/Jigk9FsTi6LuY63G1sWezqjRKjhz4coPpiRRF4QsW</Hos
tId></Error>..0..


GET /blank.html HTTP/1.1
Accept: */*
Accept-Language: en-US
User-Agent: Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1; WOW64; Trident/6.0)
Accept-Encoding: gzip, deflate
Host: ads.bittorrent.com
Connection: Keep-Alive


HTTP/1.1 200 OK
x-amz-id-2: JWxhIKHNdEwAJuxjFoqm4a368O1LevOk82iD08REKC CGMW ePYeIhEWUCRcE0nd
x-amz-request-id: B631848566C2C6A8
Content-Type: text/html
Server: AmazonS3
Age: 39424
Date: Wed, 02 Jul 2014 08:33:39 GMT
Last-Modified: Thu, 23 Jan 2014 18:56:38 GMT
Content-Length: 109
Connection: keep-alive
<!DOCTYPE html>.<html>.<head>.</head>.<body
style="overflow: hidden; margin: 0; padding: 0;">.</body>.&l
t;/html>HTTP/1.1 200 OK..x-amz-id-2: JWxhIKHNdEwAJuxjFoqm4a368O1Lev
Ok82iD08REKC CGMW ePYeIhEWUCRcE0nd..x-amz-request-id: B631848566C2C6A8
..Content-Type: text/html..Server: AmazonS3..Age: 39424..Date: Wed, 02
Jul 2014 08:33:39 GMT..Last-Modified: Thu, 23 Jan 2014 18:56:38 GMT..
Content-Length: 109..Connection: keep-alive..<!DOCTYPE html>.<
;html>.<head>.</head>.<body style="overflow: hidden;
margin: 0; padding: 0;">.</body>.</html>..


GET /installstats.php?cl=uTorrent&v=109279617&h=AJ_YwRVi29RbUrz-&w=1DB10106&bu=0&pr=0&cmp=82&ocmp=82&gettbofferresult&pid=1224&cau=0&tbofferresult=3&exit=1375&cbsearch=1&cbhomepage=1&tb=ask-surf&view=win32 HTTP/1.1
Accept-Encoding: gzip
User-Agent: uTorrent(31105)/3.4.1
Host: update.utorrent.com
Cache-Control: no-cache


HTTP/1.1 200 OK
Server: nginx/1.4.7
Date: Wed, 02 Jul 2014 08:33:28 GMT
Content-Type: text/html
Transfer-Encoding: chunked
Connection: close
X-Powered-By: PHP/5.4.30
0..


POST /e?i=20 HTTP/1.1
Host: bench.utorrent.com
User-Agent: BTWebClient/3410(31105)
Accept-Encoding: gzip
Connection: Close
Content-Length: 295

{"h":"AJ_YwRVi29RbUrz-","cl":"uTorrent","v":109279617,"l":"en","w":"6.1","cts":1404290024,"eventName":"ap","fte":1,"lre":1,"ltic_0":0,"ltic_1":2,"lcic_0":0,"lcic_1":0,"laae":0,"lare":0,"laie":0,"lame":0,"name":"impression","errCode":0,"requestTime":1404290024,"action":"client.az.impression.ua"}
HTTP/1.1 200 OK
Content-Type: text/html
Date: Wed, 02 Jul 2014 08:33:50 GMT
Server: nginx/1.4.7
X-Powered-By: PHP/5.4.30
Content-Length: 21
Connection: Close
{"response_code":200}..


GET /impression.do/?user_id=FE2D69B3-3914-4632-9A57-DB6072FEFE3C&event=dll_wrapper_initialize_0_2340&spsource=68E633381BD14a69BD08A05C22B72D6A&traffic_source=68E633381BD14a69BD08A05C22B72D6A&browser=IE&implementation_id=dll HTTP/1.1
Accept: */*
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; WOW64; Trident/6.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; .NET4.0C)
Host: imp.install-zone.com
Connection: Keep-Alive


HTTP/1.1 200 OK
Cache-Control: no-cache
Pragma: no-cache
Content-Type: image/png
Expires: -1
Server: Microsoft-IIS/7.5
X-AspNet-Version: 2.0.50727
X-Powered-By: ASP.NET
Date: Wed, 02 Jul 2014 08:31:56 GMT
Connection: close
Content-Length: 109
.PNG........IHDR..............wS.....tEXtSoftware.Adobe ImageReadyq.e&
lt;....IDATx.b...?@....... .t.....IEND.B`...


GET /utorrent-onboarding/player.btapp HTTP/1.1
Host: apps.bittorrent.com
User-Agent: BTWebClient/3410(31105)
Accept-Encoding: gzip
Connection: Close


HTTP/1.1 200 OK
x-amz-id-2: kLnNrkgfGAUNBhBwOUtnTaaAPMzN4DSdXHzrxkam8f6mjZV0Qi/hOlv0ELXd7rpV
x-amz-request-id: 04253D8D9662B60E
Accept-Ranges: bytes
Content-Type: binary/octet-stream
Server: AmazonS3
Age: 50207
Date: Wed, 02 Jul 2014 08:33:35 GMT
Last-Modified: Tue, 08 Oct 2013 00:53:35 GMT
Content-Length: 3097
Connection: close
PK.........c.@!m@.............btappUT....8.O7N.Oux.............-.1.. .
.{^.....L...u.M....G..>v.i..f4.6....V/pO...q...S_...d..(..%.5.B.yp.
.H..Rk..$rb&.......*.......d....959...=&.`@.....(F..)Jz.....1.}....9..
PK.........c.@v.7.`...........main.cssUT....8.O7N.Oux..............S.n
.0.}. ".....[7e_c..k............i....9....`u...p.'4U..lH)...,.|.....Jn
.H...B.bm..:j.R...l@CU...cC.....IK._........,.K.b...<.I.F.]....A...
F|#...../.%.$...q8.........-.9%....3......h9 -V...)....gB../.Z.V@.&[..
a...!6..\)..QX....f...Qh.......H.....].ZD6....H(-.pSt...sH o^..nu.hB..
.a.ou......Ng.cEw.`....=_.............H..6..Y.>..7.}!.w...W.W'.....
....PK.........c.@..yI....6.......icon.bmpUT....8.O7N.Oux.............
U....@...>*....<..E.....;....{..Q.....yU-....<...D..4w..@/...
.c..................wf??...S.&...q.......}7k..).v..Z..l.R.8..;..;9..'.
.{:=yO.....{.E.>.`"...9..|$..G...#.H...<..<...:x......|!_....
|Y..[K...D.TP.Nk..;~......O679'...;~......w....;~....s.w....;~....S.w.
...;~....3.w....;~.....8~......w.....6...s._..?............N.~..X.....
./.)./../../.....K.....k........./../../..L...........%$../../../..|.G
.x.....-...........?............?............?..r.........,.|.e..?....
.....s...$xY...O..6.V.S....n....V/...k...x....2.....4.P....C..9.ka_.lC
3Ms..S.3.|..2....2......|..C.oS.y.iZ.......i..[.A.T_?.u......p.......F
=..i...u.G.......7..Y..M../PK.........u.@.W.@....m.......index.htmlUT.
...M.O.N.Oux..............U.r.0.}._..a...;i.\.0.r..tH..G...je.#.I...r.
.0I.O.v..v.J..........R...Y.. .ZF.....I.........Xt. ......'..n1...

<<< skipped >>>

POST /e?i=D2544ACE4303E0E45B2240BD78E93A67FFE4B5B2 HTTP/1.1
Host: bench.utorrent.com
User-Agent: Hydra HttpRequest
Connection: close
Content-Length: 93

{"eventName":"hydra.compat.good","pid":"1224","h":"D2544ACE4303E0E45B2240BD78E93A67FFE4B5B2"}
HTTP/1.1 200 OK
Content-Type: text/html
Date: Wed, 02 Jul 2014 08:32:02 GMT
Server: nginx/1.4.7
X-Powered-By: PHP/5.4.30
Content-Length: 21
Connection: Close
{"response_code":200}..


GET /installstats.php?cl=uTorrent&v=109279617&h=AJ_YwRVi29RbUrz-&w=1DB10106&bu=0&pr=0&cmp=82&ocmp=82&offerretrievedfromserver&pid=1224&cau=0&ServerOfferRetrieved=1&sec_offs=adk,oc&view=win32 HTTP/1.1
Accept-Encoding: gzip
User-Agent: uTorrent(31105)/3.4.1
Host: update.utorrent.com
Cache-Control: no-cache


HTTP/1.1 200 OK
Server: nginx/1.4.7
Date: Wed, 02 Jul 2014 08:28:43 GMT
Content-Type: text/html
Transfer-Encoding: chunked
Connection: close
X-Powered-By: PHP/5.4.30
0..


GET /media/toolbar/everest/partners/BTR-V7/YY/Setup.ini HTTP/1.1
Accept: */*
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; WOW64; Trident/6.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; .NET4.0C)
Host: apnmedia.ask.com
Connection: Keep-Alive


HTTP/1.1 200 OK
Server: Apache
ETag: "ab99d35af854529d8876452bdeb5543c:1396547552"
Last-Modified: Thu, 03 Apr 2014 17:46:04 GMT
Accept-Ranges: bytes
Content-Length: 1436
Content-Type: text/plain
Date: Wed, 02 Jul 2014 08:33:37 GMT
Connection: keep-alive
[Startup]..CmdLine=..DefaultOffer=..XpiInstall=0..Require=OS_Requireme
nt..[Product]..ProductName=Ask Toolbar..msi=hXXp://apnmedia.ask.com/me
dia/toolbar/everest/partners/BTR-V7/YY/AskToolbarInstaller-BTR-V7.7z..
Languages=1031;1033;1034;1036;1040;1041;1043;1045;1049;2070..Criteria=
prod..UpgradeCode={A75C7978-0A75-7786-6895-A75C79FFFFFF}..ProductCode=
{4254522D-5637-006A-76A7-A75C790C0B00}..CmdLine=..Logging=voicewarmup.
.Type=bt-crxrt..[OS_Requirement]..Criteria=os..ProductName=Windows XP.
.[Windows XP]..PlatformID=2..MajorVersion=5..MinorVersion=1..ServicePa
ckMajor=2..[Reporting]..Url=hXXp://phn.apnanalytics.com/tr.gif..[Offer
Check]..BlockList=FTB;OVO2;STC7;STC8;WCL2;WCL3..Browsers=ORGB:-1;DBR:
-1;ToolbarCR:3;ToolbarFF:2..[ToolbarIE]..Criteria=ie..ProductName=IE v
9..ProductVersion=9.0.0.0..exe=iexplore.exe..[ToolbarFF]..Criteria=fil
e..ProductName=FF v3.6..Path=firefox.exe..FileVersion=>1.9.2..exe=f
irefox.exe..[ToolbarCR]..Criteria=file_reg..ProductName=CR v17..Path=H
KEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Uninstall\G
oogle Chrome..VarPath=DisplayIcon..FileVersion=>17.0..exe=chrome.ex
e..OR=ToolbarCR2..[ToolbarCR2]..Criteria=file_reg..ProductName=CR v17.
.Path=HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Uni
nstall\Google Chrome..VarPath=DisplayIcon..FileVersion=>17.0..OR=To
olbarCR3..[ToolbarCR3]..Criteria=file..ProductName=CR v17..Path=chrome
.exe..FileVersion=>17.0....

<<< skipped >>>

GET /images/mobile-icon.png HTTP/1.1
Host: utclient.utorrent.com
User-Agent: BTWebClient/3410(31105)
Accept-Encoding: gzip
If-Modified-Since: Sun, 1 Jan 1982 00:00:00 GMT
Connection: Close


HTTP/1.1 200 OK
x-amz-id-2: AiTCN3rc7lXqnd 2yEVttm66O8rPVv3IOppc2idRUfr4LDLrmfWCh/7hwLwlyiUr
x-amz-request-id: 09F9D2D9707B2892
Date: Wed, 02 Jul 2014 08:33:45 GMT
x-amz-meta-cb-modifiedtime: Tue, 11 Mar 2014 23:12:00 GMT
Last-Modified: Tue, 11 Mar 2014 23:12:21 GMT
ETag: "4280089022fce23da2c64031bf137c08"
Content-Type: image/png
Content-Length: 1263
Server: AmazonS3
.PNG........IHDR................a....tEXtSoftware.Adobe ImageReadyq.e&
lt;...kiTXtXML:com.adobe.xmp.....<?xpacket begin="..." id="W5M0MpCe
hiHzreSzNTczkc9d"?> <x:xmpmeta xmlns:x="adobe:ns:meta/" x:xmptk=
"Adobe XMP Core 5.5-c021 79.154911, 2013/10/29-11:47:16 "> &
lt;rdf:RDF xmlns:rdf="hXXp://VVV.w3.org/1999/02/22-rdf-syntax-ns#">
<rdf:Description rdf:about="" xmlns:xmpMM="hXXp://ns.adobe.com/xap
/1.0/mm/" xmlns:stRef="hXXp://ns.adobe.com/xap/1.0/sType/ResourceRef#"
xmlns:xmp="hXXp://ns.adobe.com/xap/1.0/" xmpMM:OriginalDocumentID="xm
p.did:01801174072068119FB483BB6AA6447E" xmpMM:DocumentID="xmp.did:9E4A
8AB99C4311E3BC81E4BD1BE0F00E" xmpMM:InstanceID="xmp.iid:9E4A8AB89C4311
E3BC81E4BD1BE0F00E" xmp:CreatorTool="Adobe Photoshop CC (Macintosh)"&g
t; <xmpMM:DerivedFrom stRef:instanceID="xmp.iid:3637b3de-885b-4f94-
b5ae-3e362ec1613c" stRef:documentID="xmp.did:01801174072068119FB483BB6
AA6447E"/> </rdf:Description> </rdf:RDF> </x:xmpmeta
> <?xpacket end="r"?>m.......IDATx.b..........hb.P....,.... ^
..Z@,.....:.7. .f.7.Oeddpfecb`cgb......_..........`....P...T,....d3.h.
..v...# .f@..f ......... ..Y.D.08..| ..f.. .... ...3.....00B.......1..
.>...L..R.......?.._>.aB.. ..C...X...@!.....z. ...$q...?&.4..:d6
.\F..-...~..*~....2.H} ..@A..).P..d&.8........0.a.........IEND.B`...

<<< skipped >>>

POST /api/v2 HTTP/1.1
Host: engine.ap.bittorrent.com
User-Agent: Mozilla/5.0 (compatible; MSIE 10.0 Windows NT 6.1; WOW64; Trident/6.0; EIE10; ENUSMSN)(31105)
Accept-Encoding: gzip
content-type: application/json
Connection: Close
Content-Length: 361

{ "keywords": [ "clientdata=utorrent|3.4.1.31105|82", "IEVersion=10", "flash=none" ], "placements": [ { "adTypes": [ 9 ], "divName": "lrec", "networkId": 5682, "properties": { "IEVersion": 10, "campaigncode": 82, "featurelevel": 0, "flash": "none", "major": 3, "minor": 4, "product": "utorrent", "tag": "", "tiny": 1, "version": 31105 }, "siteId": "33049" } ] }
HTTP/1.1 200 OK
Access-Control-Allow-Headers: accept, origin, content-type, content-length
Access-Control-Allow-Methods: GET,PUT,POST,DELETE,OPTIONS
Access-Control-Allow-Origin: *
Content-Type: application/json
Date: Wed, 02 Jul 2014 08:31:17 GMT
ETag: "-891249303"
Server: nginx/1.1.19
Set-Cookie: azk=ue1-19da8d2dd3364e49aed7dacbd931d420; Path=/; Expires=Thu, 02 Jul 2015 08:31:17 GMT
x-powered-by: adzerk bifrost/
x-served-by: engine-us-east-1a-11
Content-Length: 2381
Connection: Close
{"user":{"key":"ue1-19da8d2dd3364e49aed7dacbd931d420"},"decisions":{"l
rec":{"adId":408185,"creativeId":330911,"flightId":206441,"campaignId"
:112237,"clickUrl":"hXXp://engine.ap.bittorrent.com/r?e=eyJhdiI6MzY0OT
MsImF0Ijo5LCJjbSI6MTEyMjM3LCJjaCI6ODc4NSwiY3IiOjMzMDkxMSwiZGkiOiI0YWU2
Y2RjYTQ5YTk0MGFjOTgzNzc0MjQxNTk4OGM2YSIsImRtIjozLCJmYyI6NDA4MTg1LCJmbC
I6MjA2NDQxLCJpcCI6IjE5My4xMzguMjQ0LjIzMSIsImt3IjoiY2xpZW50ZGF0YT11dG9y
cmVudHwzLjQuMS4zMTEwNXw4MixpZXZlcnNpb249MTAsZmxhc2g9bm9uZSIsIm53Ijo1Nj
gyLCJwYyI6MC4wOCwicHIiOjIzNzU1LCJydCI6Mywic3QiOjMzMDQ5LCJ0ciI6dHJ1ZSwi
dWsiOiJ1ZTEtMTlkYThkMmRkMzM2NGU0OWFlZDdkYWNiZDkzMWQ0MjAiLCJ0cyI6MTQwND
I4OTg3NzAxNiwidXIiOiJodHRwOi8vdHJhY2tpc3RhLmNvbS90cmFjay9idHJlZGlyZWN0
LnBocD9oYW5kbGU9MTAwNTMifQ&s=egiOVlB-PNRjO_823h0YHcyJvlc","impressionU
rl":"hXXp://engine.ap.bittorrent.com/i.gif?e=eyJhdiI6MzY0OTMsImF0Ijo5L
CJjbSI6MTEyMjM3LCJjaCI6ODc4NSwiY3IiOjMzMDkxMSwiZGkiOiI0YWU2Y2RjYTQ5YTk
0MGFjOTgzNzc0MjQxNTk4OGM2YSIsImRtIjozLCJmYyI6NDA4MTg1LCJmbCI6MjA2NDQxL
CJpcCI6IjE5My4xMzguMjQ0LjIzMSIsImt3IjoiY2xpZW50ZGF0YT11dG9ycmVudHwzLjQ
uMS4zMTEwNXw4MixpZXZlcnNpb249MTAsZmxhc2g9bm9uZSIsIm53Ijo1NjgyLCJwYyI6M
C4wOCwicHIiOjIzNzU1LCJydCI6Mywic3QiOjMzMDQ5LCJ0ciI6dHJ1ZSwidWsiOiJ1ZTE
tMTlkYThkMmRkMzM2NGU0OWFlZDdkYWNiZDkzMWQ0MjAiLCJ0cyI6MTQwNDI4OTg3NzAxN
iwiZnEiOjF9&s=Iy3hRp0kcSxHtMFS49XUgy6V8ZE","contents":[{"type":"html",
"body":"<a href=\"hXXp://engine.ap.bittorrent.com/r?e=eyJhdiI6MzY0O
TMsImF0Ijo5LCJjbSI6MTEyMjM3LCJjaCI6ODc4NSwiY3IiOjMzMDkxMSwiZGkiOiI0YWU
2Y2RjYTQ5YTk0MGFjOTgzNzc0MjQxNTk4OGM2YSIsImRtIjozLCJmYyI6NDA4MTg1L

<<< skipped >>>

GET /aff_setup.exe HTTP/1.1
Accept: */*
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; WOW64; Trident/6.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; .NET4.0C)
Host: cdn.backupgrid.net
Connection: Keep-Alive


HTTP/1.1 200 OK
Date: Wed, 02 Jul 2014 08:33:36 GMT
Content-Type: application/octet-stream
Content-Length: 106748
Connection: keep-alive
x-amz-id-2: PAQjSw6k8g8FMK7/c9lnX9d1Z65ol4A310HQ7cbs7NS7xIQ zopXBa0qCp3NNuDs
x-amz-request-id: 7A7B1EF85EFC6C69
Last-Modified: Thu, 12 Jun 2014 16:42:26 GMT
ETag: "f9970fb733cd39910571596fbde55d22"
Server: NetDNA-cache/2.2
X-Cache: HIT
MZ......................@.............................................
..!..L.!This program cannot be run in DOS mode....$.......1..:u..iu..i
u..i...iw..iu..i...i...id..i!..i...i...it..iRichu..i..................
......PE..L......K.................\..........<2.......p....@......
....................p...............................................s.
.........0m...........................................................
................p...............................text...ZZ.......\.....
............. ..`.rdata.......p.......`..............@..@.data........
........r..............@....ndata.......@...........................rs
rc...0m.......n...v..............@..@.................................
......................................................................
......................................................................
......................................................................
......................................................................
...............................................U....\.}..t .}.F.E.u..H
.....>B..H.P.u..u..u...Hr@..B...SV.5.>B..E.WP.u...Lr@..e...E..E.
P.u...Pr@..}..e....Dp@........FR..VV..U... M.......M....3.....FQ.....N
U..M..........VT..U.....FP..E...............E.P.M...Hp@..E...E.P.E.P.u
...Tr@..u....E..9}...w....~X.te.v4..Lp@....E.tU.}.j.W.E......E.......P
p@..vXW..Tp@..u..5Xp@.W...E..E.h ...Pj.h.6B.W..Xr@..u.W...u....E.P.u..
.\r@._^3.[.....L$...>B...Si.....VW.T.....tO.q.3.;5.>B.sB..i.....
.D.......t.G.....t...O..t .....u...3....3...F.....;5.>B.r._^[..

<<< skipped >>>

GET /components/font-awesome-stylus/fonts/fontawesome-webfont.8b27bc96115c2d24350f0d09e6a9433f.eot? HTTP/1.1
Accept: */*
Referer: hXXp://bundles.bittorrent.com/bundles/79b5f927c68a0bc7f648e016404705ab4f86772403bfbd9c089194fbebe30203?starttime=1393282818000&port=10627&pair=ADFC36D802A98BEB8DDDFD9BE07E8897AB050C2B&frameaddr=38a30e0&download=true
Accept-Language: en-US
User-Agent: Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1; WOW64; Trident/6.0)
Origin: hXXp://bundles.bittorrent.com
Accept-Encoding: gzip, deflate
Host: d1mh11hmkkdpin.cloudfront.net
Connection: Keep-Alive


HTTP/1.1 200 OK
Content-Type: application/vnd.ms-fontobject
Content-Length: 38205
Connection: keep-alive
Date: Sat, 21 Jun 2014 02:48:46 GMT
Cache-Control: max-age=31536000
Last-Modified: Thu, 19 Jun 2014 23:38:04 GMT
ETag: "8b27bc96115c2d24350f0d09e6a9433f"
Accept-Ranges: bytes
Server: AmazonS3
Age: 971097
X-Cache: Hit from cloudfront
Via: 1.1 381b16645d69531c3289b92659a1215d.cloudfront.net (CloudFront)
X-Amz-Cf-Id: s4eydl57z1sH7sgEPbwktrUCsC8R526jChnoYKP1ITZnPOKmy9cWDA==
=...W.............................LP........................gr^.......
..............F.o.n.t.A.w.e.s.o.m.e.....R.e.g.u.l.a.r...$.V.e.r.s.i.o.
n. .4...0...2. .2.0.1.3...&.F.o.n.t.A.w.e.s.o.m.e. .R.e.g.u.l.a.r.....
BSGP......................O..S.~l.......Y.D.M.F..x...>..........)[.
.1..H....-A)F....1..../.d..U.'.&a-......nb$.%....J..[.`..._)q.V...l.ih
u-.........yx.M..q..y.S0E2...z.r.0.i...g.....=?..h.k.....2.[.V..0.q...
0w.....\..0....Q.a)....F.[>d...%[GV.4...l.G..G9...9...q.80}...;w...
m=7.C.w.."k?3...eYtd....`..]T.......c..4 `..*...`[.....G*LR....:.. a..
.Q..(a].]$.1?3....eq.m....$R.Y......%.......E@K.H.......S..... .Sa....
. .m....|..........5....@_.P.L...l.B.0..fj(.42..x..yt......0...:T<.
............]F..Uk..c...D6$........q.....z{.?....j_.f...\..6 .X.).FP..
.N...........>.p...u..d_.-..0.!#...S.I.`...FW..d...C.G.ZM..4Z.@...&
..X..e%.[...b.xG.amB.KB.(%\.....K.....OG5..4a.B..5..PK..eE.1..f.Y.!yQ/
..,..0]U,.JA...y\.....I...c-.W.,.}F=..n.'.~...ji3c4......y]E%.... .r..
g'..*2......*.'./..0....k.a...Z.#.g..2....\.62.I..)C.....U!".C|.....e.
.Vx..0.P.....@n......mU...U....vfB.G..iL....%Y.U.t...~...YHl..f...h.8.
.....Y.9.......x... ~...j.b..Y..=.:.#... |&...V..]\..........b.W.M....
.x...@.@B..D.`xV....$e.#..l.n.....|Q...,..sR.....,.:5......DS'.v:..%A.
.....P..`K".[....X.^S\.(....".....Te...&q...l-.. .....3....o.&.....~g=
..*J..V.....CeD.h..4....~.F..)h..z{H.=UW...8."....].....L.......23...e
.....m..?Py.7.B\......t.J.-../D.....m...9K..3adz.4].J.. .B......@....
"..WU.... .@D...>.K.."ZW.J.....@..L1:..&P.|....X...t..5 1..{=JK

<<< skipped >>>

GET /components/font-awesome-stylus/fonts/fontawesome-webfont.3293616ec0c605c7c2db25829a0a509e.woff?v=4.0.3 HTTP/1.1

Accept: */*
Referer: hXXp://bundles.bittorrent.com/bundles/79b5f927c68a0bc7f648e016404705ab4f86772403bfbd9c089194fbebe30203?starttime=1393282818000&port=10627&pair=ADFC36D802A98BEB8DDDFD9BE07E8897AB050C2B&frameaddr=38a30e0&download=true
Accept-Language: en-US
User-Agent: Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1; WOW64; Trident/6.0)
Origin: hXXp://bundles.bittorrent.com
Accept-Encoding: gzip, deflate
Host: d1mh11hmkkdpin.cloudfront.net
Connection: Keep-Alive


HTTP/1.1 200 OK
Content-Type: application/font-woff
Content-Length: 44432
Connection: keep-alive
Date: Sat, 21 Jun 2014 02:49:31 GMT
Access-Control-Allow-Origin: *
Access-Control-Allow-Methods: GET, HEAD
Access-Control-Max-Age: 3000
Cache-Control: max-age=31536000
Last-Modified: Thu, 19 Jun 2014 23:38:04 GMT
ETag: "3293616ec0c605c7c2db25829a0a509e"
Accept-Ranges: bytes
Server: AmazonS3
Age: 971053
X-Cache: Hit from cloudfront
Via: 1.1 381b16645d69531c3289b92659a1215d.cloudfront.net (CloudFront)
X-Amz-Cf-Id: YtmoiTF6zzqexYBW-icjFkOpNw3WXv6ymbleEgouN1fuqUqRj90Yaw==
wOFF..............;.........................FFTM...D........f/.WGDEF..
.`....... ....OS/2.......>...`..z.cmap.......$...r.k..gasp.........
.......glyf.............;e.head.......1...6....hhea...........$....hmt
x...........H....loca.............8b.maxp........... ....name.......e.
...;.e.post...8...M...]P...webf..............Rw.........=.......T.0...
...jWx.c`d``..b...`b`d`d..$Y.<.......x.c`f}.8.............B3.3D..8A
AeQ1....W.6..@>...2.bDR......i....x....J.a....\. ..kb.e...>AX..[
.X.....'.y...6..&.....R|.\@..3E.D....A.F,<0g8p...".Q4k.B'u.&......O
.%.....S....I9..^.um7....Q@.%.QE.M.q. .p.....u)HQJR....9$cB..x.A./D.#.
.>.TPC.-......B....x.K ..IcB47f.....m....m..7....'....,gx..x..x...9
.. &m.X.....G.I?..}?{.].o....UVh..B.....df:.2C...._q.../x.........x...
.|T..0~.s..;..Y..d2.d.$d..Y............. ..(...*..j....]..j...jW}mkW..
.m..^...?[!s......$$.}....{.}=...s.s......x...N..l....!.....v2.]....q.
8.....3...................H(.Oe.!.....H.:. =.R..r.x.7..O..on.6z...1*..
`t......s......`.cub........J..$.C..^.8...d!...H..-..;..<|M.`Mq.7..
sf{c..<>.....nYz...../.........pB'GX......a..\.....N.>.qbwf.A
..t.0x....v....p)/..2Q...^.S;~..K......^r5...L...X..................#1
:;..........A..9$Y....G...X<.pyp.3......Hn......IG...d{ ..''.......
...<..]...~Q.....XP......d6..Y.{...4 .mu..Z..Y........w,..qc.X.....
h..}-.3f...{).-r.U.....0(.j......3|1.3..!>v.......[.e.sL.....'....i
laG.x{x.P:...)g..%2.....\...ht.%...ho...;.:C..s.....Z............Q..^.
.q.F....*.G.-&...4.R0...L.W.qL|.}...R.Z.....&..{k;......ux........

<<< skipped >>>

GET /i.gif?e=eyJhdiI6NTEzMjAsImF0IjoxMjI0LCJjbSI6MTA1OTgxLCJjaCI6ODc4NSwiY3IiOjM2NTIzOSwiZGkiOiJiZjQzY2NhNmEwMTg0MjQ5OWE1N2RkYTcyMDJlZTU1NyIsImRtIjozLCJmYyI6NDUwODU2LCJmbCI6MjI5OTIwLCJpcCI6IjE5My4xMzguMjQ0LjIzMSIsImt3IjoiY2xpZW50ZGF0YT11dG9ycmVudHwzLjQuMS4zMTEwNXw4MixpZXZlcnNpb249MTAsZmxhc2g9bm9uZSIsIm53Ijo1NjgyLCJwYyI6MC4wMiwicHIiOjIzNzU1LCJydCI6Mywic3QiOjMzMDQ5LCJ1ayI6InVlMS02Y2ZkYmNkY2E0NDY0NDZmYjAxZmQxNDQ4MGRlYjY0YSIsInRzIjoxNDA0MjkwMjc4MDQ1LCJmcSI6MX0&s=H8-CSOgax1FMdCtlLuH8RMCrAWs HTTP/1.1
Host: engine.ap.bittorrent.com
User-Agent: Mozilla/5.0 (compatible; MSIE 10.0 Windows NT 6.1; WOW64; Trident/6.0; EIE10; ENUSMSN)(31105)
Accept-Encoding: gzip
Accept-Language: en-US
Connection: Close


HTTP/1.1 200 OK
Access-Control-Allow-Headers: accept, origin, content-type, content-length
Access-Control-Allow-Methods: GET,PUT,POST,DELETE,OPTIONS
Access-Control-Allow-Origin: *
Content-Type: image/gif
Date: Wed, 02 Jul 2014 08:37:24 GMT
Server: nginx/1.1.19
Set-Cookie: azk=ue1-6cfdbcdca446446fb01fd14480deb64a; Path=/; Expires=Thu, 02 Jul 2015 08:37:24 GMT
x-powered-by: adzerk bifrost/
x-served-by: engine-us-east-1a-01
Content-Length: 43
Connection: Close
GIF89a.............!.......,...........D..;..


GET /offers/streaming/index.html?port=10627&pair=AAF51F5F564AD28FFCFB5020BDB00283A1ED40A1&frameaddr=68242f8&plus=0&cid=AJ_YwRVi29RbUrz-&code=4 HTTP/1.1
Accept: */*
Accept-Language: en-US
User-Agent: Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1; WOW64; Trident/6.0)
Accept-Encoding: gzip, deflate
Host: utclient.utorrent.com
Connection: Keep-Alive


HTTP/1.1 200 OK
x-amz-id-2: 9o Sc3p6veFRGDuhpEdM0ZGifxX/4iGdpVkSju7TL1piSZq4/PAE1GvlrjSWgFbJ
x-amz-request-id: 415325386D821A71
Date: Wed, 02 Jul 2014 08:33:44 GMT
x-amz-meta-s3cmd-attrs: uid:107/gname:jenkins/uname:jenkins/gid:120/mode:33188/mtime:1402612153/atime:1402612153/md5:256ccc8fecd1bfd8d0cb598d78949ac4/ctime:1402612153
Last-Modified: Thu, 12 Jun 2014 22:29:19 GMT
ETag: "256ccc8fecd1bfd8d0cb598d78949ac4"
Content-Type: text/html
Content-Length: 7679
Server: AmazonS3
<!doctype html>.<html>..<head>.    <meta http-equ
iv="X-UA-Compatible" content="IE=edge">. <title></title
>. <link href='hXXp://fonts.googleapis.com/css?family=Open Sa
ns|Open Sans Condensed:700' rel='stylesheet' type='text/css'>. &
lt;link rel="stylesheet" href="bower_components/components-bootstrap/c
ss/bootstrap.min.css">. <link rel="stylesheet" href="css/styl
es.css">.</head>..<body>.. <div id='page1' class=
"container page">. <div class="title-container">.
<span>. <img id="page1-no-x" src="img/i
con-close.png" />. </span>. </div>.
<div class="col-xs-4 offer_type white-rectangle center-align
height400 col-xs-push-2 first-offer">. <h1>Free<
;/h1>. <p>Everything you want in a torrent client.
</p>. <p>Completely free.</p>.
<div class="image_container">. <img class='ve
rtical_center' src="img/laptop-free.png" alt="">. </d
iv>. <p>Your content via desktop computer.</p&g
t;. <p>Ad-supported, unlimited use.</p>..
<button class="btn btn-free" id='free'>Stick with Free<
/button>. </div>. <div class="col-xs-4 offer
_type white-rectangle center-align height400 col-xs-push-2">.
<img src="img/ribbon.png" id='img_ribbon' alt="">.

<<< skipped >>>

GET /offers/streaming/css/styles.css HTTP/1.1

Accept: */*
Referer: hXXp://utclient.utorrent.com/offers/streaming/index.html?port=10627&pair=AAF51F5F564AD28FFCFB5020BDB00283A1ED40A1&frameaddr=68242f8&plus=0&cid=AJ_YwRVi29RbUrz-&code=4
Accept-Language: en-US
User-Agent: Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1; WOW64; Trident/6.0)
Accept-Encoding: gzip, deflate
Host: utclient.utorrent.com
Connection: Keep-Alive


HTTP/1.1 200 OK
x-amz-id-2: PS4VSEGQSXe1hryLjIq7W5nVm 6v341VyOca5o4vvXdSPKQFEtPrZmKXzlH0NFaN
x-amz-request-id: 7331123DA6F9001B
Date: Wed, 02 Jul 2014 08:33:44 GMT
x-amz-meta-s3cmd-attrs: uid:107/gname:nogroup/uname:jenkins/gid:65534/mode:33188/mtime:1397258161/atime:1397258161/md5:e61148c0af3132a8543f8f8692225220/ctime:1397258161
Content-Encoding: UTF-8
Last-Modified: Fri, 11 Apr 2014 23:16:11 GMT
ETag: "e61148c0af3132a8543f8f8692225220"
Content-Type: text/css
Content-Length: 3143
Server: AmazonS3
body {.    background-color: #f1f1f1;.    /* layer fill content */.   
font-family:"Open Sans", sans-serif;. font-size: 14px;.}.h1 {.
color: #4c4c4c;. font-size: 24px;. font-weight: bold;.}.#page1,
#page2 {. margin-top: 20px;.}..container.page {. width: 970px;.
overflow: hidden;.}..white-rectangle {. color: #7f7f7f;. back
ground-color: #fff;. /* layer fill content */. border: 1px solid
#e5e5e5;. /* stroke */. -moz-box-shadow: -2px 4px 0 #e8e8e8;.
/* drop shadow */. -webkit-box-shadow: -2px 4px 0 #e8e8e8;. /*
drop shadow */. box-shadow: -2px 4px 0 #e8e8e8;. /* drop shadow
*/.}...center-align {. text-align: center;.}...height400 {. hei
ght:400px;.}...para_text {. margin-bottom: 25px;.}..title-container
{. cursor: pointer;. position: relative;. left: 100%;.}..tit
le-container, .title-container:active, .title-container:focus {. ou
tline:none;. cursor: pointer;.}..btn {. font-weight: bold;. c
olor: #f9f9f9;. width: 225px;. height: 50px;. -moz-border-rad
ius: 3px;. -webkit-border-radius: 3px;. border-radius: 3px;.
-moz-background-clip: padding;. -webkit-background-clip: padding-bo
x;. background-clip: padding-box;. background-color: #75b73e;.}.
.btn.btn-free {. background-color: #CCCCCC;. color: #575757;.}..
btn.btn-free:hover {. background-color: #dbdbdb;. color: #575757
;.}..btn:hover {. background-color: #85C84E;. color: white;.}..b
tn:active, .btn:focus {. outline:none;. color:white;.}..firs

<<< skipped >>>

GET /offers/streaming/img/icon-close.png HTTP/1.1

Accept: */*
Referer: hXXp://utclient.utorrent.com/offers/streaming/index.html?port=10627&pair=AAF51F5F564AD28FFCFB5020BDB00283A1ED40A1&frameaddr=68242f8&plus=0&cid=AJ_YwRVi29RbUrz-&code=4
Accept-Language: en-US
User-Agent: Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1; WOW64; Trident/6.0)
Accept-Encoding: gzip, deflate
Host: utclient.utorrent.com
Connection: Keep-Alive


HTTP/1.1 200 OK
x-amz-id-2: lbRsTtdCDk/fNrgXdh5S sVH2rE4k8gWCauclpo7TiwvBGm9wzzh4mz8IUarfKsx
x-amz-request-id: 4CE777C1BEC3AAFE
Date: Wed, 02 Jul 2014 08:33:44 GMT
x-amz-meta-s3cmd-attrs: uid:107/gname:nogroup/uname:jenkins/gid:65534/mode:33188/mtime:1395949858/atime:1395949858/md5:41d1d6e9b78bb0ea06c73fd66c6e5665/ctime:1395949858
Content-Encoding: UTF-8
Last-Modified: Thu, 27 Mar 2014 19:51:01 GMT
ETag: "41d1d6e9b78bb0ea06c73fd66c6e5665"
Content-Type: image/png
Content-Length: 235
Server: AmazonS3
.PNG........IHDR................a....IDAT8...... .D..q..X.EY.....e..:.
......}....!.D4x.....1.)..........O`....O7........U.'....X&...H.....0.
?.. ...:c...j. ..Y5`5w.~.N.%0......O.wB...X...............p.........e.
7....n..`..?.....IEND.B`.
....



GET /offers/streaming/img/laptop-free.png HTTP/1.1

Accept: */*
Referer: hXXp://utclient.utorrent.com/offers/streaming/index.html?port=10627&pair=AAF51F5F564AD28FFCFB5020BDB00283A1ED40A1&frameaddr=68242f8&plus=0&cid=AJ_YwRVi29RbUrz-&code=4
Accept-Language: en-US
User-Agent: Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1; WOW64; Trident/6.0)
Accept-Encoding: gzip, deflate
Host: utclient.utorrent.com
Connection: Keep-Alive


HTTP/1.1 200 OK
x-amz-id-2: Aji6Hode6E S1l3q7apGdW1gXgcjdkvU 95QkBTn9a/oKDgrthT6BJWUPS9fq1Ij
x-amz-request-id: F1ACED3B8717B599
Date: Wed, 02 Jul 2014 08:33:45 GMT
x-amz-meta-s3cmd-attrs: uid:107/gname:nogroup/uname:jenkins/gid:65534/mode:33188/mtime:1395949858/atime:1395949858/md5:7d158091462ae8f99c8ade7ebc53592c/ctime:1395949858
Content-Encoding: UTF-8
Last-Modified: Thu, 27 Mar 2014 19:51:01 GMT
ETag: "7d158091462ae8f99c8ade7ebc53592c"
Content-Type: image/png
Content-Length: 1299
Server: AmazonS3
.PNG........IHDR...m...;.....q/......IDATx....O.G..g....5."p.."%p..R).
.U.Qz........{.rh.JUzi#...B.......&........ep4....Y.FZ...{3......W R.r
y..i...b6....Y DY......OiD...K.R.><:...w.[.......p.T*..*.&5@.z..
.;..F.s.;.''..O{?J..w...:..e....G"...pu.}4...W....h.Z.."......N6..G.*:
.....n.;.fCE.>..c.mt..l....Cs,.........`h.....C...c.....6.ch6Tt...9
..Fw.....}04.......P... .......g.v..w......8X..........M.....Xx......T
6..@......m>7x..o'...(..Q.!.Bl*...7.T.q.8..O....?..S./l..O.O.F.\i.A
..@..@thz..M|.N... ........j.?....c....j.*}.....}..H..B......Me^.@A...
......8.DT....lJ..,..,D....F.S.^..5"..l..8..8..mWg.4....Yt.J.....9D\..
..........\.t..C}&.Ahl(..l$:..^..7j.......H.O..z...v.....(...Bi3....h.
.-".[.J&."z........1..k:.b~$>..s|xV....J..6.3]l..A.".Q...e/......!.
.._.g8*.o.........g.Q@...M.W.J.H..N.....|9...>.a..#..]..G....F.X...
.p(s..W{.U....V../B......{..{h4.....Z"..G.q$....G....1..P:,\..t...w$..
F......Rb...5.B..).........8.r...Q../..S}.c}k........Jc....:!m.%-.H.s]
.H~.iww?v..[.s../..=.x.i=.G.f......T..d..%.....[..-.....Y.ok...h..chfm
..ah..1.........y..<0.f......-.....Y.ok...h..chfm..ah..1...[3.=.sxA
....#..5m......h-....,...w.*=..r.R...W.zo.y.c.^.j..Eb i.j....};..-...@
jW..qj[....... ..,.....Dk.N..(.."..%..)...Q.%............W.,.m..*.....
..Z.on....j/.@<.C(9..w.].].\....^.......N..Yi.%.....IEND.B`.

....

<<< skipped >>>

GET /offers/streaming/img/ribbon.png HTTP/1.1

Accept: */*
Referer: hXXp://utclient.utorrent.com/offers/streaming/index.html?port=10627&pair=AAF51F5F564AD28FFCFB5020BDB00283A1ED40A1&frameaddr=68242f8&plus=0&cid=AJ_YwRVi29RbUrz-&code=4
Accept-Language: en-US
User-Agent: Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1; WOW64; Trident/6.0)
Accept-Encoding: gzip, deflate
Host: utclient.utorrent.com
Connection: Keep-Alive


HTTP/1.1 200 OK
x-amz-id-2: lYJlQmCeSLVMnjGwJb9YLGBcMl6Ar0csA38FwGtRqUKPb2IgyPOvCxfBUQvCLIEl
x-amz-request-id: 4239DB08CC72CB3D
Date: Wed, 02 Jul 2014 08:33:45 GMT
x-amz-meta-s3cmd-attrs: uid:107/gname:nogroup/uname:jenkins/gid:65534/mode:33188/mtime:1395949858/atime:1395949858/md5:166d6b239e93d9b80d1c32cf92def2c3/ctime:1395949858
Content-Encoding: UTF-8
Last-Modified: Thu, 27 Mar 2014 19:51:01 GMT
ETag: "166d6b239e93d9b80d1c32cf92def2c3"
Content-Type: image/png
Content-Length: 4278
Server: AmazonS3
.PNG........IHDR...l...n............}IDATx...y...........d.@..eA......
.....`.X. .H%&).,...V.b...F..Dc......$J...aAPW.....r..{..3.....v..}..B
............._s..=...<W[p4sH.UU.......'o...Wp...........df..6=[Ww..
.]..l&w....Y7;2x......$I.R......(.>.c..GmS..R.........{.-..$2b....F
...\.8g.U...H2.....-3w..9...r.<..4.,./..dM.......U...Uy.3.?."}).?f]
.K..t..._%Pe.....p..G[^.....(^...U.c.[.......U..9.|].."..0..{..eko...u
.H..3\.R..P.L.,y...'x.........9;^.d6#d........b..L.....s...1g......f..
....5...kV.....q...|.....g.\..........,H..pF...}...............p.>T
."> ;..b.e'....['/-i.xuU.... ..x...C..p..?ue.?s..RYf.V&&...XS{.z\..
/...._.u..!..mJ......(2;..w.........*|...e.0....=.F......|l..EC..5U...
..-Q$..GQD.h.g.....G..^|......K..rb........<?.gC..-^`B.....Lu......
..T..|...T..\...{.......&... ...O....3o`....64!.....C.....T<..x...&
9."9X.x..........h...x...f.,..4]r2..mhI.cS.,2.M....;......0.iZ^.y...V.
.T...mc...f..C..3d.{I.lh...R..34.iz#.|SM..3....<...#;....V..t......
..........2.Xv2.w.[.Z..E.V.....7..t..jO@..;.5.j....U........m5a.....-.
.:4...3x!.....;.-........6.. 9 @K70!...JG.~..w:%Y.H..."@:..5..!-.|W. .
{.)4. .......d"zE.e..}....hD......A J.4...h..D.v..}V.......$..........
W..)}.r..Kh(T...O/.3.........(...e...`-.:...e..........S........?~.Bp.
....~X..Ass.....3..p.)*..f........W........z.z<....6d......O~.O.D..
ES"....-....6......;...V}...V....e.........a#..iAQwA...(k8;H...y7.hM.0
....F.N....N..t3.'=............=.mV.z...62..f`@....43.D.v.........S..3
5..M.z.H4......x..=k..M,..Mh..n..y..xlV.X&i....5Xh{..:...6.p..Y..B

<<< skipped >>>

GET /offers/streaming/img/devices-01.png HTTP/1.1

Accept: */*
Referer: hXXp://utclient.utorrent.com/offers/streaming/index.html?port=10627&pair=AAF51F5F564AD28FFCFB5020BDB00283A1ED40A1&frameaddr=68242f8&plus=0&cid=AJ_YwRVi29RbUrz-&code=4
Accept-Language: en-US
User-Agent: Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1; WOW64; Trident/6.0)
Accept-Encoding: gzip, deflate
Host: utclient.utorrent.com
Connection: Keep-Alive


HTTP/1.1 200 OK
x-amz-id-2: BDNDUH/Y49uGCs2MobbGnglyLtLIz32ojz9fbeetea9aukqVfEpZmmaGAkkVvy7Y
x-amz-request-id: B958D4A7AA1E2356
Date: Wed, 02 Jul 2014 08:33:45 GMT
x-amz-meta-s3cmd-attrs: uid:107/gname:nogroup/uname:jenkins/gid:65534/mode:33188/mtime:1395949858/atime:1395949858/md5:a9db19c7fb3f02ebf6b5290095bc11a2/ctime:1395949858
Content-Encoding: UTF-8
Last-Modified: Thu, 27 Mar 2014 19:51:01 GMT
ETag: "a9db19c7fb3f02ebf6b5290095bc11a2"
Content-Type: image/png
Content-Length: 5052
Server: AmazonS3
.PNG........IHDR.......n......2.K....IDATx..]kl...>3|.....OJ..v^.8.
.$N..M[..v..i...nw..[.....n....].W.4?..A....F.t..[.M.4...M..v,..EJ...$
.93{.mJ.5...!9.9..p..;...]...s.=G.............#{..Y4.%..A..nm.}....i..
*."..._........q1.....6.S..wc.k....P..*..zz.. .o.{..1. .....Y.V9...{.@
.[-...#`$.(0...\{.|.cf.......l.u..nH.5O.*.^...J.sdddM-.0-........4.g.j
...<.f....Z...V.... H.G@..=i...{.8...!....wf..5..<M.`h...1....M.
.s....>/..............Q.;...p.B.... .....(...QW..n...{...n..hV.>
.#..$H..u}...6...........E.paF...43.%8X.Q.9.c...U.Xp......#P.......<
;F..PE...*,...0.......D"..$........>l../.Z#..N.8ETP ..JT.`.w.~?2..c
A..r.q.#.....].cbb.URRWPH....8.N..{..<S..L...L..l.B(<.$B........
.R@<........m...s!.Kp.....[.).....$.ey....F...L#82R....0.q..b.....N
.j;..m...M.(&F..(F@.....KV..,.....z...[t8....uz,......V.s...H.........
....B.ohW>?0......N...L.h...P.!..oF...f.....f_.#4..Lfbp)..x&....;..
....=.....8..)..J.t..b%..Uvv....g...k9.w7....7.l.n.~...=.O.OF..@.l..\.
..5.G;...._A..gW:=L.\.4.B...F`...3..*.u')Y.D?...................!.....
.q{i....`.....8d......b.......K..i...F`....8.N..g. E.)i).w.>....v..
.....I..F....Np.`..Gw....2\..;..g1....c{.bX.....&8Hw.Z....E4.j......h2
%..m'ar.....C...h../Jeq:#`[.....".[.?../>...g......t..`;3.I.Z.SY.z.
#9.i.B......C...R...L......%.....~.N.<e*X.Rk...!O...............6'.
.y..AS...a....!.#.Z....j..G^..._....l$W..7.....x..............CVN.4..X
p...OF..&......r..l.........{6.!... ...4.7vo..A.R....L..#...!3.R6N,..t
@.."...A.L.Q.....Sfc........xf...M..,.>.......ZQ..[.z.7Dp\[.=..

<<< skipped >>>

GET /offers/streaming/img/ut-premium-logo.png HTTP/1.1

Accept: */*
Referer: hXXp://utclient.utorrent.com/offers/streaming/index.html?port=10627&pair=AAF51F5F564AD28FFCFB5020BDB00283A1ED40A1&frameaddr=68242f8&plus=0&cid=AJ_YwRVi29RbUrz-&code=4
Accept-Language: en-US
User-Agent: Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1; WOW64; Trident/6.0)
Accept-Encoding: gzip, deflate
Host: utclient.utorrent.com
Connection: Keep-Alive


HTTP/1.1 200 OK
x-amz-id-2: N2SSA72f/ekExYEnswB gsOQe67BzI/9PnIGf7OWKz/gDL2OCTeGeQC64thEtqRm
x-amz-request-id: 38AC11437AE044D5
Date: Wed, 02 Jul 2014 08:33:45 GMT
x-amz-meta-s3cmd-attrs: uid:107/gname:nogroup/uname:jenkins/gid:65534/mode:33188/mtime:1397098235/atime:1397256192/md5:394579a60ed225e898ee0c54682f4a02/ctime:1397098235
Content-Encoding: UTF-8
Last-Modified: Fri, 11 Apr 2014 23:16:11 GMT
ETag: "394579a60ed225e898ee0c54682f4a02"
Content-Type: image/png
Content-Length: 5444
Server: AmazonS3
.PNG........IHDR.......$......p......IDATx..].|V....{..yD.H..b.S....".
...[.. ..[.n.[j..y`w1.!y!...u.....[.u%.....[....S..b->x..$....3....
.B.........3g..{..3g&...d.l.?.1...l*.....1L...2{....G.x..Ec}..MN[.....
n..@..z.9.]Y.\.......H..G....w................3p@. o......s1.0...\...-
m]..t...3......V..E#X....d...._.s....O...\.ij.....@..U...aB..._:.,K...
........G.~.fz.>.3.R0G....c.0...y....U{..8i.....f@xG.^.......`*....
-..T.....8..>...........O......B..%...6.. ../2l{t]I...%m.p...Fe.{'.
o...A..8&f.u. .s/c.?=.o..... .XG.k.|....m....]R....tJ...5.J.nx)'v...I.
.E..;...|>.......&.....6T6...........rA...........M.f...Z7.t.t....f
@)......q9...[2.,..m!7J...P......)w>ng4..GV-f.....l....`, ...Q.6.Y@
.0.B.Y...o..5.2.....P.....R..4/...........7.....J&v......Y....{..My/..
.....j.%....V....iAS...8Z..=.gr...Ao.{7......}.V.j.e.......J\....i.iA.
..^.... ..R....i....[..1.K).".".h...kM..I......Q..(...)W....(.@.6.V.eR
....... ..5...*.x$^(......8.'...X.j..%/l..=..=..Y..;.SU.4..B0....W.4..
..s.0.v..... @oG...0C.....H..-...m.Ii_.%.....FNL,...[.J.k)......E.....
.[A.}........;..,?JC2...F.i..g.~~.%.i?.NI...7.!p;.u..).;V.EX\.........
A.5...i@.c.AIu%.w..e7U4..!$......sq...,...V..b.eB.`R....0...5?.Te.ba.!
a..RM...p.......l..t..A,.C..d...&erfOE..............K.:....../z.......
...@.....e..3.m.;..~..,.e3. ..>...7V4.}._.<..\v..Hk...=.4_8Z..\4
....dx.l .|...v....>.....v:p.%e[Ci......B(1............("b........!
..0......j.T.L...s..BX/C.3..k.-....S...{....)'g..E.#..|.ka.-.u...|..#.
..o%..... .}H..g).D..?..).\....`.x..H....k./#..}G;D........D(.E...

<<< skipped >>>

GET /aadebc4830c51c2794a960fe5a9e11df.php HTTP/1.0
Host: track.mypcbackup.com
User-Agent: NSISDL/1.2 (Mozilla)
Accept: */*


HTTP/1.1 200 OK
Date: Wed, 02 Jul 2014 08:33:54 GMT
Server: Apache
Set-Cookie: SESSID=1peqqvibkf5t04kgascm37kur3; path=/; domain=.mypcbackup.com
Expires: Thu, 19 Nov 1981 08:52:00 GMT
Cache-Control: no-store, no-cache, must-revalidate, post-check=0, pre-check=0
Pragma: no-cache
Set-Cookie: LC_CURRENCY=US; expires=Sat, 12-Jul-2014 08:33:54 GMT; path=/; domain=.mypcbackup.com
Set-Cookie: ?uva6aT*=US; expires=Sat, 12-Jul-2014 08:33:54 GMT; path=/; domain=.mypcbackup.com
Set-Cookie: LC_CURRENCY=US; expires=Sat, 12-Jul-2014 08:33:54 GMT; path=/; domain=.mypcbackup.com
Set-Cookie: ?uva6aT*=US; expires=Sat, 12-Jul-2014 08:33:54 GMT; path=/; domain=.mypcbackup.com
Content-Length: 8
Connection: close
Content-Type: text/html; charset=UTF-8
Set-Cookie: MPBWWW=3891563201.1.778673792.501672480; path=/
Complete..


POST /e?i=31 HTTP/1.1
Host: bench.utorrent.com
User-Agent: BTWebClient/3410(31105)
Accept-Encoding: gzip
Connection: Close
Content-Length: 198

{"h":"AJ_YwRVi29RbUrz-","cl":"uTorrent","v":109279617,"l":"en","w":"6.1","cts":1404290028,"eventName":"sau_metrics","dmver":109346224, "cau":0,"action":"dmv","nosau":0,"dl":1404282821,"fv":0,"ev":0}
HTTP/1.1 200 OK
Content-Type: text/html
Date: Wed, 02 Jul 2014 08:33:59 GMT
Server: nginx/1.4.7
X-Powered-By: PHP/5.4.30
Content-Length: 21
Connection: Close
{"response_code":200}..


GET /analytics.js HTTP/1.1
Accept: */*
Referer: hXXp://bundles.bittorrent.com/bundles/79b5f927c68a0bc7f648e016404705ab4f86772403bfbd9c089194fbebe30203?starttime=1393282818000&port=10627&pair=ADFC36D802A98BEB8DDDFD9BE07E8897AB050C2B&frameaddr=38a30e0&download=true
Accept-Language: en-US
User-Agent: Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1; WOW64; Trident/6.0)
Accept-Encoding: gzip, deflate
Host: VVV.google-analytics.com
Connection: Keep-Alive


HTTP/1.1 200 OK
Date: Wed, 02 Jul 2014 01:08:41 GMT
Expires: Wed, 02 Jul 2014 13:08:41 GMT
Last-Modified: Tue, 17 Jun 2014 01:05:58 GMT
X-Content-Type-Options: nosniff
Content-Type: text/javascript
Vary: Accept-Encoding
Content-Encoding: gzip
Server: Golfe2
Content-Length: 10852
Age: 26701
Cache-Control: public, max-age=43200
Alternate-Protocol: 80:quic
...........|kW............a..]].n.m).-.-...C.L0.$u......}..d;..}.8k..y
.>%....M.*OGC?.>..}).d.F:..a...l<.&.\.E..P..D,.I..L...4..hO..
m...#.K...Y.O..}...Y.....;.P.8K.P..u=...tr....;...D^.Lr@d.M..J<.^E^
....>~E....D.yj4:M.{...Xf[..G...\..y.,..d..l..tr$.....LQ..u&.P{..y.
Q..S4.%2O......z.J.[y...4G....)zB.Z. ..a.#..U...a?G...l6.G...%.(..)Z..
j..B..A.:OQg.$..........l4N......y.q.0....u...2.8..t ..Ol.........I.?F
....a.<...M...6.{..mIeF...x<@.#I.>O.2.e....c.....1.x.y'..5v1.
...E.=...k...h.\._.oQ.....I..FE&............R.h..T9Fe..F[m..U....@vUoy
.....h0BA..(.E..?...._..65eZ.].1Z......o..y...........8.........Xa....
....p4..M.......Fsm}..........>S=....i.m.......yA....lV..W.......T%
.5e....zQD.htt_.G.\WJvG.I...[Y&.z(......0....w..|.E..l..,...>J..F-.
.. .M_.j4...*,.......i.......F.I*.W..Q.ndGv..[.?....K...o...j_........
....N1...#h........1.pNN2..b.*..^*.&.hz.Ky?.4.P.._......._.k..U.,.i.}
.....O....c.......c...r..{B..\.........8eo.I....s..S.ZM.-...T....<.
.{.=u..f.h........l&......Yr6:O.;..j.oR.:....Y......'....*.........B..
......y.m.2..j.@&.4..B...)...B.CK.'O.>..[P...n....Oq/....>M@...P
? ..._..Sys....x.....>.u.{..iq.....G!...........N.wqq.z.......$V.uu
...GI.%Y..Z...vZ.....iwB'.....6.]].tl..S...(.0....#...&..n.:..@x..&..c
......R..r...X.f..i]^.N......=C...#e./.M......gBG..,..DK...yp..v.....6
:....Wr.>N....n&{~?..P.>....=.....Y2.$...*\B"..*...12.V......jRp
.............cu...U.c^..1...u]...i...m...*6..L....|s......x....6..f9@.
..(.g...=...bP.......&..~t$."=RS:..R.ug......'..w.......r.........

<<< skipped >>>

GET /plugins/ua/ecommerce.js HTTP/1.1

Accept: */*
Referer: hXXp://bundles.bittorrent.com/bundles/79b5f927c68a0bc7f648e016404705ab4f86772403bfbd9c089194fbebe30203?starttime=1393282818000&port=10627&pair=ADFC36D802A98BEB8DDDFD9BE07E8897AB050C2B&frameaddr=38a30e0&download=true
Accept-Language: en-US
User-Agent: Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1; WOW64; Trident/6.0)
Accept-Encoding: gzip, deflate
Host: VVV.google-analytics.com
Connection: Keep-Alive


HTTP/1.1 200 OK
Vary: Accept-Encoding
Content-Encoding: gzip
Content-Type: text/javascript
Last-Modified: Wed, 16 Apr 2014 21:48:42 GMT
Date: Wed, 02 Jul 2014 08:31:24 GMT
Expires: Wed, 02 Jul 2014 09:31:24 GMT
X-Content-Type-Options: nosniff
Server: sffe
Content-Length: 728
X-XSS-Protection: 1; mode=block
Age: 139
Cache-Control: public, max-age=3600
Alternate-Protocol: 80:quic
..........eTK..0....H}...B=.YUUUU/....8.1..b.1I.......l/`.=.cf )...imB
.'.6%?...3.81..=a{N:..._: ..d/..........,........0Q..1".b@....v..8....
.OX.7]gl.;$Q.s`.eG.@&f.p}=..Q.Yq@.c...P../..a.3*.t...a......f.......)j
>..yA."....6.{......._':e.|_.....M&R..X... .E..E...*.1.i.......AN.
.....W.x.2..6P..7...Y..$.....AE.......u......f*P?.qX..|5..L>...~..3
..n......v.:%wZ.h.bQ..WA..K.n1Qd.\...a{.....0.A.20..U..T.(.v..P9..U.,.
".L..r....){..n..$U.Oy.....1X...98.......`Zr,..b...$.....,...\~h..ji.Z
5D.....2.~p....X.A)...:....^.." #EM#x\}.9..W...U..n>@...1F....?.Lc.
.......j.m{*..\oje*......U...........`..d.Z.....2..=.q.W.....p....3...
..z\.....~.q.....vn.2.T..."r.4..?..j.........?..8.J.lG......$D.#._...4
....>...$.2OF......A.t.......o...{...
....



GET /collect?v=1&_v=j23&a=36551962&t=event&_s=1&dl=http://bundles.bittorrent.com/bundles/79b5f927c68a0bc7f648e016404705ab4f86772403bfbd9c089194fbebe30203?starttime=1393282818000&port=10627&pair=ADFC36D802A98BEB8DDDFD9BE07E8897AB050C2B&frameaddr=38a30e0&download=true&ul=en-us&de=utf-8&dt=Somewhere Else | BitTorrent Bundle&sd=24-bit&sr=1716x901&vp=973x534&je=1&ec=79b5f927c68a0bc7f648e016404705ab4f86772403bfbd9c089194fbebe30203&ea=InClient__InstallPath_TorrentDownload-Attempted&el=PublicTorrent&ev=0&_u=OKAAgIgS~&jid=899397547&cid=f862f0b3-a9cb-437c-941f-9f54e60b13bf&tid=UA-43671923-1&z=1077104819 HTTP/1.1

Accept: */*
Referer: hXXp://bundles.bittorrent.com/bundles/79b5f927c68a0bc7f648e016404705ab4f86772403bfbd9c089194fbebe30203?starttime=1393282818000&port=10627&pair=ADFC36D802A98BEB8DDDFD9BE07E8897AB050C2B&frameaddr=38a30e0&download=true
Accept-Language: en-US
User-Agent: Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1; WOW64; Trident/6.0)
Accept-Encoding: gzip, deflate
Host: VVV.google-analytics.com
Connection: Keep-Alive


HTTP/1.1 200 OK
Pragma: no-cache
Expires: Mon, 07 Aug 1995 23:30:00 GMT
Access-Control-Allow-Origin: *
Last-Modified: Sun, 17 May 1998 03:00:00 GMT
X-Content-Type-Options: nosniff
Content-Type: image/gif
Date: Fri, 20 Jun 2014 03:06:23 GMT
Server: Golfe2
Content-Length: 35
Age: 1056440
Cache-Control: private, no-cache, no-cache=Set-Cookie, proxy-revalidate
Alternate-Protocol: 80:quic
GIF89a.............,...........D..;....



GET /collect?v=1&_v=j23&a=36551962&t=event&_s=3&dl=http://bundles.bittorrent.com/bundles/79b5f927c68a0bc7f648e016404705ab4f86772403bfbd9c089194fbebe30203?starttime=1393282818000&port=10627&pair=ADFC36D802A98BEB8DDDFD9BE07E8897AB050C2B&frameaddr=38a30e0&download=true&dp=/bundles/79b5f927c68a0bc7f648e016404705ab4f86772403bfbd9c089194fbebe30203&ul=en-us&de=utf-8&dt=Somewhere Else | BitTorrent Bundle&sd=24-bit&sr=1716x901&vp=973x534&je=1&ec=79b5f927c68a0bc7f648e016404705ab4f86772403bfbd9c089194fbebe30203&ea=InClient__InstallPath_IeEngine&el=10.0&ev=10&_u=eKAAgIgS~&jid=&cid=f862f0b3-a9cb-437c-941f-9f54e60b13bf&tid=UA-43671923-1&z=1143596725 HTTP/1.1

Accept: */*
Referer: hXXp://bundles.bittorrent.com/bundles/79b5f927c68a0bc7f648e016404705ab4f86772403bfbd9c089194fbebe30203?starttime=1393282818000&port=10627&pair=ADFC36D802A98BEB8DDDFD9BE07E8897AB050C2B&frameaddr=38a30e0&download=true
Accept-Language: en-US
User-Agent: Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1; WOW64; Trident/6.0)
Accept-Encoding: gzip, deflate
Host: VVV.google-analytics.com
Connection: Keep-Alive


HTTP/1.1 200 OK
Pragma: no-cache
Expires: Mon, 07 Aug 1995 23:30:00 GMT
Access-Control-Allow-Origin: *
Last-Modified: Sun, 17 May 1998 03:00:00 GMT
X-Content-Type-Options: nosniff
Content-Type: image/gif
Date: Fri, 20 Jun 2014 03:06:23 GMT
Server: Golfe2
Content-Length: 35
Age: 1056440
Cache-Control: private, no-cache, no-cache=Set-Cookie, proxy-revalidate
Alternate-Protocol: 80:quic
GIF89a.............,...........D..;....



GET /collect?v=1&_v=j23&a=36551962&t=event&_s=4&dl=http://bundles.bittorrent.com/bundles/79b5f927c68a0bc7f648e016404705ab4f86772403bfbd9c089194fbebe30203?starttime=1393282818000&port=10627&pair=ADFC36D802A98BEB8DDDFD9BE07E8897AB050C2B&frameaddr=38a30e0&download=true&dp=/bundles/79b5f927c68a0bc7f648e016404705ab4f86772403bfbd9c089194fbebe30203&ul=en-us&de=utf-8&dt=Somewhere Else | BitTorrent Bundle&sd=24-bit&sr=1716x901&vp=973x534&je=1&ec=79b5f927c68a0bc7f648e016404705ab4f86772403bfbd9c089194fbebe30203&ea=InClient__InstallPath_Btapp_Download_Success&el=Somewhere Else-N-4e75813dfb7ca48ab329af68fec2bf200eab5504&ev=0&_u=eKAAgIgS~&jid=&cid=f862f0b3-a9cb-437c-941f-9f54e60b13bf&tid=UA-43671923-1&z=476402294 HTTP/1.1

Accept: */*
Referer: hXXp://bundles.bittorrent.com/bundles/79b5f927c68a0bc7f648e016404705ab4f86772403bfbd9c089194fbebe30203?starttime=1393282818000&port=10627&pair=ADFC36D802A98BEB8DDDFD9BE07E8897AB050C2B&frameaddr=38a30e0&download=true
Accept-Language: en-US
User-Agent: Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1; WOW64; Trident/6.0)
Accept-Encoding: gzip, deflate
Host: VVV.google-analytics.com
Connection: Keep-Alive


HTTP/1.1 200 OK
Pragma: no-cache
Expires: Mon, 07 Aug 1995 23:30:00 GMT
Access-Control-Allow-Origin: *
Last-Modified: Sun, 17 May 1998 03:00:00 GMT
X-Content-Type-Options: nosniff
Content-Type: image/gif
Date: Fri, 20 Jun 2014 03:06:23 GMT
Server: Golfe2
Content-Length: 35
Age: 1056440
Cache-Control: private, no-cache, no-cache=Set-Cookie, proxy-revalidate
Alternate-Protocol: 80:quic
GIF89a.............,...........D..;....



GET /collect?v=1&_v=j23&a=36551962&t=event&_s=5&dl=http://bundles.bittorrent.com/bundles/79b5f927c68a0bc7f648e016404705ab4f86772403bfbd9c089194fbebe30203?starttime=1393282818000&port=10627&pair=ADFC36D802A98BEB8DDDFD9BE07E8897AB050C2B&frameaddr=38a30e0&download=true&dp=/bundles/79b5f927c68a0bc7f648e016404705ab4f86772403bfbd9c089194fbebe30203&ul=en-us&de=utf-8&dt=Somewhere Else | BitTorrent Bundle&sd=24-bit&sr=1716x901&vp=973x534&je=1&ec=79b5f927c68a0bc7f648e016404705ab4f86772403bfbd9c089194fbebe30203&ea=InClient__InstallPath_ClientVersion&el=uTorrent_3_4_1_31105&ev=0&_u=eKAAgIgS~&jid=&cid=f862f0b3-a9cb-437c-941f-9f54e60b13bf&tid=UA-43671923-1&z=787819751 HTTP/1.1

Accept: */*
Referer: hXXp://bundles.bittorrent.com/bundles/79b5f927c68a0bc7f648e016404705ab4f86772403bfbd9c089194fbebe30203?starttime=1393282818000&port=10627&pair=ADFC36D802A98BEB8DDDFD9BE07E8897AB050C2B&frameaddr=38a30e0&download=true
Accept-Language: en-US
User-Agent: Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1; WOW64; Trident/6.0)
Accept-Encoding: gzip, deflate
Host: VVV.google-analytics.com
Connection: Keep-Alive


HTTP/1.1 200 OK
Pragma: no-cache
Expires: Mon, 07 Aug 1995 23:30:00 GMT
Access-Control-Allow-Origin: *
Last-Modified: Sun, 17 May 1998 03:00:00 GMT
X-Content-Type-Options: nosniff
Content-Type: image/gif
Date: Fri, 20 Jun 2014 03:06:23 GMT
Server: Golfe2
Content-Length: 35
Age: 1056440
Cache-Control: private, no-cache, no-cache=Set-Cookie, proxy-revalidate
Alternate-Protocol: 80:quic
GIF89a.............,...........D..;....



GET /collect?v=1&_v=j23&a=36551962&t=event&_s=6&dl=http://bundles.bittorrent.com/bundles/79b5f927c68a0bc7f648e016404705ab4f86772403bfbd9c089194fbebe30203?starttime=1393282818000&port=10627&pair=ADFC36D802A98BEB8DDDFD9BE07E8897AB050C2B&frameaddr=38a30e0&download=true&dp=/bundles/79b5f927c68a0bc7f648e016404705ab4f86772403bfbd9c089194fbebe30203&ul=en-us&de=utf-8&dt=Somewhere Else | BitTorrent Bundle&sd=24-bit&sr=1716x901&vp=973x534&je=1&ec=79b5f927c68a0bc7f648e016404705ab4f86772403bfbd9c089194fbebe30203&ea=InClient__InstallPath_PageView-Succeed&el=EmailGatePage&ev=0&_u=eKAAgIgS~&jid=&cid=f862f0b3-a9cb-437c-941f-9f54e60b13bf&tid=UA-43671923-1&z=999524987 HTTP/1.1

Accept: */*
Referer: hXXp://bundles.bittorrent.com/bundles/79b5f927c68a0bc7f648e016404705ab4f86772403bfbd9c089194fbebe30203?starttime=1393282818000&port=10627&pair=ADFC36D802A98BEB8DDDFD9BE07E8897AB050C2B&frameaddr=38a30e0&download=true
Accept-Language: en-US
User-Agent: Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1; WOW64; Trident/6.0)
Accept-Encoding: gzip, deflate
Host: VVV.google-analytics.com
Connection: Keep-Alive


HTTP/1.1 200 OK
Pragma: no-cache
Expires: Mon, 07 Aug 1995 23:30:00 GMT
Access-Control-Allow-Origin: *
Last-Modified: Sun, 17 May 1998 03:00:00 GMT
X-Content-Type-Options: nosniff
Content-Type: image/gif
Date: Fri, 20 Jun 2014 03:06:23 GMT
Server: Golfe2
Content-Length: 35
Age: 1056440
Cache-Control: private, no-cache, no-cache=Set-Cookie, proxy-revalidate
Alternate-Protocol: 80:quic
GIF89a.............,...........D..;HTTP/1.1 200 OK..Pragma: no-cache..
Expires: Mon, 07 Aug 1995 23:30:00 GMT..Access-Control-Allow-Origin: *
..Last-Modified: Sun, 17 May 1998 03:00:00 GMT..X-Content-Type-Options
: nosniff..Content-Type: image/gif..Date: Fri, 20 Jun 2014 03:06:23 GM
T..Server: Golfe2..Content-Length: 35..Age: 1056440..Cache-Control: pr
ivate, no-cache, no-cache=Set-Cookie, proxy-revalidate..Alternate-Prot
ocol: 80:quic..GIF89a.............,...........D..;..


GET /MyPCBackup_Setup.exe HTTP/1.0
Host: cdn.mypcbackup.com
User-Agent: NSISDL/1.2 (Mozilla)
Accept: */*


HTTP/1.1 200 OK
Date: Wed, 02 Jul 2014 08:33:38 GMT
Content-Type: application/octet-stream
Content-Length: 5464192
Connection: close
x-amz-id-2: QXTM8aFpDZceuTRo0JYwwenK7VhV0UZhyTIO4vAUSWtLkT8f6XPilHxVUeMi9VKS
x-amz-request-id: AA53935064E4F43F
Last-Modified: Tue, 24 Jun 2014 08:32:36 GMT
ETag: "cc1e34422f0fe7957531b7db55f193b5"
Server: NetDNA-cache/2.2
X-Cache: HIT
MZ......................@.............................................
..!..L.!This program cannot be run in DOS mode....$.......1..:u..iu..i
u..i...iw..iu..i...i...id..i!..i...i...it..iRichu..i..................
......PE..L......K.................\..........<2.......p....@......
....................P......S.S......................................s.
.........(m.......... NS.`............................................
................p...............................text...ZZ.......\.....
............. ..`.rdata.......p.......`..............@..@.data........
........r..............@....ndata.......@...........................rs
rc...(m.......n...v..............@..@.................................
......................................................................
......................................................................
......................................................................
......................................................................
...............................................U....\.}..t .}.F.E.u..H
.....>B..H.P.u..u..u...Hr@..B...SV.5.>B..E.WP.u...Lr@..e...E..E.
P.u...Pr@..}..e....Dp@........FR..VV..U... M.......M....3.....FQ.....N
U..M..........VT..U.....FP..E...............E.P.M...Hp@..E...E.P.E.P.u
...Tr@..u....E..9}...w....~X.te.v4..Lp@....E.tU.}.j.W.E......E.......P
p@..vXW..Tp@..u..5Xp@.W...E..E.h ...Pj.h.6B.W..Xr@..u.W...u....E.P.u..
.\r@._^3.[.....L$...>B...Si.....VW.T.....tO.q.3.;5.>B.sB..i.....
.D.......t.G.....t...O..t .....u...3....3...F.....;5.>B.r._^[..

<<< skipped >>>

POST /e?i=20 HTTP/1.1
Host: bench.utorrent.com
User-Agent: BTWebClient/3410(31105)
Accept-Encoding: gzip
Connection: Close
Content-Length: 295

{"h":"AJ_YwRVi29RbUrz-","cl":"uTorrent","v":109279617,"l":"en","w":"6.1","cts":1404290024,"eventName":"ap","fte":1,"lre":1,"ltic_0":0,"ltic_1":1,"lcic_0":0,"lcic_1":0,"laae":0,"lare":0,"laie":0,"lame":0,"name":"impression","errCode":0,"requestTime":1404290024,"action":"client.az.impression.ua"}
HTTP/1.1 200 OK
Content-Type: text/html
Date: Wed, 02 Jul 2014 08:33:55 GMT
Server: nginx/1.4.7
X-Powered-By: PHP/5.4.30
Content-Length: 21
Connection: Close
{"response_code":200}..


GET /1/8b9486d826?a=3276066&qt=5&ap=25.624376&be=0&fe=358&dc=346&v=411.b2946c1&to=IxtARFdGQF8XSXQnZUlMUkNcUV9QF0kJClAVCxo=&f=["err","xhr"]&jsonp=NREUM.setToken&perf={"timing":{"of":1404290020183,"n":0,"dl":0,"di":5,"ds":354,"de":354,"dc":355,"l":366,"le":367,"f":0,"dn":0,"dne":0,"c":0,"ce":0,"rq":0,"rp":0,"rpe":3},"navigation":{}} HTTP/1.1
Accept: */*
Referer: hXXp://bundles.bittorrent.com/bundles/79b5f927c68a0bc7f648e016404705ab4f86772403bfbd9c089194fbebe30203?starttime=1393282818000&port=10627&pair=ADFC36D802A98BEB8DDDFD9BE07E8897AB050C2B&frameaddr=38a30e0&download=true
Accept-Language: en-US
User-Agent: Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1; WOW64; Trident/6.0)
Accept-Encoding: gzip, deflate
Host: beacon-2.newrelic.com
Connection: Keep-Alive


HTTP/1.1 200 OK
Set-Cookie: JSESSIONID=582ce85d07febe21;Path=/
Expires: Thu, 01 Jan 1970 00:00:00 GMT
Content-Type: text/javascript;charset=ISO-8859-1
Content-Length: 21
NREUM.setToken(null)...


GET /utorrent-onboarding/player.btapp?h=AJ_YwRVi29RbUrz-&v=109279617&ol=en&ul=&tk=beta&c=uTorrent HTTP/1.1
Host: apps.bittorrent.com
User-Agent: BTWebClient/3410(31105)
Accept-Encoding: gzip
If-Modified-Since: Tue, 08 Oct 2013 00:53:35 GMT
Connection: Close


HTTP/1.1 304 Not Modified
Content-Type: binary/octet-stream
Age: 50212
Date: Wed, 02 Jul 2014 08:33:40 GMT
Connection: close


POST /e?i=27 HTTP/1.1
Host: bench.utorrent.com
User-Agent: BTWebClient/3410(31105)
Accept-Encoding: gzip
Connection: Close
Content-Length: 127

{"h":"AJ_YwRVi29RbUrz-","cl":"uTorrent","v":109279617,"l":"en","w":"6.1","cts":1404290018,"eventName":"embeddedIE","version":9}
HTTP/1.1 200 OK
Content-Type: text/html
Date: Wed, 02 Jul 2014 08:33:42 GMT
Server: nginx/1.4.7
X-Powered-By: PHP/5.4.30
Content-Length: 21
Connection: Close
{"response_code":200}..


POST /e?i=20 HTTP/1.1
Host: bench.utorrent.com
User-Agent: BTWebClient/3410(31105)
Accept-Encoding: gzip
Connection: Close
Content-Length: 293

{"h":"AJ_YwRVi29RbUrz-","cl":"uTorrent","v":109279617,"l":"en","w":"6.1","cts":1404290019,"eventName":"ap","fte":1,"lre":1,"ltic_0":0,"ltic_1":0,"lcic_0":0,"lcic_1":0,"laae":0,"lare":0,"laie":0,"lame":0,"name":"adrequest","errCode":0,"requestTime":1404290019,"action":"client.az.adrequest.us"}
HTTP/1.1 200 OK
Content-Type: text/html
Date: Wed, 02 Jul 2014 08:33:37 GMT
Server: nginx/1.4.7
X-Powered-By: PHP/5.4.30
Content-Length: 21
Connection: Close
{"response_code":200}..


GET /css?family=Open Sans|Open Sans Condensed:700 HTTP/1.1
Accept: */*
Referer: hXXp://utclient.utorrent.com/offers/streaming/index.html?port=10627&pair=AAF51F5F564AD28FFCFB5020BDB00283A1ED40A1&frameaddr=68242f8&plus=0&cid=AJ_YwRVi29RbUrz-&code=4
Accept-Language: en-US
User-Agent: Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1; WOW64; Trident/6.0)
Accept-Encoding: gzip, deflate
Host: fonts.googleapis.com
Connection: Keep-Alive


HTTP/1.1 200 OK
Content-Type: text/css
Timing-Allow-Origin: *
Expires: Wed, 02 Jul 2014 08:33:43 GMT
Date: Wed, 02 Jul 2014 08:33:43 GMT
Cache-Control: private, max-age=86400
Content-Encoding: gzip
Content-Length: 372
X-Content-Type-Options: nosniff
X-Frame-Options: SAMEORIGIN
X-XSS-Protection: 1; mode=block
Server: GSE
Alternate-Protocol: 80:quic
............MO.@.........".....B..F................mb....D......L.....
\...ZA.....i.:Y.ES...U..EF@C...Ev......j5...c[CILj.. .c.C.\....$.b;..T
.6.0...l\.....<7.......L.^L[.....53.w~.4...-..;.......20Q.9.f[.v..~
v......o._M...-.q...i"[............{.1.X$j....u.y.......=..t.....s,..o
.a..x.b/l.SN..i...<..JJG..g....e4P....Y.......B=F.O..v.e...qB.~.5.O
G.^:V..iK....q.f_...S...`.....


GET /scripts/dl.php?build=31105&ref=client&client=utorrent&sys_l=en&sel_l=0&tk=beta HTTP/1.1
Host: VVV.utorrent.com
User-Agent: BTWebClient/3410(31105)
Accept-Encoding: gzip
Connection: Close


HTTP/1.1 200 OK
Server: nginx/1.4.7
Content-Type: application/x-utorrent-language
Content-Disposition: attachment; filename=utorrent.lng
Cache-Control: max-age=3600
Accept-Ranges: bytes
Date: Wed, 02 Jul 2014 08:33:41 GMT
Last-Modified: Thu, 15 May 2014 12:30:28 GMT
Expires: Wed, 02 Jul 2014 09:33:41 GMT
Content-Length: 1339054
Connection: close
PK.........c.D%X_.JS..........Serbian (Latin)!srYU.txt..[s.G.&..3...dH
.j(I..F....$(...`p..Y, ..p$"/.YqI........y.z..1..........ZMOi..zJm.K.S
......=.9./......uu...p.p.p?~..........=..>..F..c....;....iY.J3i...
Y.,...ff^.r;.8~......O<..V...Y%.v..VF~.....u.......>)....f......
....x..e...J.le..M...{rn.Q...e.TY>H...J>>z..u..|a..bj...I...&
Y.M...zj..kg............ .R...IS....r`.C...R....,....i.qF?.EC]....v<
;........S...(.../.......".....;c.L...n*.&.bz..g.6..qS%}.'E>.Hz....
.]*E/1IE..7..-Q._L.Mm....`x...I.m..Z.......lF..$...:...FP... s.\...ky.
T.L.N..k. .rb.......o..........I&..Z.G..Vi.~j.q&....CNlY.%M....iif....
.3L79,.....&C*.L.Q..WfH.."/f.U{..k....}...m."......"5..\..T3;0.k.MZ#..
I..iV...uo>..'E.?.........H...5....I/KRS........W.....m.$...J.7....
.h.ti......1.1.Rs..ft.....R.$.b.$.....d..<..3....$....Q..d4.g4...@.
..)..}.s..&..L.Y..G..z.....jt....k..&Wwl..a.l}...0..k...]..3.e.f._16s.
`...._Z.v..Z....f..Q..j.nr0.a.iAR.I1....Q.i..WL..p.....i....u[.}K.g...
..l...n*.Gt....o........V3...h..aXuI.....4......Y.T...mm3...>....3.
ak....E.7..5".3...).pj......Q..o..........|A.S......6..}......3.......
.Z^K...%.0{T6sui.A%..<.m.).>....8qEM..R..M60l.zS..p...B..F.<.
.............4_g4kB........o]|..]Z>..<.En^.<K.......Ii...V...
SZ.<...O.y...L.d..".J.&(<...i.a...E...w.....:=..i.VMRhO.....0c*.
5....u.~C....@.Q....D..W.K..T..W.l..L..6...W.....)....<.I .3;.5.v-V
.._...........T#.c..Pi...N..!.._Pw......../...>..!..O S.....n.9(Q.4
..=.}V..6.g.{w......v...R!.4..hL....R%S.m7-...........w.....m..R.T

<<< skipped >>>

GET /MFEwTzBNMEswSTAJBgUrDgMCGgUABBRIt2RJ89X++hEzqoBeQg8PymQ2UQQUANhaTCXBIuWLMe9tuvPMXynxDWECECUM6OAwYS6fK4n3BU18+P0= HTTP/1.1
Connection: Keep-Alive
Accept: */*
User-Agent: Microsoft-CryptoAPI/6.1
Host: ocsp.verisign.com


HTTP/1.1 200 OK
Last-Modified: Tue, 01 Jul 2014 22:01:05 GMT
Expires: Tue, 08 Jul 2014 22:01:05 GMT
Content-Type: application/ocsp-response
content-transfer-encoding: binary
Content-Length: 1586
Cache-Control: max-age=566936, public, no-transform, must-revalidate
Date: Wed, 02 Jul 2014 08:33:42 GMT
Connection: keep-alive
0.........'0..#.. .....0......0...0...........0..1.0...U....US1.0...U.
...Symantec Corporation1.0...U....Symantec Trust Network1?0=..U...6Sym
antec Class 3 PCA - G1 OCSP Responder Certificate 2..20140701220105Z0s
0q0I0... ........H.dI.....3..^B...d6Q....ZL%."..1.m..._)..a..%...0a..
...M|......20140701220105Z....20140708220105Z0...*.H..............8.o.
.i...Z.z.,.....5.`...A*..J5.sq..~y...q...V....... ...mE.....m-..=...ZV
]..1.......3....<..m.........hG{..?t..a...7'........eF..BP...P..[..
%..>.EY...kg...Y.f...........X.;..<{@.......BK.@LC&]K.....>hx
K=$( {. ..Ii.....uO ij.0..*..I32.~,...>C..;.`.UN...s.....0...0...0.
.6.......^K..DT....j.f*..0...*.H........0_1.0...U....US1.0...U....Veri
Sign, Inc.1705..U....Class 3 Public Primary Certification Authority0..
.131112000000Z..141212235959Z0..1.0...U....US1.0...U....Symantec Corpo
ration1.0...U....Symantec Trust Network1?0=..U...6Symantec Class 3 PCA
- G1 OCSP Responder Certificate 20.."0...*.H.............0.........z.
..JUYp...h.....u..({.t..xG.xHq.-R........>..0..=...=?:.-....T*.....
..D.../.L...I.jJ.CB...YeY.....".......).KXo..Y=.5.v$..{.'.... `ML..L.q
..TxLw,.%.{...!...S.....a.Wb........jt&o...&.............4@pz.[.d4cxb.
.K. ...D.....%...Q.>.!...I0...K..;.u...~6.............0..0...U....0
.0l..U. .e0c0a..`.H...E....0R0&.. .........hXXp://VVV.symauth.com/cps0
(.. .......0...hXXp://VVV.symauth.com/rpa0...U.%..0... .......0...U...
.....0... .....0......0$..U....0...0.1.0...U....2048-TGV-4580...*.H...
.........#.k.....B=h.xL;W~.1....P......&......B...y..B.W..... kw..

<<< skipped >>>

GET /MFEwTzBNMEswSTAJBgUrDgMCGgUABBS56bKHAoUD+Oyl+0LhPg9JxyQm4gQUf9Nlp8Ld7LvwMAnzQzn6Aq8zMTMCEFIA5aolVvwahu2WydRLM8c= HTTP/1.1

Connection: Keep-Alive
Accept: */*
User-Agent: Microsoft-CryptoAPI/6.1
Host: ocsp.verisign.com


HTTP/1.1 200 OK
Last-Modified: Mon, 30 Jun 2014 17:00:29 GMT
Expires: Mon, 07 Jul 2014 17:00:29 GMT
Content-Type: application/ocsp-response
content-transfer-encoding: binary
Content-Length: 1895
Cache-Control: max-age=462502, public, no-transform, must-revalidate
Date: Wed, 02 Jul 2014 08:33:48 GMT
Connection: keep-alive
0..c......\0..X.. .....0.....I0..E0...........0..1.0...U....US1.0...U.
...Symantec Corporation1.0...U....Symantec Trust Network1?0=..U...6Sym
antec Class 3 PCA - G5 OCSP Responder Certificate 2..20140630170029Z0s
0q0I0... ...................B.>.I.$&.....e......0..C9...313..R...%V
.......K3.....20140630170029Z....20140707170029Z0...*.H..............|
.N....."{.Q3I.s.\.....'.Z._O..]..N.(.TX..D.Pm...<..-7...B...p'!..|~
.2....ygb.9...".3.hg..Zt. ..jm.<.P.....X?2^.zQO-C...5..S...e...J.8.
(K|.......n......l........mx..x...(Z{..S..RJ{.O. ...=...Z.i.......zy.B
m.\..M........w........G.O..*nJ.)....H...].y.U........0...0...0.......
...U..3....2.......0...*.H........0..1.0...U....US1.0...U....VeriSign,
Inc.1.0...U....VeriSign Trust Network1:08..U...1(c) 2006 VeriSign, In
c. - For authorized use only1E0C..U...<VeriSign Class 3 Public Prim
ary Certification Authority - G50...131112000000Z..141212235959Z0..1.0
...U....US1.0...U....Symantec Corporation1.0...U....Symantec Trust Net
work1?0=..U...6Symantec Class 3 PCA - G5 OCSP Responder Certificate 20
.."0...*.H.............0.........2...#.522.K.....G.....].........5....
..1.mW.....k....zz.5.....ts.o..v.....QtN.W.zO....t....B...:.......GVd.
'=...........6.Lg../......`.. .U..V ...6......Y....e.)....o....._.b...
..1......[.<.j.hT3..f......vJ>...Q.7....U...W3....i!...hu.JK...`
.L...S..@.~N...........0...0...U.......0.0l..U. .e0c0a..`.H...E....0R0
&.. .........hXXp://VVV.symauth.com/cps0(.. .......0...hXXp://VVV.syma
uth.com/rpa0...U.%..0... .......0...U...........0... .....0......0

<<< skipped >>>

GET /MFEwTzBNMEswSTAJBgUrDgMCGgUABBTSqZMG5M8TA9rdzkbCnNwuMAd5VgQUz5mp6nsm9EvJjo/X8AUm7+PSp50CEFcywVdOavgo4bT5Ors07Qg= HTTP/1.1

Connection: Keep-Alive
Accept: */*
User-Agent: Microsoft-CryptoAPI/6.1
Host: ocsp.verisign.com


HTTP/1.1 200 OK
Last-Modified: Mon, 30 Jun 2014 11:11:43 GMT
Expires: Mon, 07 Jul 2014 11:11:43 GMT
Content-Type: application/ocsp-response
content-transfer-encoding: binary
Content-Length: 1844
Cache-Control: max-age=441569, public, no-transform, must-revalidate
Date: Wed, 02 Jul 2014 08:33:49 GMT
Connection: keep-alive
0..0......)0..%.. .....0......0...0...........0..1.0...U....US1.0...U.
...VeriSign, Inc.1.0...U....VeriSign Trust Network1:08..U...1VeriSign
Class 3 Code Signing 2010 OCSP Responder..20140630111143Z0s0q0I0... ..
.................F....0.yV......{&.K......&.......W2.WNj.(...:.4......
20140630111143Z....20140707111143Z0...*.H................t.....M....j.
.Q..y.......:.Q...X.F.......0.....;&.........."..X;8A.$he.....A....;&.
C......s...>y..r.m.G...c.v....W.....5G..k..:P...a..9C.F....&.G:B..$
...S..kI.g..~..q.R......Q........ d..X".nFkR........>...I....L.....
....]$..B.A....J....~*..v...$.....Y.....0...0...0..........0...?..-..A
.F..p0...*.H........0..1.0...U....US1.0...U....VeriSign, Inc.1.0...U..
..VeriSign Trust Network1;09..U...2Terms of use at hXXps://VVV.verisig
n.com/rpa (c)101.0,..U...%VeriSign Class 3 Code Signing 2010 CA0...140
621000000Z..140919235959Z0..1.0...U....US1.0...U....VeriSign, Inc.1.0.
..U....VeriSign Trust Network1:08..U...1VeriSign Class 3 Code Signing
2010 OCSP Responder0.."0...*.H.............0..........}..{.x.fh.......
.'.U...D.D.n.g......B..(1.....o4.=..<v.F.aV..U...'........B........
77...........:....=....C..T.K..j......8..i..}..f........0:J...'.{M...-
.g.-(.4n......J...}.....U..8.o.{....\. ......q...h..<.....<.M...
^.7....S.x.=....rs#S~VY.....=.....GJw.........0...0...U....0.0....U. .
..0..0....`.H...E....0..0(.. .........hXXps://VVV.verisign.com/CPS0b..
.......0V0...VeriSign, Inc.0.....=VeriSign's CPS incorp. by reference
liab. ltd. (c)97 VeriSign0...U.%..0... .......0...U........0... .

<<< skipped >>>

POST /e?i=20 HTTP/1.1
Host: bench.utorrent.com
User-Agent: BTWebClient/3410(31105)
Accept-Encoding: gzip
Connection: Close
Content-Length: 295

{"h":"AJ_YwRVi29RbUrz-","cl":"uTorrent","v":109279617,"l":"en","w":"6.1","cts":1404290024,"eventName":"ap","fte":1,"lre":1,"ltic_0":1,"ltic_1":2,"lcic_0":0,"lcic_1":0,"laae":0,"lare":0,"laie":0,"lame":0,"name":"impression","errCode":0,"requestTime":1404290024,"action":"client.az.impression.ua"}
HTTP/1.1 200 OK
Content-Type: text/html
Date: Wed, 02 Jul 2014 08:33:53 GMT
Server: nginx/1.4.7
X-Powered-By: PHP/5.4.30
Content-Length: 21
Connection: Close
{"response_code":200}..


POST /e?i=29 HTTP/1.1
Host: bench.utorrent.com
User-Agent: BTWebClient/3410(31105)
Accept-Encoding: gzip
Connection: Close
Content-Length: 149

{"h":"AJ_YwRVi29RbUrz-","cl":"uTorrent","v":109279617,"l":"en","w":"6.1","cts":1404290019,"eventName":"cfu","action":"uTorrent.3.4.01.1.31105","i":0}
HTTP/1.1 200 OK
Content-Type: text/html
Date: Wed, 02 Jul 2014 08:33:44 GMT
Server: nginx/1.4.7
X-Powered-By: PHP/5.4.30
Content-Length: 21
Connection: Close
{"response_code":200}..


GET /impression.do/?user_id=FE2D69B3-3914-4632-9A57-DB6072FEFE3C&event=mypcbackup_ww_filesize_106748&spsource=68E633381BD14a69BD08A05C22B72D6A&traffic_source=68E633381BD14a69BD08A05C22B72D6A&browser=IE&implementation_id=dll HTTP/1.1
Accept: */*
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; WOW64; Trident/6.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; .NET4.0C)
Host: imp.install-zone.com
Connection: Keep-Alive


HTTP/1.1 200 OK
Cache-Control: no-cache
Pragma: no-cache
Content-Type: image/png
Expires: -1
Server: Microsoft-IIS/7.5
X-AspNet-Version: 2.0.50727
X-Powered-By: ASP.NET
Date: Wed, 02 Jul 2014 08:33:37 GMT
Connection: close
Content-Length: 109
.PNG........IHDR..............wS.....tEXtSoftware.Adobe ImageReadyq.e&
lt;....IDATx.b...?@....... .t.....IEND.B`...


GET /impression.do/?user_id=FE2D69B3-3914-4632-9A57-DB6072FEFE3C&event=mypcbackup_ww_downloaded&spsource=68E633381BD14a69BD08A05C22B72D6A&traffic_source=68E633381BD14a69BD08A05C22B72D6A&browser=IE&implementation_id=dll HTTP/1.1
Accept: */*
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; WOW64; Trident/6.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; .NET4.0C)
Host: imp.install-zone.com
Connection: Keep-Alive


HTTP/1.1 200 OK
Cache-Control: no-cache
Pragma: no-cache
Content-Type: image/png
Expires: -1
Server: Microsoft-IIS/7.5
X-AspNet-Version: 2.0.50727
X-Powered-By: ASP.NET
Date: Wed, 02 Jul 2014 08:33:37 GMT
Connection: close
Content-Length: 109
.PNG........IHDR..............wS.....tEXtSoftware.Adobe ImageReadyq.e&
lt;....IDATx.b...?@....... .t.....IEND.B`...


GET /stylesheets/public.6e99eab4adc332040f74e65e06c4942b.gz.css HTTP/1.1
Accept: */*
Referer: hXXp://bundles.bittorrent.com/bundles/79b5f927c68a0bc7f648e016404705ab4f86772403bfbd9c089194fbebe30203?starttime=1393282818000&port=10627&pair=ADFC36D802A98BEB8DDDFD9BE07E8897AB050C2B&frameaddr=38a30e0&download=true
Accept-Language: en-US
User-Agent: Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1; WOW64; Trident/6.0)
Accept-Encoding: gzip, deflate
Host: d1mh11hmkkdpin.cloudfront.net
Connection: Keep-Alive


HTTP/1.1 200 OK
Content-Type: text/css
Content-Length: 24494
Connection: keep-alive
Date: Wed, 25 Jun 2014 19:24:06 GMT
Cache-Control: max-age=31536000
Content-Encoding: gzip
Last-Modified: Wed, 25 Jun 2014 19:22:52 GMT
ETag: "8aa7ffa078bf83e79022e43aa2391653"
Accept-Ranges: bytes
Server: AmazonS3
Age: 565775
X-Cache: Hit from cloudfront
Via: 1.1 d84cd5311ccca1f37f90f1eed9f01585.cloudfront.net (CloudFront)
X-Amz-Cf-Id: dGihzIOpFs3v8bUMQND6Cw1Oa-N04q9ePVskkgKGeGXLwb3YwIgqig==
............k..6. .W.U..>...oJ..{.wfzvo..D......vP$t..IT.T=.8.}.f.H
..9Un..q.e.H$^..D".X..[Uw.c...>..3Y..M..i.....8../......D..DDz..9..
s....H.D..C.....Gr...'...PST...i.C}~~,.}]...#......j..6.s[|...H^..bu|.
...g...c..r2*^.)M.H....V.....*L......WDN<1...LL`b".S............m.&
..D...-...^..$......x..UE;.:.}..<....>._.. ...>vr.W.....3..~.
.o.....9?..X..G9t ..u....'^...Ct.......L..v.X...u.k.\.F~...i.P<.i.b
.....a.....u.X.t<...!2}..U}.h.....z<.....l.I.0....p..Uw..7E...&g
t;.|.X."...y_...,.... ..`...I..?..>./..8.n...|w..}[..=]..m..=.>x
x..on.n ...B..."xe.....`o0...N$..;u..tc.G2!FtL..^5.........c..L_.._f}Q
~p9..*.$O..@2..b....OuUI...Z.....*.<L1...>x8..w.M.......Q. g.3mg
Gnesl......'?...{..:^,.Vu.....>..w..t......@G.Cy@!".Ah...BV........
...;....O.|O....v.....}}<......VG.....U0hn1`........@..(@)q.t......
..x....v..8\()..|.....Q E..T.#.!..l.e6_.....P..].....P...j.h~...Cs.$..
.r.....)*4_.D.|:.}0.&..m>...-Y.x...@....X.K}.5.Q.I...id(.$..\H..9..
S*2XI.J.[....I...dqD.D.B.d...$.....O4.........I..Hy....9..(.TE...OQ$I.
om.T(.F.@v..Dq.O.w:.....]..c[..T-.a.4_...O.^.'*.....%/ar...U3..J.%..=.
..8...`.S.F.,.`B.bP.V...z:..A(!.Q...yWS..`..v}....n.5..K..HE...n.=H2.i
~.......H36....u._[....M.sY.r#Q.HqY1...6..STl.P.H.M.[.$.R..X.....]._'.
.....(d...8."*&..%..J.!..9.....]4.$.}Ay.(.fC#0. N.|I?..jY(@.....2...h.
m .C#pi.Fh.N... )Q.H#=m...........4Q.x..PF.$.p.l...*..\..o.NI. ...e.t.
......dS.MG.I..$...~..#-..x .d P....l.&6. .wZ.....@.A..b....Q.c..R....
.,..R.Qj...jN......e.}..9 L.@.1....C..l..Z..ax...LR.s.."I;GR..]V..

<<< skipped >>>

GET /javascripts/base.fcc9358c8aaae43d85b310d2804259c0.gz.js HTTP/1.1

Accept: */*
Referer: hXXp://bundles.bittorrent.com/bundles/79b5f927c68a0bc7f648e016404705ab4f86772403bfbd9c089194fbebe30203?starttime=1393282818000&port=10627&pair=ADFC36D802A98BEB8DDDFD9BE07E8897AB050C2B&frameaddr=38a30e0&download=true
Accept-Language: en-US
User-Agent: Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1; WOW64; Trident/6.0)
Accept-Encoding: gzip, deflate
Host: d1mh11hmkkdpin.cloudfront.net
Connection: Keep-Alive


HTTP/1.1 200 OK
Content-Type: application/javascript
Content-Length: 57306
Connection: keep-alive
Date: Wed, 25 Jun 2014 19:24:07 GMT
Cache-Control: max-age=31536000
Content-Encoding: gzip
Last-Modified: Wed, 25 Jun 2014 19:22:51 GMT
ETag: "0020cc4495440fc6ad9712644693a2b0"
Accept-Ranges: bytes
Server: AmazonS3
Age: 565774
X-Cache: Hit from cloudfront
Via: 1.1 d84cd5311ccca1f37f90f1eed9f01585.cloudfront.net (CloudFront)
X-Amz-Cf-Id: j2cZBgOHxFTzsQK3r4eYCFJOQL94pv_-IUHkOWNMjA08CL9Zf6XRXA==
.................(.|............a..$LQ.D.$ER..BC}.....@.XU.A.....~....
....~.Z.. ......c.h...c-.Q...9E.....Q....u.....'6..8...l.L.8M.."=....N
h..W...n2Q.......bR.....9O."..yw.-..w..x.e.u.<...,.../X...3.p..H..4
..~4H...B$.....o.Q2.l....,a"..I..........Y.v..8.....a.'.....(... .V6..
^^&.].ns.E._......1*..z[.Nu[1|....:.h]. 8.D.."Z.W1....L....K(........@
.-.8..K.......yq....U`.m6z.......k....(.`..b..j5..x.......~..6`....*..
.*lSN.dZ.@So..n.Z-..X...K..y..Y>..U....tB..0<......~.._DK.{2...#
L.h.(^&.....H.8....(...4.. .T[..41..,..v..J4..W........@....1tD..i.N..
.."..'..%?...89 .U...F.M.y.....f..g.r./^G...qWe~.#.a.....t..9.X.....x.
'..J.I.b[=...4).U..0...xPe....ta....t..aB.L`...(.@v.D.m...`...".-..uU.
..#x.Z......E........?.&P.8Y.A...Zb.....*..K18ul...E,gk6a..b36eg...9tJ
.G..#..'.e.b.|yp..y.y..r.,..7...?....S.|.4]."h.y.f=..Wr.t...<_.qF./
.?0D.E.M(.f.......h...E...?..9._.y7.......L8~..N.D8^.!..a..S..X..e.&.0
.lN..&*5h B...Gz\..G...'....u.y`..y.`k..2X.....*..}....:p..B.L..M.{..x
.f<..K.).....B.e.S..@S...3....:8....O..,`..G.R.`.W.'.S.VO ....z7.Ar
.x...{ ..._...E&..o.......8.. 2O..p.iTD.j^.i^z..2H.[rN.....]..ln...U..
.{...E....Y..B.X.(./.x.:..B..e..Qq...X.c%..M...>.......{..Lw..oEb..
".{-..d.X...]..!Z.m.....T/S...0\.E....z.....!.wU3%..$....E`X.I.6).....
@b...GDG.}3..X.a........&..!....Ny..(........P..N.....OP....c[...f.|..
.c..:.v.YO..\w.S....-.!...A.l$[F..w1t.....vG...m....J.6..C..g\.Q..L..d
.3l_....~...- .Tm....&.l......:1u.B._c...*...*\0..3&i.G.`.D.n..:[...R.
.8..8..4.p..i....@.:g.Y.Y.j..^h...E..;P.....$..."...])..)&..Z.`./.

<<< skipped >>>

GET /img/logo.2c586cc7a3f8c7e684be335d22b13d8d.png HTTP/1.1

Accept: */*
Referer: hXXp://bundles.bittorrent.com/bundles/79b5f927c68a0bc7f648e016404705ab4f86772403bfbd9c089194fbebe30203?starttime=1393282818000&port=10627&pair=ADFC36D802A98BEB8DDDFD9BE07E8897AB050C2B&frameaddr=38a30e0&download=true
Accept-Language: en-US
User-Agent: Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1; WOW64; Trident/6.0)
Accept-Encoding: gzip, deflate
Host: d1mh11hmkkdpin.cloudfront.net
Connection: Keep-Alive


HTTP/1.1 200 OK
Content-Type: image/png
Content-Length: 2216
Connection: keep-alive
Date: Sat, 21 Jun 2014 02:48:47 GMT
Cache-Control: max-age=31536000
Last-Modified: Thu, 19 Jun 2014 23:38:05 GMT
ETag: "2c586cc7a3f8c7e684be335d22b13d8d"
Accept-Ranges: bytes
Server: AmazonS3
Age: 971095
X-Cache: Hit from cloudfront
Via: 1.1 d84cd5311ccca1f37f90f1eed9f01585.cloudfront.net (CloudFront)
X-Amz-Cf-Id: H9zNJY9ijeJO-s-TDQhSoNvHc8-VJcYWDrvqY4DFQAKAphfUF7LQJA==
.PNG........IHDR.............Z.N....oIDATx....l.E..K[....B.... hD.b...
.x...R..(...BA..#....C..h.....F.i.*.G."...`.$&hAA".}...M...|...K...%..
~o..73.....6...b#.@..r.7.=..zt7....z,......gW...6.v.i..N..p.Z....k.R.N
%.;.....Z.v.....w.... f...W.Xe.k ......=..Z..y..CA;~;@.J.....lpI...}..
_I_.C.=&.Z....#....N.>..@...hI..>p....e.z....h...fl...x.......6@
....2.0h} .]J}1IEp$..........N.M.....}#.....A[...I_.;...h...fh......S.
.o...:C............{*.~a;.P9......;..^.m.........k.pl...].*...A.....t.
.2n...A....o..k(hI..9..DGg..m.0.....f...j..-.."..E;.X.P)..T.t.1D....b.
.C...7WS.._.~s?....w./n...\...7.$.v.-)..A3)..Eh...B.].h..%.s|?........
...^.....N..(..VG....h....8.0....Ph..........B....Ix.'.X....,h>...
...vU..ZY<.OV...>.F.9.%.|.Q.\...2.2N...2........5D.....f!\...X..
...A3..*s;.Ep...$.9Z...l...P..;P..{...*.....J...z.uV..kq~.1......K.S!.
...Q...\..*.uT..#j../.vo...Z.=...qt.*..o\g..K..|.6..V.*q]...._~..k.M..
jKK=.NY..\.......$...!.x....\.......N.RXe.4.$Jx.-;g%..z........yQ.Xv.!
?X=...._.P'......)`. ..~........w...._..Os.<...0..../......Q..5..j.
.2..T...5..ZL.C=.?/......8_....m.ur.o.1.K`.[p.....W..!.N_..5.^'...N...
..p...k..V........'.{juI[P.pl....~.F....,T.*........{......H.....I.-.?
.T...N.HeZ.[x...&.o........ W.t[.....T.0pIx...Z/.....L..[...>..([..
..W.]....b.ju..b%.c.....0.).."~..o... .y.qor9....}.CS.._c.....1z..u.cp
5..<.6..m...m]...TC....N..\.h...V!.......x-{....h.]D....0-V..'*V.?v
1os5x'8.w.."}.@.W..H..Pn.1.iT]@.E.{....06h&.....N%....r......E.....Z\o
.b{..B.n....=..?d._..lV.0.^9......0.j.U.....R.a...}V4.\%Z.U..FLv3.

<<< skipped >>>

GET /img/bundle-logo-large.4a053bd30f5bb3329130cf4fc49d0d73.png HTTP/1.1

Accept: */*
Referer: hXXp://bundles.bittorrent.com/bundles/79b5f927c68a0bc7f648e016404705ab4f86772403bfbd9c089194fbebe30203?starttime=1393282818000&port=10627&pair=ADFC36D802A98BEB8DDDFD9BE07E8897AB050C2B&frameaddr=38a30e0&download=true
Accept-Language: en-US
User-Agent: Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1; WOW64; Trident/6.0)
Accept-Encoding: gzip, deflate
Host: d1mh11hmkkdpin.cloudfront.net
Connection: Keep-Alive


HTTP/1.1 200 OK
Content-Type: image/png
Content-Length: 2324
Connection: keep-alive
Date: Thu, 19 Jun 2014 14:04:19 GMT
Cache-Control: max-age=31536000
Last-Modified: Sat, 14 Jun 2014 00:45:26 GMT
ETag: "4a053bd30f5bb3329130cf4fc49d0d73"
Accept-Ranges: bytes
Server: AmazonS3
Age: 1103363
X-Cache: Hit from cloudfront
Via: 1.1 d84cd5311ccca1f37f90f1eed9f01585.cloudfront.net (CloudFront)
X-Amz-Cf-Id: -fXl1u08d8xuDrDkbzlYPUXU_JI9M0GCQM15agX_xUY2Mg1ccovH3A==
.PNG........IHDR...R...P.......".....sBIT....|.d.....pHYs...........~.
....tEXtSoftware.Adobe Fireworks CS6........tEXtCreation Time.1/14/14.
lbA...mIDATx....o..........{......9....7..../..DI. .R.6/...A....F..H..
...i.TU..VH....m........|g../~........{w....{........W3..... !$..#-.U.
..~/....%.R.~.%.5.uSJ....J.?..^..p8...P..7f....'...*@)..?%.J.=B......`
...]....w..".....0.O.A.:~6wR..q.P.|r......D...;...|V2.d.....q...&....J
_....i&.=..J...G..p...E!........J........;U.T..Vj..`HT.dQ..T|.T.9.....
p.../w.E...c...dT..j..... .."D.g?...=..Q......^7......=^....9zZD....N.
Kc..f....|....7.ff}....{N$.})..T...i......4...E._....sy..Xq..|..|..M..
.U@...ID..'Wj...:..M|..q_.E.9..%:...4......[...."...7.!.._[..H.[....6.
K.g&.y...Q..[.. ...vK...}.....GO..i.....8=.H......F..5o...;s....<..
./.92F......yQ...;s.q{.pp.I......7^..N..2.>....(J@......k!.uh.[....
|\.r....2/...d....o....cH..A..v.oy../..^. .ih?3A..u..e..0GbDAd#,...u..
..x$..v.".B.5.0.d...>3.ar.0.;..:.........#ct._..^.WZ.>..G@..D...
.t.ya..A!-Uq..nW.vHTTP/1.1 200 OK..Content-Type: image/png..Content-Le
ngth: 2324..Connection: keep-alive..Date: Thu, 19 Jun 2014 14:04:19 GM
T..Cache-Control: max-age=31536000..Last-Modified: Sat, 14 Jun 2014 00
:45:26 GMT..ETag: "4a053bd30f5bb3329130cf4fc49d0d73"..Accept-Ranges: b
ytes..Server: AmazonS3..Age: 1103363..X-Cache: Hit from cloudfront..Vi
a: 1.1 d84cd5311ccca1f37f90f1eed9f01585.cloudfront.net (CloudFront)..X
-Amz-Cf-Id: -fXl1u08d8xuDrDkbzlYPUXU_JI9M0GCQM15agX_xUY2Mg1ccovH3A==..
.PNG........IHDR...R...P.......".....sBIT....|.d.....pHYs.........

<<< skipped >>>

GET /v7/installed?pid=BTR-V7&dtid=&cbid=&pf=&pids=&dbr=iexplore.exe_6_10.0.9200.16521&user_lid=409&client=stub HTTP/1.1
User-Agent: APN-Stub
Host: tbapi.search.ask.com


HTTP/1.1 200 OK
Date: Wed, 02 Jul 2014 08:33:37 GMT
Server: Apache
Content-Length: 2647
Connection: close
Content-Type: text/xml;charset=UTF-8
<?xml version="1.0" encoding="UTF-8"?>.<options id="BTR-V7"&g
t;<option id="dtid" value="^YYYYYY^YY^UA" client="macro"/>.<o
ption id="switches/enableHPG" value="1" client="macro"/>.<option
id="switches/enableFFRevert" value="1" client="macro"/>.<option
id="switches/enableStartSingleBrowser" value="1" client="macro"/>.
<option id="location" value="Kharkiv,Ukraine" client="macro"/>.&
lt;option id="reason" value="allowV7Install" client="stub"/>.<op
tion id="p2" value="^BJ2^YYYYYY^YY^UA" client="macro"/>.<option
id="locale" value="en_US" client="macro"/>.<option id="switches/
enableFFHPG" value="1" client="macro"/>.<option id="dbr" value="
iexplore.exe_6_10.0.9200.16521" client="macro"/>.<option id="swi
tches/enableVNT" value="1" client="macro"/>.<option id="switches
/enableGC32Rebuttal" value="1" client="macro"/>.<option id="nthp
" value="1" client="macro"/>.<option id="nthp" value="1" client=
"msi"/>.<option id="switches/enableGCStartupPage" value="1" clie
nt="macro"/>.<option id="cbid" value="^BJ2" client="macro"/>.
<option id="switches/enableIEToolbarProtection" value="1" client="m
acro"/>.<option id="domain" value="VVV.search.ask.com" client="m
acro"/>.<option id="proceed" value="yes" client="stub"/>.<
option id="longitude" value="36.25" client="macro"/>.<option id=
"switches/enableGCRestart" value="1" client="macro"/>.<option id
="dbgrpt" value="0,1" client="macro"/>.<option id="switches/

<<< skipped >>>

GET /impression.do/?user_id=FE2D69B3-3914-4632-9A57-DB6072FEFE3C&event=offer_0_accepted_mypcbackup_ww&spsource=68E633381BD14a69BD08A05C22B72D6A&traffic_source=68E633381BD14a69BD08A05C22B72D6A&browser=IE&implementation_id=dll HTTP/1.1
Accept: */*
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; WOW64; Trident/6.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; .NET4.0C)
Host: imp.install-zone.com
Connection: Keep-Alive


HTTP/1.1 200 OK
Cache-Control: no-cache
Pragma: no-cache
Content-Type: image/png
Expires: -1
Server: Microsoft-IIS/7.5
X-AspNet-Version: 2.0.50727
X-Powered-By: ASP.NET
Date: Wed, 02 Jul 2014 08:33:35 GMT
Connection: close
Content-Length: 109
.PNG........IHDR..............wS.....tEXtSoftware.Adobe ImageReadyq.e&
lt;....IDATx.b...?@....... .t.....IEND.B`...


GET /content-bundles/production-df0ec56d-0fbb-bc2c-11e7-354ff3af9c4e/79b5f927c68a0bc7f648e016404705ab4f86772403bfbd9c089194fbebe30203/53a31fb10c56d802001b29ae/Somewhere Else.torrent HTTP/1.1
Host: s3.amazonaws.com
User-Agent: BTWebClient/3410(31105)
Accept-Encoding: gzip
Connection: Close


HTTP/1.1 200 OK
x-amz-id-2: gbFNlK1aMRylcXbH/fvVhnKGWz3Ehy/yUmIZ96gxf9saXDbM Dv7ZLuiIdVg4DoI
x-amz-request-id: 31795CC4D9B4F8B4
Date: Wed, 02 Jul 2014 08:33:43 GMT
Last-Modified: Tue, 01 Jul 2014 18:43:29 GMT
ETag: "a4dc18d9d91198d7571b4c5bda237e8b"
Accept-Ranges: bytes
Content-Type: application/x-bittorrent
Content-Length: 26175
Server: AmazonS3
d8:announce38:udp://tracker.publicbt.com:80/announce13:announce-listll
38:udp://tracker.publicbt.com:80/announce44:udp://tracker.openbittorre
nt.com:80/announceel46:hXXp://tracker.bundles.bittorrent.com/announcee
e4:infod11:collectionsl47:com.bittorrent.bundles.53a31afe0c56d802001b2
9ade5:filesld6:lengthi3838e4:pathl21:00_What's-Inside.htmleed6:lengthi
286625709e4:pathl72:01 - Zeds Dead (feat. Twin Shadow) - Lost You (Off
icial Music Video).mp4eed6:lengthi9157072e4:pathl40:02 - Zeds Dead x M
emorecks - Love Me.mp3eed6:lengthi155413e4:pathl40:03 - Zeds Dead - Lo
go Wallpaper Art.jpegeed6:lengthi180e4:pathl31:04 - Zeds Dead Merch St
ore.htmleed6:lengthi191e4:pathl39:05 - Buy Zeds Dead Music on iTunes.h
tmleee4:name14:Somewhere Else10:originator1179:-----BEGIN CERTIFICATE-
----.MIIDOjCCAiICAQEwDQYJKoZIhvcNAQEFBQAwTDELMAkGA1UEBhMCVVMxCzAJBgNV.
BAgTAkNBMRcwFQYDVQQKEw5CaXRUb3JyZW50IEluYzEXMBUGA1UEAxMOY29tLmJp.dHRvc
nJlbnQwHhcNMTQwNTIwMjM1MzA0WhcNMTYwNTA5MjM1MzA0WjB6MQswCQYD.VQQGEwJVUz
ELMAkGA1UECAwCQ0ExFzAVBgNVBAoMDkJpdFRvcnJlbnQgSW5jMR8w.HQYDVQQDDBZjb20
uYml0dG9ycmVudC5idW5kbGVzMSQwIgYJKoZIhvcNAQkBFhVuHTTP/1.1 200 OK..x-am
z-id-2: gbFNlK1aMRylcXbH/fvVhnKGWz3Ehy/yUmIZ96gxf9saXDbM Dv7ZLuiIdVg4D
oI..x-amz-request-id: 31795CC4D9B4F8B4..Date: Wed, 02 Jul 2014 08:33:4
3 GMT..Last-Modified: Tue, 01 Jul 2014 18:43:29 GMT..ETag: "a4dc18d9d9
1198d7571b4c5bda237e8b"..Accept-Ranges: bytes..Content-Type: applicati
on/x-bittorrent..Content-Length: 26175..Server: AmazonS3..d8:announce3
8:udp://tracker.publicbt.com:80/announce13:announce-listll38:udp:/

<<< skipped >>>

GET /offers/streaming/offer.json?cid=AJ_YwRVi29RbUrz-&cc=82&l=-1 HTTP/1.1
Host: utclient.utorrent.com
User-Agent: BTWebClient/3410(31105)
Accept-Encoding: gzip
Connection: Close


HTTP/1.1 200 OK
x-amz-id-2: uNZLoIXTNk45UblHO9NZAwyydyQTg/y2KuPu2lk0/YJZSdEFwrC/EuJ9qdUQql1l
x-amz-request-id: FA72B07E771D4626
Date: Wed, 02 Jul 2014 08:33:41 GMT
x-amz-meta-s3cmd-attrs: uid:501/gname:staff/uname:jayraj/gid:20/mode:33188/mtime:1400522212/atime:1400522207/md5:e4899c8c0e01fd2dacf3b8bf2fbfd715/ctime:1400522212
Content-Encoding: UTF-8
Last-Modified: Mon, 19 May 2014 17:56:57 GMT
ETag: "e4899c8c0e01fd2dacf3b8bf2fbfd715"
Content-Type: application/json
Content-Length: 226
Server: AmazonS3
{.    "icon": "hXXp://utclient.utorrent.com/offers/streaming/streaming
-animation-icon.bmp",. "text": "Media Streaming",. "page": "http
://utclient.utorrent.com/offers/streaming/index.html",. "code": 4,.
"node": 0.}...


GET /impression.do/?user_id=FE2D69B3-3914-4632-9A57-DB6072FEFE3C&event=setup_complete&spsource=68E633381BD14a69BD08A05C22B72D6A&traffic_source=68E633381BD14a69BD08A05C22B72D6A&browser=IE&implementation_id=dll HTTP/1.1
Accept: */*
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; WOW64; Trident/6.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; .NET4.0C)
Host: imp.install-zone.com
Connection: Keep-Alive


HTTP/1.1 200 OK
Cache-Control: no-cache
Pragma: no-cache
Content-Type: image/png
Expires: -1
Server: Microsoft-IIS/7.5
X-AspNet-Version: 2.0.50727
X-Powered-By: ASP.NET
Date: Wed, 02 Jul 2014 08:34:05 GMT
Connection: close
Content-Length: 109
.PNG........IHDR..............wS.....tEXtSoftware.Adobe ImageReadyq.e&
lt;....IDATx.b...?@....... .t.....IEND.B`...


GET /68E633381BD14a69BD08A05C22B72D6A/offers.json?version=1.1&pid=2&ts=&browser=IE HTTP/1.1
Accept: */*
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; WOW64; Trident/6.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; .NET4.0C)
Host: config.install-zone.com
Connection: Keep-Alive


HTTP/1.1 200 OK
Cache-Control: no-cache, no-store, must-revalidate
Pragma: no-cache
Content-Length: 1955
Content-Type: application/json
Expires: -1
Server: Microsoft-IIS/7.5
Content-Disposition: attachment; filename=
X-AspNet-Version: 2.0.50727
X-Powered-By: ASP.NET
Date: Wed, 02 Jul 2014 08:31:55 GMT
Connection: close
{"offers":[{"name":"mypcbackup_ww","type":"utility","images":[{"1":"ht
tp://d22z5jqfvuej9a.cloudfront.net/bundles/mypcbackup/dll_mypcbackup.j
pg","1.25":"hXXp://d22z5jqfvuej9a.cloudfront.net/bundles/mypcbackup/dl
l_mypcbackup_125.jpg"}],"downloadinfo":[{"downloadurl":"hXXp://cdn.bac
kupgrid.net/aff_setup.exe","exename":"aff_setup.exe","event":"mypcback
up_ww","label":"mypcbackup","switches":"/S /product=mypcbackup /hash=a
04d5a5c /tid={date}","post_install_check_v2":[{"type":"registry_localm
achine","key":"Software\\Microsoft\\Windows\\CurrentVersion\\Uninstall
\\MyPC Backup"}]}],"links":[{"left":"287","top":"252","right":"364","b
ottom":"260","url":"hXXp://VVV.mypcbackup.com/terms/"},{"left":"368","
top":"256","right":"433","bottom":"261","url":"hXXp://VVV.mypcbackup.c
om/privacy/"}],"criteria":[{"type":"registry_localmachine","key":"Soft
ware\\Microsoft\\Windows\\CurrentVersion\\Uninstall\\MyPC Backup"}]},{
"name":"chicapwmanager","conflictswith":"passwordbox","adprovider_blac
klist":"68E633381BD14a69BD08A05C22B72D6A","images":[{"1":"hXXp://d22z5
jqfvuej9a.cloudfront.net/bundles/chicapwmanager/bt_dll_chicapwmanager.
jpg","1.25":"hXXp://d22z5jqfvuej9a.cloudfront.net/bundles/chicapwmanag
er/bt_dll_chicapwmanager_125.jpg"}],"downloadinfo":[{"downloadurl":"ht
tp://d22z5jqfvuej9a.cloudfront.net/bundles/chicapwmanager/chica_silent
_2008.exe","exename":"chica_silent_2008.exe","event":"chicapwmanager",
"label":"Chica PW Manager","switches":" /VERYSILENT","post_install_che
ck_v2":[{"type":"directory","key":"%ProgramFiles%\\ChicaLogic"}],"

<<< skipped >>>

POST /e?i=20 HTTP/1.1
Host: bench.utorrent.com
User-Agent: BTWebClient/3410(31105)
Accept-Encoding: gzip
Connection: Close
Content-Length: 293

{"h":"AJ_YwRVi29RbUrz-","cl":"uTorrent","v":109279617,"l":"en","w":"6.1","cts":1404290019,"eventName":"ap","fte":1,"lre":1,"ltic_0":0,"ltic_1":0,"lcic_0":0,"lcic_1":0,"laae":0,"lare":0,"laie":0,"lame":0,"name":"adrequest","errCode":0,"requestTime":1404290019,"action":"client.az.adrequest.us"}
HTTP/1.1 200 OK
Content-Type: text/html
Date: Wed, 02 Jul 2014 08:33:45 GMT
Server: nginx/1.4.7
X-Powered-By: PHP/5.4.30
Content-Length: 21
Connection: Close
{"response_code":200}..


GET /bundles/mypcbackup/dll_mypcbackup.jpg HTTP/1.1
Accept: */*
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; WOW64; Trident/6.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; .NET4.0C)
Host: d22z5jqfvuej9a.cloudfront.net
Connection: Keep-Alive


HTTP/1.1 200 OK
Content-Type: image/jpeg
Content-Length: 24072
Connection: keep-alive
Cache-Control: public
Last-Modified: Tue, 01 Jul 2014 15:22:53 GMT
Server: Microsoft-IIS/7.5
X-AspNet-Version: 2.0.50727
X-Powered-By: ASP.NET
Date: Tue, 01 Jul 2014 15:22:53 GMT
Age: 61742
X-Cache: Hit from cloudfront
Via: 1.1 622b39b22357e70fa8da7e1f171019f3.cloudfront.net (CloudFront)
X-Amz-Cf-Id: HKBJEiWTQuMOCkAVjei6Z-abxpt3EsuzLhFqWDJUimxe0-V-rxDW5Q==
......Exif..II*.................Ducky.......P......Adobe.d............
......................................................................
.................................................................D....
......................................................................
...................!..1A".2#.QaBqR3.v.7.CSst%5u.br..$4.8.6............
..........!1..A".Qaq.2.....BRr.34..b.#..............?.................
......................................................................
......................................................................
......................................................................
......................................................................
.....h;S....lV.cYM..}9..Jx.&W....z....B._.@...]..3..5....x.2.w...d.'..
...... ...kA...9K.....h.o*......M.....V./....M,...O.F.._Q...-.cP.m}...
.4m<J4.....L.G._ 4.N....f.....JT.'-.....6|...q(p.~'..x....=...C.X..
....[e*....G...|$..30.......G.F@?@G4...A....qi...b..r..Rg.%.1.........
H................................................................&...%
N...uhA.`zr......M?Q.[._....._...'...c..uwq2.`..{..:9..2.SKE...I\|.|..
..>@^.~...M.Q.l.D..>cw}...Ym...I..s~.4.%....iZ?.O....=B;.Ou}.W..
{3.... 3c7G=...R..P.K.8.P.35.T.......{.Gk.A.].>%.:..O#D........5...
D.&.{..Q......A.......6.8...qb./.....u)^e/....k$.{........81.^...09..u
s.K...l.......C....jC...^7.ZY>....~..%...z..uC....e.u.-.|F9.......L
Y.7vNz.)B|..#....~a.....h..C...a.....%....wu.a.....!..Gu..m..&..Q#.Q..
..*.....9...H.......w.O....vI.v'..L..q.T.R|..m..Dh...cm....h...I.O

<<< skipped >>>

GET /?clientv=29&cltzone=180&language=en,en&method=get_offers&mstime=0.124&os=WIN6.1SP1-64&product_key=cb00343115ffdf69411419d8a9ceff1a&v=1.0&signature=76c9333ec06129b83c928f81de3acca9 HTTP/1.1
Host: api.opencandy.com
Accept: */*


HTTP/1.1 200 OK
Date: Wed, 02 Jul 2014 08:31:57 GMT
Server: Apache
X-Robots-Tag: noindex
Last-Modified: Wed, 02 Jul 2014 08:31:57 GMT
Cache-Control: no-store, no-cache, must-revalidate
Cache-Control: post-check=0, pre-check=0
Pragma: no-cache
Connection: close
Transfer-Encoding: chunked
Content-Type: text/xml
2000..<?xml version="1.0"?>.<get_offers>.    <installer
_md5s>. <md5>0</md5>. </installer_md5s>
. <session_key>2aae5d2238ca18b801b423327bc6cf76</session_k
ey>. <product_name><![CDATA[BitTorrent]]></produc
t_name>. <offer id="3204" instance_id="30906" language="en" a
dvertiser_id="667"> . <name><![CDATA[SpeedUpMyPC 20
14 ]]></name>. <score>0.38</score>.
<exclusions tags="cat_utility_registry" />. <filters
applies="" keys="" />. <package_url>hXXp://cdn.opencan
dy.com/p/1039/installers/dlm.exe</package_url>. <packa
ge_md5>962e3904abdf2d2139b45d9d667942a2</package_md5>.
<package_filesize>302888</package_filesize>. <p
ackage_tool_version></package_tool_version>.<styles><
;image_source name="imgsrc">hXXp://media.opencandy.com/templates/32
04/3301/30906.png</image_source></styles>. <bann
er_title><![CDATA[Install SpeedUpMyPC 2014 ]]></banner_tit
le>. <banner_description><![CDATA[Recommended by Bi
tTorrent]]></banner_description>.<panel>.
<image name="background-on" imagesource="imgsrc" size="4
71,220" position="0,0" normalimagefrom="0,0"/>....<panel id="1"
name="install" Type="Radio" default="0" tabstopgroup="true" drawfocuse
d="false">.....<radio id="2" name="yes" position="6,139" siz

<<< skipped >>>

GET /static/fonts/opensans/v8/DXI1ORHCpsQm3Vp6mXoaTXZ2MAKAc2x4R1uOSeegc5U.eot HTTP/1.1
Accept: */*
Referer: hXXp://bundles.bittorrent.com/bundles/79b5f927c68a0bc7f648e016404705ab4f86772403bfbd9c089194fbebe30203?starttime=1393282818000&port=10627&pair=ADFC36D802A98BEB8DDDFD9BE07E8897AB050C2B&frameaddr=38a30e0&download=true
Accept-Language: en-US
User-Agent: Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1; WOW64; Trident/6.0)
Origin: hXXp://bundles.bittorrent.com
Accept-Encoding: gzip, deflate
Host: themes.googleusercontent.com
Connection: Keep-Alive


HTTP/1.1 200 OK
Vary: Accept-Encoding
Content-Encoding: gzip
Content-Type: font/eot
Last-Modified: Tue, 28 Jan 2014 23:51:09 GMT
Date: Tue, 24 Jun 2014 15:06:00 GMT
Expires: Wed, 24 Jun 2015 15:06:00 GMT
Access-Control-Allow-Origin: *
Timing-Allow-Origin: *
X-Content-Type-Options: nosniff
Server: sffe
Content-Length: 19331
X-XSS-Protection: 1; mode=block
Age: 667661
Cache-Control: public, max-age=31536000
Alternate-Protocol: 80:quic
.............P]]..............]....;.ww.....!.`............V.;.5.x.;.\
..V..P..t....?......p..0@ .........U.....d....?.3..._.........@.....8.
3..0.......v...-.......?.6.O..?.n.8x......&....>..`.g...z.. .!.._..
..........8.1.....c.[...3>.$.rwuk.f..LP.......TR.,.....dp.u.FJ...I.
.q......:..A-[.E...rF..............W.%..$..>2..7V.&.T..n....)...4.W
....<.q|..<c.....b....Yl..S..P....\.O./O...T.c..._..@........m..
......].......r.`..3...J..33...`)..zh.0...U....o....n....i#........D.X
..]Lq..).:.t!.,.....$..........P..~...Uj.}..f4....P.......|.6,..u&..T.
C#.a1..X...P.2K.v|..6_C........7....&WB9.........[..D^...C.'$...fE4DW.
.X....Jy...f:6.......l..(.Tl..o.......&0S.HO.>m....w.`.A}...aM.. d.
."...OK............`...............g.AOC|.S.._.;...'..............0.y.
......mp[.(..)L@.a(.......?THs3.#.!.g.........@....58.^...}.........B.
#..B....l..2!}.q..........{..H....`S$F}8.c2?..'..b.3w...W.W$........(M
.#...`.A.Ru...b.....=..;....y............p.op.%.>....G.<...&c.v.
...._...........t.......8..*1 ...N...=.....*rOF="HTTP/1.1 200 OK..Vary
: Accept-Encoding..Content-Encoding: gzip..Content-Type: font/eot..Las
t-Modified: Tue, 28 Jan 2014 23:51:09 GMT..Date: Tue, 24 Jun 2014 15:0
6:00 GMT..Expires: Wed, 24 Jun 2015 15:06:00 GMT..Access-Control-Allow
-Origin: *..Timing-Allow-Origin: *..X-Content-Type-Options: nosniff..S
erver: sffe..Content-Length: 19331..X-XSS-Protection: 1; mode=block..A
ge: 667661..Cache-Control: public, max-age=31536000..Alternate-Protoco
l: 80:quic...............P]]..............]....;.ww.....!.`.......

<<< skipped >>>

GET /static/fonts/opensans/v8/cJZKeOuBrn4kERxqtaUH3fY6323mHUZFJMgTvxaG2iE.eot HTTP/1.1
Accept: */*
Referer: hXXp://bundles.bittorrent.com/bundles/79b5f927c68a0bc7f648e016404705ab4f86772403bfbd9c089194fbebe30203?starttime=1393282818000&port=10627&pair=ADFC36D802A98BEB8DDDFD9BE07E8897AB050C2B&frameaddr=38a30e0&download=true
Accept-Language: en-US
User-Agent: Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1; WOW64; Trident/6.0)
Origin: hXXp://bundles.bittorrent.com
Accept-Encoding: gzip, deflate
Host: themes.googleusercontent.com
Connection: Keep-Alive


HTTP/1.1 200 OK
Vary: Accept-Encoding
Content-Encoding: gzip
Content-Type: font/eot
Last-Modified: Tue, 28 Jan 2014 23:51:09 GMT
Date: Mon, 30 Jun 2014 12:38:21 GMT
Expires: Tue, 30 Jun 2015 12:38:21 GMT
Access-Control-Allow-Origin: *
Timing-Allow-Origin: *
X-Content-Type-Options: nosniff
Server: sffe
Content-Length: 18265
X-XSS-Protection: 1; mode=block
Age: 158120
Cache-Control: public, max-age=31536000
Alternate-Protocol: 80:quic
..........u.sx%......83.mw...m....m..:.mt..:.....[k.s...w....w.g.....$
).`^.....4.............H.....9....}]R.0-..F...._}.&.......E.......!U..
?.......Of.p.........4.I\....8..4..........@TUR.?....5..).....f......-
Mx ../.<I.y......G..7.....uR.....q&.&6.-X..lDlx.....y..~..O.<...
......'}..q........=.1..qvW..S..I."\u.....0.X...V#w..'#..[.`L.........
...&.J!.5.d......i...MG..m=..k.T..\..&.-...C..Y.]D.L.... ...I..|.8....
7.]. ...B...[.J.9k...,..C...h.-*.4.....%Y]Q'....<..Ò.9\...qC,g...
....'<G_..|*.'.2=..q~9.7W,0......V.?sN..T..PJ9.}P]H......D!...K....
k...H3..F.N....J....._.....;H't....d.8.'].........}.V...EGb..]#76...oV
...VE.e..`fc.7...t...V...!.......^.qX..0T.....^...sZs%^....7.o..4z.i.V
2.d..B.E....)\......w.MV5.>.p...Mh}0...NE.JE.O .Y.F...N..'.........
G..O..E...G..BM.wx......L8..U...T..^..8......:....e..z-q......~......D
..=.fEf....;.w....P...b...X..Z/.....9*.......m..I..i.nG3.n.@){...P9{.b
du..voz..<q....e...8......v.A,..=.X..$..3ea...B. ..D..L....ow...7Q.
:...q.....9./....yg..c..keZ.... .^..,%G%..Y.p..O%.G\.........X."....n.
...6.*.Y...A.k...".N.....l...f..l....b..v..N.....E.A.6.e.6...%.....Y[.
.D...#.Z.{~{.....&.Q.......7...r7.@..O..G.y`./2.^L....i....JQ."...s...
jW.Y....1.....|.6.=Y|....!...5K.|......'.....l......_..tQ..*Z..2....Q.
6...(C.,..B^..X...c..(m.n.7..(.Q.O.q"..\Od.".2.l....H......Gi.".b]..1{
.....X.....)C........7... ...C.i..tN....G1.]0*W....t.....".y1.X)...|..
..<.....[..^.....0.z...X.gJ.s.tcu....x.{..u(.N'........X.:..xQH..V.
1.z....a0.q...q.4.../dr..!t......_:u.F.F@....M......D.4g.2...=...2

<<< skipped >>>

GET /static/fonts/opensans/v8/MTP_ySUJH_bn48VBG8sNSnZ2MAKAc2x4R1uOSeegc5U.eot HTTP/1.1

Accept: */*
Referer: hXXp://bundles.bittorrent.com/bundles/79b5f927c68a0bc7f648e016404705ab4f86772403bfbd9c089194fbebe30203?starttime=1393282818000&port=10627&pair=ADFC36D802A98BEB8DDDFD9BE07E8897AB050C2B&frameaddr=38a30e0&download=true
Accept-Language: en-US
User-Agent: Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1; WOW64; Trident/6.0)
Origin: hXXp://bundles.bittorrent.com
Accept-Encoding: gzip, deflate
Host: themes.googleusercontent.com
Connection: Keep-Alive


HTTP/1.1 200 OK
Vary: Accept-Encoding
Content-Encoding: gzip
Content-Type: font/eot
Last-Modified: Tue, 28 Jan 2014 23:51:09 GMT
Date: Tue, 24 Jun 2014 15:07:56 GMT
Expires: Wed, 24 Jun 2015 15:07:56 GMT
Access-Control-Allow-Origin: *
Timing-Allow-Origin: *
X-Content-Type-Options: nosniff
Server: sffe
Content-Length: 19392
X-XSS-Protection: 1; mode=block
Age: 667545
Cache-Control: public, max-age=31536000
Alternate-Protocol: 80:quic
............ct%o..;33c...m..m...t..cul..;N:..t.......k.s>.........j
....F...."..... .?......... .:@.....r......Dh....@.H...0v....(.....%..
.!u..?...f.p..........?s....2k..?{S..?..@.....y....u= .......]..1ui...
. .......L....<w.7.....'v...A. wW.Vw.^y...0.X.....ji.~Y.&....*R.[Z.
..,....8I...K..4.....x....rA .Q..C....4......v_,~..Q.....03^....sAko..
.).w..m.P...;..*..*..F:..h....[.........SIu.Bnt....H}1.N.]...z....3f.;
...Wj....uhP.:.6....-.....XC*Jh.....b..y..#`H..x....."..l.Y......f..E~
-fc.x>.J.../....-..V..|....^5..^H.aZo..;l!FM..(..%u....). R&.......
$:.%8|e-..[........w.|.X.T......a.9.9..by..J..H..J..g..a.rP.zU<.,.b
......=Pib...ZA..,.....0N.a......vvg..'....6..r...0VxW........l:..c.w.
..5...H. .9.a/`R......p..":.....R.....5.....,Y..mB.:{6Esy....]..._B..=
.....cy..........\xW..i.n2<..........`.G..H.E..A.. f|YN.9.!"~.ZL..;
*A.I;GB.....g.....CV..Z ..H.uv<..P..A .g..U....l]...r!..../yl.{.0."
..\ab.xY.T..3...8.xIJPI.Nn.......Go=........y%..m.7s.v.Z.l..q%T*..@8.C
...P....s........=.G..V.Q...)t.0..t.K...Zr.-6R..!..)6T..c......Y...'..
.?..f#%....D[4.._.....Y.7.;o..O......@...J.'.....udE.F=xKa.t^V....m#;.
.!.@.......'...d..s......u.Y.IX..?(P&...V.m.9....P...=..xV.i.V.B~^...V
..2.y.h.Vp..L....Gp.0.....l!..4...$rV.R..v....a....@R`.X......>....
y._.....#...53 .....hP...}..>..I..$...Q7.T.t.. >3....U|.c0Ot.N.r
..|..}.~.q(.!.$P0.........9...z$.....9.0.)T..ZFY...\.f%...Y.r.g0.t.~..
.V._eDu5'.&...{.[i[9qc.a.tU)8>..v..a..,.& 6..w.hfQ.~$w.........'...
y.[%c'.Z..|.[.0.....W...jH#.....1%...Iax7.....E3..WAR...0.......K.

<<< skipped >>>

GET /bittorrent/image/upload/f_jpg,w_1440,q_70/content-bundles/production-df0ec56d-0fbb-bc2c-11e7-354ff3af9c4e/53a0fc156e35310200e22f33/oigklpHfR96yCGJVAjuK_Zeds Dead Press Photo 2014.jpg HTTP/1.1
Accept: */*
Referer: hXXp://bundles.bittorrent.com/bundles/79b5f927c68a0bc7f648e016404705ab4f86772403bfbd9c089194fbebe30203?starttime=1393282818000&port=10627&pair=ADFC36D802A98BEB8DDDFD9BE07E8897AB050C2B&frameaddr=38a30e0&download=true
Accept-Language: en-US
User-Agent: Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1; WOW64; Trident/6.0)
Accept-Encoding: gzip, deflate
Host: d1m8s5h8cyrbdy.cloudfront.net
Connection: Keep-Alive


HTTP/1.1 200 OK
Content-Type: image/jpeg
Content-Length: 277700
Connection: keep-alive
Accept-Ranges: bytes
Access-Control-Allow-Headers: X-Requested-With
Access-Control-Allow-Origin: *
ETag: "2f237e69e8f64a6b131457dd75188a62"
Last-Modified: Fri, 27 Jun 2014 22:57:24 GMT
Server: cloudinary
Cache-Control: public, max-age=2592000
Date: Mon, 30 Jun 2014 18:25:31 GMT
Age: 137291
X-Cache: Hit from cloudfront
Via: 1.1 c3c0d58b159b49bebbb09f118dea0023.cloudfront.net (CloudFront)
X-Amz-Cf-Id: nq68GXFs9Ty4xBBBiJezwgm4ovl4HRAzWIliOnJ0XQDpZTodBmx4sA==
......JFIF.....,.,.....C...........................#.%$"."!& 7/&)4)!"0
A149;>>>%.DIC<H7=>;...C...........;("(;;;;;;;;;;;;;;;;;
;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;.....................................
...............J.........................!1A.."Qa.q.2..#B..R.$3br...C.
...S4..%D.5Tcs..6&...............................1....................
...!1AQ.".2aq.#B...R...................?.....5..r..y{........E3...H.4.
...._N...&.. NK....2....I...........*.4..`..TX..T...y..2.i.S.&...h....
.D.....G<...Pj).....Z..`...@.=...U.$3....z.Ee.r...R.x..5tm....7....
.?.......Z.x...:..Z......T.pGj..4..k s.....,..F.z........Vd..Pj$*.sWB.
.g.i..A.?M]...5'..Qb\t.E.kp..Dd..8'...QE$}..,.Y3....'...Q.... 7..u....
.1`q....,x..U.#.M.........'.VQ.$AO...................#....C..J.O.5P$..
.ZI.$}.Y..l.uf.cFy...j......R....A....Z.].....*....p.......0s.A....4.D
eh......!,..U.S..@.2..a .M..O.<T..&I.i..3A.F.....h%W.P..;qPZ&..E...
5..k...0.b.......sU.G...v5...P.a..=**.....V....#,.4.4..(....E"r.......
..W@9.TX.*.......I.......( .....A.l..e....b.YI_.X.j..lqDX7.f..4..sY.z{
.$.SIWI..>1S.<..$P..y...0A.S`S....PA<V.....m.@w...AP....P.. .
C7....y.@..3...|GAA.j)......_#..&.kH_<..z...E...n6.3......1..A..3Z.
.pm..A.$.U..9c.@I...E]...O4U._l....#N......f5XW/...t`.n\.E.J..h......Y
?...h..f....c.=*...|.[f.s..Gz.iX..Dc.K.c!.......G.G..$W:..[U.@@.B.....
'>..fY...P3.Z...4.1n(...r...k. .j...9.R...>.R=..1..>@8..5....
.....i.@.......)A.4.v..*....0sP^s..9.V..La...k9|\~..Ne...\.....E......
.V8.PK..i.&7.}.m.1........)Fw.....D...qM....M..Qi.......b.4U..y...

<<< skipped >>>

GET /langpacks/langpack-3063504ut.win.zip HTTP/1.1
Host: ll.download3.utorrent.com
User-Agent: BTWebClient/3410(31105)
Accept-Encoding: gzip
Connection: Close


HTTP/1.1 200 OK
Server: nginx/1.4.4
Content-Type: application/zip
Cache-Control: max-age=86400
Accept-Ranges: bytes
Age: 54909
Date: Wed, 02 Jul 2014 08:33:41 GMT
Last-Modified: Fri, 14 Mar 2014 16:58:58 GMT
Expires: Wed, 02 Jul 2014 17:18:32 GMT
Content-Length: 1315367
Connection: close
PK........l.nDT...Jk..S.......Ukrainian!uk.txt...n\../.?..CI.)RC.]|.."
. [r..Y...8.e.Z.E......HV.. .... Y.B.q,.....p0iQl.E...<.A3.0/p^..w.
{.........."...UU......~.....}0<.......n........-..w...#.......n...
mt....[{w......Q..w.....fw{o....._=..^.[.[....|......._.nG6......s....
..........).f..JZ.M.S...B....EwW>.....M..e.D...B.'.....G{..[{ {..;r
,p..g.1w..-..!oi...r\.{...D...........s....c..6=..}.......}*...n.....c
d.w'..g..u.e..*..{.t....\.wc.....l./..|K.;*....m..[..........h.;......
0...^..h.D......;.....y.....|:!....T...k=....k.*.........w~:......."{.
.'~.....{ r.rv.....<.D..s.s... w...q-W.-........r.\JK...g.......g..
....Bo`.\....5......j.rI....Z(]*.b.^...U...-/^..9)*..b.*fs%Q......(...
\.(..c..jZ.......7.......RM..|.J..6..i....:./.......AB.-..3"-..e..s...
.*5<W...=.n.....r.&.(d.s51_.-N.:4......Z..^"...9q.\..J.....T\Jk59..
.BZ.....EZ.. .......nn.2.m....l.V....r{....D.....a7O..3..7..........X^
.B...............;{.qU..p....\.[(2Wp!......z..}.V.s........n..i..lA/..
x...x.&.*.h../.7._[.L.7rCm._.,x..p. ..Fi.u..Fx.k.9.o.. .qQ........l.%o
H....\.Z..|.~.WC.......J..(...$FX:.G.\n...`_y.S.e.m...v.[.P....t...l..
.R..&....P....a..AL..n$.jX...].....V.hi@......;.?..6$.......gDJ.9.(..p
.N..<.q2.o.Ox.r..,~...^]...z.r..ca.y%.....)..3,..>.a.X6.Y.%.a.(.
.a...y....7."..w...=#....'P..K...@9.B.z...3..^.3[.....Z....Xz..y1.^...
%...ri6.M..o..=7=-............u~..>L&.........#....n.\a..vAM.......
2)m......h..G.T=....C...aIv[.$..U.....[\,.f....;. .H..I(..G..Cr.....Q.
:(.`.l.$....................w.....n.v..|....J.......}.R.^.9./.T/..

<<< skipped >>>

POST /e?i=29 HTTP/1.1
Host: bench.utorrent.com
User-Agent: BTWebClient/3410(31105)
Accept-Encoding: gzip
Connection: Close
Content-Length: 171

{"h":"AJ_YwRVi29RbUrz-","cl":"uTorrent","v":109279617,"l":"en","w":"6.1","cts":1404290018,"eventName":"dimensions", "appsize": [ 1200, 600 ], "screensize": [ 1716, 901 ] }
HTTP/1.1 200 OK
Content-Type: text/html
Date: Wed, 02 Jul 2014 08:33:47 GMT
Server: nginx/1.4.7
X-Powered-By: PHP/5.4.30
Content-Length: 21
Connection: Close
{"response_code":200}..


GET /MFEwTzBNMEswSTAJBgUrDgMCGgUABBQSBA0TLeT5Hrk8v73bcU3oAZux9AQUEUrQcznVW2kIXLo9v2SaqIscVbwCEFCJdZ5K2+b6D313VdV4haw= HTTP/1.1
Connection: Keep-Alive
Accept: */*
User-Agent: Microsoft-CryptoAPI/6.1
Host: gb.symcd.com


HTTP/1.1 200 OK
Last-Modified: Mon, 30 Jun 2014 23:30:37 GMT
Expires: Mon, 07 Jul 2014 23:30:37 GMT
Content-Type: application/ocsp-response
content-transfer-encoding: binary
Content-Length: 1523
Cache-Control: max-age=485880, public, no-transform, must-revalidate
Date: Wed, 02 Jul 2014 08:34:42 GMT
Connection: keep-alive
0..........0..... .....0......0...0........U0S1.0...U....US1.0...U....
GeoTrust Inc.1,0*..U...#GeoTrust SSL CA - G2 OCSP Responder..201406302
33037Z0s0q0I0... ............-....<...qM........J.s9.[i.\.=.d....U.
..P.u.J....}wU.x......20140630233037Z....20140707233037Z0...*.H.......
.......RPZ..%..s.q{..]..x..1.R..........`..5.C.......@....G.[.... j2.&
gt;}...Pi..k.....5.V...........C..f..p.4./...Z.....5N.=O.x...V..!...j.
&...P......\.g-n..{....}..A.U?.|.n...;`.2..X=......G..G...kw ....n...n
...{.......dY......_].qa.c....y.S9%......Si.".....e........0...0...0..
........ld.{y..C....hB.N0...*.H........0D1.0...U....US1.0...U....GeoTr
ust Inc.1.0...U....GeoTrust SSL CA - G20...140502000000Z..140731235959
Z0S1.0...U....US1.0...U....GeoTrust Inc.1,0*..U...#GeoTrust SSL CA - G
2 OCSP Responder0.."0...*.H.............0.........-...o.,...3..2....r.
.......N...~/U../I.2.w8.B../s.l{W.X..w...L..Y...F..sAt.LN.P...e .\..QQ
p..2.l..bC ......=i...iu..S.a..m=.S..B...WR.......&..P....LhJ.D.<.m
\*...j.`"....|9.J. .H.....:....b#s...`(.[...9..........M/@......1T....
.(t........D.4.3.[..../m.9..........0..0...U.......0.0...U.%..0... ...
....0...U...........0... .....0......0!..U....0...0.1.0...U....TGV-B-8
210...U.#..0....J.s9.[i.\.=.d....U.0...U......'.It.P......E`... ..0...
*.H.............t.hv..bN..;......yt:H.)d......}....i....r..y.ZG..m...x
.c.........Z.*.p.......M....D.P.},tA2y.P.{_.7Vu. ,.`....D..M7.....>
.7...n.Q609. ~.A5.~a..aaO....y.....y>.Q[....._......!.y..7...`S5...
...I-.....#m.....HQ..g.|W{....y.|.w\rC..$...?&..p.^..>8'I.O...M

<<< skipped >>>

POST /e?i=27 HTTP/1.1
Host: bench.utorrent.com
User-Agent: BTWebClient/3410(31105)
Accept-Encoding: gzip
Connection: Close
Content-Length: 127

{"h":"AJ_YwRVi29RbUrz-","cl":"uTorrent","v":109279617,"l":"en","w":"6.1","cts":1404290018,"eventName":"embeddedIE","version":9}
HTTP/1.1 200 OK
Content-Type: text/html
Date: Wed, 02 Jul 2014 08:33:47 GMT
Server: nginx/1.4.7
X-Powered-By: PHP/5.4.30
Content-Length: 21
Connection: Close
{"response_code":200}..


GET /download/langpacks/dl.php?build=31105&ref=client&client=utorrent&sys_l=en&sel_l=0&tk=beta HTTP/1.1
Host: VVV.utorrent.com
User-Agent: BTWebClient/3410(31105)
Accept-Encoding: gzip
Connection: Close


HTTP/1.1 301 Moved Permanently
Server: nginx/1.4.7
Date: Wed, 02 Jul 2014 08:33:41 GMT
Content-Type: text/html
Location: hXXp://VVV.utorrent.com/scripts/dl.php?build=31105&ref=client&client=utorrent&sys_l=en&sel_l=0&tk=beta
Content-Length: 184
Connection: close
<html>..<head><title>301 Moved Permanently</title
></head>..<body bgcolor="white">..<center><h1&
gt;301 Moved Permanently</h1></center>..<hr><cent
er>nginx/1.4.7</center>..</body>..</html>....


GET /i.gif?e=eyJhdiI6MzY0OTMsImF0Ijo5LCJjbSI6MTEyMjM3LCJjaCI6ODc4NSwiY3IiOjMzMDkxMSwiZGkiOiI0YWU2Y2RjYTQ5YTk0MGFjOTgzNzc0MjQxNTk4OGM2YSIsImRtIjozLCJmYyI6NDA4MTg1LCJmbCI6MjA2NDQxLCJpcCI6IjE5My4xMzguMjQ0LjIzMSIsImt3IjoiY2xpZW50ZGF0YT11dG9ycmVudHwzLjQuMS4zMTEwNXw4MixpZXZlcnNpb249MTAsZmxhc2g9bm9uZSIsIm53Ijo1NjgyLCJwYyI6MC4wOCwicHIiOjIzNzU1LCJydCI6Mywic3QiOjMzMDQ5LCJ0ciI6dHJ1ZSwidWsiOiJ1ZTEtMTlkYThkMmRkMzM2NGU0OWFlZDdkYWNiZDkzMWQ0MjAiLCJ0cyI6MTQwNDI4OTg3NzAxNiwiZnEiOjF9&s=Iy3hRp0kcSxHtMFS49XUgy6V8ZE HTTP/1.1
Host: engine.ap.bittorrent.com
User-Agent: Mozilla/5.0 (compatible; MSIE 10.0 Windows NT 6.1; WOW64; Trident/6.0; EIE10; ENUSMSN)(31105)
Accept-Encoding: gzip
Accept-Language: en-US
Connection: Close


HTTP/1.1 200 OK
Access-Control-Allow-Headers: accept, origin, content-type, content-length
Access-Control-Allow-Methods: GET,PUT,POST,DELETE,OPTIONS
Access-Control-Allow-Origin: *
Content-Type: image/gif
Date: Wed, 02 Jul 2014 08:35:38 GMT
Server: nginx/1.1.19
Set-Cookie: azk=ue1-19da8d2dd3364e49aed7dacbd931d420; Path=/; Expires=Thu, 02 Jul 2015 08:35:38 GMT
Set-Cookie: azk-events=W3siYXYiOjM2NDkzLCJhdCI6OSwiY20iOjExMjIzNywiY2giOjg3ODUsImNyIjozMzA5MTEsImRpIjoiNGFlNmNkY2E0OWE5NDBhYzk4Mzc3NDI0MTU5ODhjNmEiLCJkbSI6MywiZmMiOjQwODE4NSwiZmwiOjIwNjQ0MSwiaXAiOiIxOTMuMTM4LjI0NC4yMzEiLCJrdyI6ImNsaWVudGRhdGE9dXRvcnJlbnR8My40LjEuMzExMDV8ODIsaWV2ZXJzaW9uPTEwLGZsYXNoPW5vbmUiLCJudyI6NTY4MiwicGMiOjAuMDgsInByIjoyMzc1NSwicnQiOjMsInN0IjozMzA0OSwidHIiOnRydWUsInVrIjoidWUxLTE5ZGE4ZDJkZDMzNjRlNDlhZWQ3ZGFjYmQ5MzFkNDIwIiwidHMiOjE0MDQyODk4NzcwMTYsImNpIjoiNWMyMTBjM2VkZjBmNDAzNmEyMDk1ZThiNWRhNTY0Y2IiLCJjdiI6MX1d; Path=/; Expires=Fri, 01 Aug 2014 08:35:38 GMT
x-powered-by: adzerk bifrost/
x-served-by: engine-us-east-1b-09
Content-Length: 43
Connection: Close
GIF89a.............!.......,...........D..;..


GET /updatestats.php?cl=uTorrent&v=109279617&h=AJ_YwRVi29RbUrz-&k=&ip=8&dns=1092&con=78&dl=78&error=HTTP Error 404&dlurl=http://ll.download3.utorrent.com/offers/mediaCaster_default_grey.bmp&svp=4&pid=1224&sz=168&bin=<NULL>bmp&p1=192.168.139.2&m1=0&p2=192.168.50.10&m2=1&p3=193.138.244.233&m3=125&p4=10.235.0.11&m4=1&p5=193.138.244.106&m5=1&p6=46.164.136.181&m6=35&p7=80.91.160.129&m7=23&p9=195.22.214.108&m9=73&p10=89.221.34.123&m10=76&p11=89.221.34.181&m11=82&p12=87.248.216.137&m12=71&p13=87.248.217.254&m13=74 HTTP/1.1
Host: update.utorrent.com
User-Agent: BTWebClient/3410(31105)
Accept-Encoding: gzip
Connection: Close


HTTP/1.1 200 OK
Server: nginx/1.4.7
Date: Wed, 02 Jul 2014 08:31:55 GMT
Content-Type: text/html
Transfer-Encoding: chunked
Connection: close
X-Powered-By: PHP/5.4.30
Expires: Thu, 21 Jul 1980 00:00:00 GMT
Cache-Control: no-store, no-cache, must-revalidate, private
Pragma: no-cache
0..


GET /impression.do/?user_id=FE2D69B3-3914-4632-9A57-DB6072FEFE3C&event=setup_run&spsource=68E633381BD14a69BD08A05C22B72D6A&traffic_source=68E633381BD14a69BD08A05C22B72D6A&browser=IE&implementation_id=dll HTTP/1.1
Accept: */*
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; WOW64; Trident/6.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; .NET4.0C)
Host: imp.install-zone.com
Connection: Keep-Alive


HTTP/1.1 200 OK
Cache-Control: no-cache
Pragma: no-cache
Content-Type: image/png
Expires: -1
Server: Microsoft-IIS/7.5
X-AspNet-Version: 2.0.50727
X-Powered-By: ASP.NET
Date: Wed, 02 Jul 2014 08:31:55 GMT
Connection: close
Content-Length: 109
.PNG........IHDR..............wS.....tEXtSoftware.Adobe ImageReadyq.e&
lt;....IDATx.b...?@....... .t.....IEND.B`...


GET /impression.do/?user_id=FE2D69B3-3914-4632-9A57-DB6072FEFE3C&event=mypcbackup_ww_install_failed&spsource=68E633381BD14a69BD08A05C22B72D6A&traffic_source=68E633381BD14a69BD08A05C22B72D6A&browser=IE&implementation_id=dll HTTP/1.1
Accept: */*
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; WOW64; Trident/6.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; .NET4.0C)
Host: imp.install-zone.com
Connection: Keep-Alive


HTTP/1.1 200 OK
Cache-Control: no-cache
Pragma: no-cache
Content-Type: image/png
Expires: -1
Server: Microsoft-IIS/7.5
X-AspNet-Version: 2.0.50727
X-Powered-By: ASP.NET
Date: Wed, 02 Jul 2014 08:34:04 GMT
Connection: close
Content-Length: 109
.PNG........IHDR..............wS.....tEXtSoftware.Adobe ImageReadyq.e&
lt;....IDATx.b...?@....... .t.....IEND.B`...


GET /installstats.php?cl=uTorrent&v=109279617&h=AJ_YwRVi29RbUrz-&w=1DB10106&bu=0&pr=0&cmp=82&ocmp=82&showwarning&pid=1224&cau=0&view=win32 HTTP/1.1
Accept-Encoding: gzip
User-Agent: uTorrent(31105)/3.4.1
Host: update.utorrent.com
Cache-Control: no-cache


HTTP/1.1 200 OK
Server: nginx/1.4.7
Date: Wed, 02 Jul 2014 08:28:51 GMT
Content-Type: text/html
Transfer-Encoding: chunked
Connection: close
X-Powered-By: PHP/5.4.30
0..


GET /a04d5a5c/D0wnloads-{date}/MyPCBackup_Setup.exe HTTP/1.0
Host: track.mypcbackup.com
User-Agent: NSISDL/1.2 (Mozilla)
Accept: */*


HTTP/1.1 301 Moved Permanently
Date: Wed, 02 Jul 2014 08:33:38 GMT
Server: Apache
Set-Cookie: SESSID=77ouhteu51t0i7f9o69qq4euv6; path=/; domain=.mypcbackup.com
Expires: Thu, 19 Nov 1981 08:52:00 GMT
Cache-Control: no-store, no-cache, must-revalidate, post-check=0, pre-check=0
Pragma: no-cache
Set-Cookie: LC_CURRENCY=US; expires=Sat, 12-Jul-2014 08:33:38 GMT; path=/; domain=.mypcbackup.com
Set-Cookie: ?uva6aT*=US; expires=Sat, 12-Jul-2014 08:33:38 GMT; path=/; domain=.mypcbackup.com
Set-Cookie: LC_CURRENCY=US; expires=Sat, 12-Jul-2014 08:33:38 GMT; path=/; domain=.mypcbackup.com
Set-Cookie: ?uva6aT*=US; expires=Sat, 12-Jul-2014 08:33:38 GMT; path=/; domain=.mypcbackup.com
Set-Cookie: 748a7624422584634822bd3a2bf604ae=56b630d3d23c5c475dfdb1ccab59f533; expires=Thu, 30-Oct-2014 08:33:38 GMT; path=/; domain=.mypcbackup.com
Set-Cookie: intc=1; expires=Thu, 03-Jul-2014 08:33:38 GMT; path=/; domain=.mypcbackup.com
P3P: CP="We do not have a P3P policy"
location: hXXp://cdn.mypcbackup.com/MyPCBackup_Setup.exe
Set-Cookie: aff_id=62861; expires=Sun, 03-Aug-2014 05:59:59 GMT; path=/; domain=mypcbackup.com
Set-Cookie: hop_name=OPTIMUMROW; expires=Sun, 03-Aug-2014 05:59:59 GMT; path=/; domain=mypcbackup.com
Set-Cookie: hop_id=108459; expires=Sun, 03-Aug-2014 05:59:59 GMT; path=/; domain=mypcbackup.com
Set-Cookie: hash=e2ec4171fc27c15a082d2a51a08aa914; expires=Sun, 03-Aug-2014 05:59:59 GMT; path=/; domain=mypcbackup.com
Set-Cookie: tid=D0wnloads-{date}; expires=Sun, 03-Aug-2014 05:59:59 GMT; path=/; domain=mypcbackup.com
Set-Cookie: a04d5a5cunique=true; expires=Tue, 30-Sep-2014 08:33:38 GMT; path=/; domain=mypcbackup.com
Content-Length: 0
Connection: close
Content-Type: text/html; charset=UTF-8
Set-Cookie: MPBWWW=3891563201.1.778673792.501662464; path=/

<<< skipped >>>

GET / HTTP/1.1
Host: bundles.bittorrent.com
User-Agent: BTWebClient/3410(31105)
Accept-Encoding: gzip
Connection: Close


HTTP/1.1 200 OK
Content-Type: text/html; charset=utf-8
Transfer-Encoding: chunked
Connection: close
Cache-Control: public, max-age=300
Content-Encoding: gzip
Date: Wed, 02 Jul 2014 08:29:48 GMT
ETag: W/"4b3c-3136939183"
Set-Cookie: connect.sid=eyJwYXNzcG9ydCI6e319--5f19a0dc71d1127c1494f9a84f91312152a2ef2e; Path=/; Expires=Wed, 02 Jul 2014 12:29:48 GMT; HttpOnly
Vary: Accept-Encoding
Age: 231
X-Cache: Hit from cloudfront
Via: 1.1 0e6067b46ed4b3e688f898d03e5c1c67.cloudfront.net (CloudFront)
X-Amz-Cf-Id: OhRJjl13xQlnrtghWXASDFnHdHnKnhwEVwWBjV5k4LzM9FU2QRUDhw==
1c3b.............<.S...?.....UJ...."l."...Z...R....d....u]....g&.^.
9.....uN...t...s&....].....i0.]... ....0..zM8{.....8*.3..5.q..}.H.DU..
,.y.~...3.B.p0$.i[..t.=.._.........|....;..l.i?".b..I.......(.tz}.....
.H.>>..g/.!xY.M... .]...^...? .z...}Vf.....(S......G..i.#Ix....n
p..(.Z1.2..#.aN.]0....@........i.,.....C.....t../..xFD.p..80.^..9!.1..
9..5...]...</\/H.z..`....m.4m...v..r...}...,t.?7..>.h[.>4...%
.{.!.....V.6h....O.u%...b;...{....'...~..*.y...6...g./]PU..U`.eqLtX...
.tn.......U....@a.......$q|rO^`.8>/.O.b..F.....~..a0.;;..n...9.K..r
.fs...x......t...?.J....tS......6.5...K.$|..*.e..'.l:...P..K......)...
$P:.$...h......6K....y.1.n. ..j.*......".F.7.P.<.YK.. ..Dv...-x)h.V
....G......... .....^W.r.=....*2K....#.$.J...!y,{$XzH..tKDZ.....V|.I..
.C.Q...j.ZBr!.... [..b..e.....3..e..X....G).e.zUK..4...... ...!jOs...
.k.......ee_s..#...*.%0._,.K.>\>*.Z/).(.\....).H..$........,...d
.b.{].68G......b....^]...dn.%g.._W.r....2.[.l....YZ^...Z.Rh].<.....
..c...4..4.".?...c..K..6.....to......T:P.U.C....9.}..-x{.CH..=8.`*8...
......^..S..e:.w..A...FX..v...........)\....I...-8. \.}.R.TwLp.....:.`
.......m.u(w...*....LX.... a....4%y}"..<.....j..).....s.......E...)
..~..O.....a*H....r.- ....y..!*.........|D.K.q....6D...p..,<7pq_..(
...@AB1d.....kv..(D..UH.>p.<.T..%......<.I................ 1.
.py.E..$A.....I..H...a....A............/..B.T>)..iI-.LcJ.......e..%
...W.j&.q...'p...3.........G......(.i..hS......#.VQ.ST.Pi.28^........n
r.B.j.........L...].A.6fG.g.f-.....y....14.:..-!..?C...O..:....=}.

<<< skipped >>>

GET /pki/crl/products/microsoftrootcert.crl HTTP/1.1
Cache-Control: max-age = 900
Connection: Keep-Alive
Accept: */*
If-Modified-Since: Sat, 24 May 2014 05:04:51 GMT
If-None-Match: "96bfbfb1d77cf1:0"
User-Agent: Microsoft-CryptoAPI/6.1
Host: crl.microsoft.com


HTTP/1.1 304 Not Modified
Content-Type: application/pkix-crl
Last-Modified: Sat, 24 May 2014 05:04:51 GMT
ETag: "96bfbfb1d77cf1:0"
Cache-Control: max-age=900
Date: Wed, 02 Jul 2014 08:34:14 GMT
Connection: keep-alive
....



GET /pki/crl/products/WinPCA.crl HTTP/1.1

Cache-Control: max-age = 900
Connection: Keep-Alive
Accept: */*
If-Modified-Since: Wed, 07 May 2014 05:04:02 GMT
If-None-Match: "a413fc3b169cf1:0"
User-Agent: Microsoft-CryptoAPI/6.1
Host: crl.microsoft.com


HTTP/1.1 304 Not Modified
Content-Type: application/pkix-crl
Last-Modified: Wed, 07 May 2014 05:04:02 GMT
ETag: "a413fc3b169cf1:0"
Cache-Control: max-age=900
Date: Wed, 02 Jul 2014 08:34:14 GMT
Connection: keep-alive
HTTP/1.1 304 Not Modified..Content-Type: application/pkix-crl..Last-Mo
dified: Wed, 07 May 2014 05:04:02 GMT..ETag: "a413fc3b169cf1:0"..Cache
-Control: max-age=900..Date: Wed, 02 Jul 2014 08:34:14 GMT..Connection
: keep-alive..


GET /installstats.php?cl=uTorrent&v=109279617&h=AJ_YwRVi29RbUrz-&w=1DB10106&bu=0&pr=0&cmp=82&ocmp=82&mismexecute&pid=1224&cau=0&download=0&execute=0&error=mism execute succeeded&mismreturn=0&mismresult=provider:8,search:1,homepage:1&view=win32 HTTP/1.1
Accept-Encoding: gzip
User-Agent: uTorrent(31105)/3.4.1
Host: update.utorrent.com
Cache-Control: no-cache


HTTP/1.1 200 OK
Server: nginx/1.4.7
Date: Wed, 02 Jul 2014 08:32:05 GMT
Content-Type: text/html
Transfer-Encoding: chunked
Connection: close
X-Powered-By: PHP/5.4.30
0..


GET /msdownload/update/v3/static/trustedr/en/disallowedcertstl.cab?2911a00539d0dcf2 HTTP/1.1
Connection: Keep-Alive
Accept: */*
If-Modified-Since: Thu, 05 Dec 2013 22:47:50 GMT
If-None-Match: "0af536cf2ce1:0"
User-Agent: Microsoft-CryptoAPI/6.1
Host: ctldl.windowsupdate.com


HTTP/1.1 304 Not Modified
Content-Type: application/octet-stream
Last-Modified: Thu, 05 Dec 2013 22:47:50 GMT
ETag: "0af536cf2ce1:0"
Cache-Control: max-age=86400
Date: Wed, 02 Jul 2014 08:31:52 GMT
Connection: keep-alive
....



GET /msdownload/update/v3/static/trustedr/en/authrootstl.cab?ad5bd4c8a0fca6e2 HTTP/1.1

Connection: Keep-Alive
Accept: */*
If-Modified-Since: Wed, 12 Mar 2014 20:20:10 GMT
If-None-Match: "0b96c77303ecf1:0"
User-Agent: Microsoft-CryptoAPI/6.1
Host: ctldl.windowsupdate.com


HTTP/1.1 304 Not Modified
Content-Type: application/octet-stream
Last-Modified: Wed, 12 Mar 2014 20:20:10 GMT
ETag: "0b96c77303ecf1:0"
Date: Wed, 02 Jul 2014 08:31:52 GMT
Connection: keep-alive
HTTP/1.1 304 Not Modified..Content-Type: application/octet-stream..Las
t-Modified: Wed, 12 Mar 2014 20:20:10 GMT..ETag: "0b96c77303ecf1:0"..D
ate: Wed, 02 Jul 2014 08:31:52 GMT..Connection: keep-alive..


GET /utorrent-onboarding/welcome-upsell.btapp?h=AJ_YwRVi29RbUrz-&v=109279617&ol=en&ul=&tk=beta&c=uTorrent HTTP/1.1
Host: apps.bittorrent.com
User-Agent: BTWebClient/3410(31105)
Accept-Encoding: gzip
Connection: Close


HTTP/1.1 200 OK
x-amz-id-2: lz 8jcYhTMFs07BwTmJ75aU1j28rdqAK f5XesTuPpWwTcY0Y2iU3R9jRveFkw15
x-amz-request-id: E5CA7888FA86DF33
Accept-Ranges: bytes
Content-Type: binary/octet-stream
Server: AmazonS3
Age: 128809
Date: Wed, 02 Jul 2014 08:33:39 GMT
Last-Modified: Tue, 08 Oct 2013 00:54:05 GMT
Content-Length: 28315
Connection: close
PK.........}?@................btappUT...4}(O..(Oux.............5.1.. .
.{^..b.N.Q.K.)...b#a8.G....S.4....`...Af..4........Q...S....G>..|.I
...1...]..j..............}q.b....u. ..<oE..N..w..D..A....GA..U.w.5W
=..`...PK.........L|>...9............empty_movie.gifUT......M..(Oux
.............GIF89a.............!.......,.............................
H...........L................L*......J......j............N............
.........(8HXhx..........)9IYiy..........*:JZjz.......... ;K[k{.......
...,<L\l|..........-=M]m}...........>N^n~........../?O_o........
..0......<.0....1...;PK.........Y.>.Pi-....T.......index.htmlUT.
.....M..(Oux..............W.n.6....8U.:.f)....IC.d..vk..C...-.Yt(R%)_0
..k...$;.l.r.!.......|.F...~.....k(m%R...-@09I..AJ.dyz....Z.Y..A...-..
....V`....r.7.i.y....Epy..E....hJD.@..H..q.f..`.5&........3..i${..L. ,
X#..~k...v[...XK...,.Jkk.:...-..R....&.T.i..c.M?7...Ix...6aE.NM..Q p..
.p...Q.......Z.5J..7..P..b:'.".........n...}..r....t.....q_...r%.dU...
Wxx..n....8trT....FH..42..K...O..;_...r.M.^.t.7._...p...B.%..o........
..D.0g...nL.`..e.U .....5.`.....i....?...)..Q.:n...E-....b......Be.y.R
j..C..<.R..lB...KC...6......1..;.=..KQ)c.....!...RcJ5.yWH......i.J.
..jq.c..8Y..v...(/..N...R.......:.L..z.s.T48.*..Q........7.....I.c.y..
o.`.....?........pv.9...S.|.'[.....>..F..U.......I@.a)....u}..7T.R.
...5..o...o..ZUp.j.zQ..T^...n........D.fGa...J....B.$.D....u..\.......
$.......././N...fJd."n..@...|q.....o....F....f.YE.G.|....N..1...N....F
h/?..l.T.=L..W.vtl8.i=.(.r[&...W4..OJ..g..a.V[.....d..36sC....l/.&

<<< skipped >>>

GET /offers/streaming/bower_components/components-bootstrap/css/bootstrap.min.css HTTP/1.1
Accept: */*
Referer: hXXp://utclient.utorrent.com/offers/streaming/index.html?port=10627&pair=AAF51F5F564AD28FFCFB5020BDB00283A1ED40A1&frameaddr=68242f8&plus=0&cid=AJ_YwRVi29RbUrz-&code=4
Accept-Language: en-US
User-Agent: Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1; WOW64; Trident/6.0)
Accept-Encoding: gzip, deflate
Host: utclient.utorrent.com
Connection: Keep-Alive


HTTP/1.1 200 OK
x-amz-id-2: /gWiBRNnlMWpy60Bt6OE5OXp5WkjapP6mAuDXP/w T qg/MCoEOq5Isxc MlP620
x-amz-request-id: C1C6428B5935D9A8
Date: Wed, 02 Jul 2014 08:33:44 GMT
x-amz-meta-s3cmd-attrs: uid:107/gname:nogroup/uname:jenkins/gid:65534/mode:33261/mtime:1395771730/atime:1395771730/md5:f21e72b53f6061350297ebe8ead662eb/ctime:1395771730
Content-Encoding: UTF-8
Last-Modified: Tue, 25 Mar 2014 18:22:13 GMT
ETag: "f21e72b53f6061350297ebe8ead662eb"
Content-Type: text/css
Content-Length: 53669
Server: AmazonS3
/*! normalize.css v3.0.0 | MIT License | git.io/normalize */html{font-
family:sans-serif;-ms-text-size-adjust:100%;-webkit-text-size-adjust:1
00%}body{margin:0}article,aside,details,figcaption,figure,footer,heade
r,hgroup,main,nav,section,summary{display:block}audio,canvas,progress,
video{display:inline-block;vertical-align:baseline}audio:not([controls
]){display:none;height:0}[hidden],template{display:none}a{background:t
ransparent}a:active,a:hover{outline:0}abbr[title]{border-bottom:1px do
tted}b,strong{font-weight:bold}dfn{font-style:italic}h1{font-size:2em;
margin:.67em 0}mark{background:#ff0;color:#000}small{font-size:80%}sub
,sup{font-size:75%;line-height:0;position:relative;vertical-align:base
line}sup{top:-0.5em}sub{bottom:-0.25em}img{border:0}svg:not(:root){ove
rflow:hidden}figure{margin:1em 40px}hr{-moz-box-sizing:content-box;box
-sizing:content-box;height:0}pre{overflow:auto}code,kbd,pre,samp{font-
family:monospace,monospace;font-size:1em}button,input,optgroup,select,
textarea{color:inherit;font:inherit;margin:0}button{overflow:visible}b
utton,select{text-transform:none}button,html input[type="button"],inpu
t[type="reset"],input[type="submit"]{-webkit-appearance:button;cursor:
pointer}button[disabled],html input[disabled]{cursor:default}button::-
moz-focus-inner,input::-moz-focus-inner{border:0;padding:0}input{line-
height:normal}input[type="checkbox"],input[type="radio"]{box-sizing:bo
rder-box;padding:0}input[type="number"]::-webkit-inner-spin-button,inp
ut[type="number"]::-webkit-outer-spin-button{height:auto}input[typ

<<< skipped >>>

POST /e?i=20 HTTP/1.1
Host: bench.utorrent.com
User-Agent: BTWebClient/3410(31105)
Accept-Encoding: gzip
Connection: Close
Content-Length: 123

{"h":"AJ_YwRVi29RbUrz-","cl":"uTorrent","v":109279617,"l":"en","w":"6.1","cts":1404290027,"eventName":"client404offerShow"}
HTTP/1.1 200 OK
Content-Type: text/html
Date: Wed, 02 Jul 2014 08:33:53 GMT
Server: nginx/1.4.7
X-Powered-By: PHP/5.4.30
Content-Length: 21
Connection: Close
{"response_code":200}..


GET /e?callback=jQuery20309916557603343579_1404290020834&i=ContentBundles&e=eyJzZXF1ZW5jZUlEIjoyLCJ1bmlxdWVJRCI6IjVhY2ZhZWU3LWQ3MzMtNDBmZS05MzdlLWY5OTliNTg3NDZiYiIsInNzYiI6MCwiZXZlbnROYW1lIjoiQ29udGVudEJ1bmRsZXMiLCJjYXRlZ29yeSI6IiIsImFjdGlvbiI6InBhZ2V2aWV3IiwibGFiZWwiOiIvYnVuZGxlcy83OWI1ZjkyN2M2OGEwYmM3ZjY0OGUwMTY0MDQ3MDVhYjRmODY3NzI0MDNiZmJkOWMwODkxOTRmYmViZTMwMjAzIn0=&_=1404290020835 HTTP/1.1
Accept: */*
Referer: hXXp://bundles.bittorrent.com/bundles/79b5f927c68a0bc7f648e016404705ab4f86772403bfbd9c089194fbebe30203?starttime=1393282818000&port=10627&pair=ADFC36D802A98BEB8DDDFD9BE07E8897AB050C2B&frameaddr=38a30e0&download=true
Accept-Language: en-US
User-Agent: Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1; WOW64; Trident/6.0)
Accept-Encoding: gzip, deflate
Host: bench.utorrent.com
Connection: Keep-Alive


HTTP/1.1 200 OK
Content-Type: text/html
Date: Wed, 02 Jul 2014 08:33:53 GMT
Server: nginx/1.4.7
X-Powered-By: PHP/5.4.30
Content-Length: 63
Connection: keep-alive
jQuery20309916557603343579_1404290020834({"response_code":200})
....



GET /e?callback=jQuery20309916557603343579_1404290020836&i=ContentBundles&e=eyJzZXF1ZW5jZUlEIjo0LCJ1bmlxdWVJRCI6IjVhY2ZhZWU3LWQ3MzMtNDBmZS05MzdlLWY5OTliNTg3NDZiYiIsInNzYiI6MCwiZXZlbnROYW1lIjoiQ29udGVudEJ1bmRsZXMiLCJhY3Rpb24iOiJJbkNsaWVudF9fSW5zdGFsbFBhdGhfQnRhcHBfRG93bmxvYWRfU3VjY2VzcyIsImxhYmVsIjoiU29tZXdoZXJlIEVsc2UtTi00ZTc1ODEzZGZiN2NhNDhhYjMyOWFmNjhmZWMyYmYyMDBlYWI1NTA0IiwiY2F0ZWdvcnkiOiI3OWI1ZjkyN2M2OGEwYmM3ZjY0OGUwMTY0MDQ3MDVhYjRmODY3NzI0MDNiZmJkOWMwODkxOTRmYmViZTMwMjAzIiwidmFsdWUiOjB9&_=1404290020848 HTTP/1.1

Accept: */*
Referer: hXXp://bundles.bittorrent.com/bundles/79b5f927c68a0bc7f648e016404705ab4f86772403bfbd9c089194fbebe30203?starttime=1393282818000&port=10627&pair=ADFC36D802A98BEB8DDDFD9BE07E8897AB050C2B&frameaddr=38a30e0&download=true
Accept-Language: en-US
User-Agent: Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1; WOW64; Trident/6.0)
Accept-Encoding: gzip, deflate
Host: bench.utorrent.com
Connection: Keep-Alive


HTTP/1.1 200 OK
Content-Type: text/html
Date: Wed, 02 Jul 2014 08:33:53 GMT
Server: nginx/1.4.7
X-Powered-By: PHP/5.4.30
Content-Length: 63
Connection: keep-alive
jQuery20309916557603343579_1404290020836({"response_code":200})
....



GET /e?callback=jQuery20309916557603343579_1404290020852&i=ContentBundles&e=eyJzZXF1ZW5jZUlEIjo2LCJ1bmlxdWVJRCI6IjVhY2ZhZWU3LWQ3MzMtNDBmZS05MzdlLWY5OTliNTg3NDZiYiIsInNzYiI6MCwiZXZlbnROYW1lIjoiQ29udGVudEJ1bmRsZXMiLCJhY3Rpb24iOiJJbkNsaWVudF9fSW5zdGFsbFBhdGhfUGFnZVZpZXctU3VjY2VlZCIsImxhYmVsIjoiRW1haWxHYXRlUGFnZSIsImNhdGVnb3J5IjoiNzliNWY5MjdjNjhhMGJjN2Y2NDhlMDE2NDA0NzA1YWI0Zjg2NzcyNDAzYmZiZDljMDg5MTk0ZmJlYmUzMDIwMyIsInZhbHVlIjowfQ==&_=1404290020853 HTTP/1.1

Accept: */*
Referer: hXXp://bundles.bittorrent.com/bundles/79b5f927c68a0bc7f648e016404705ab4f86772403bfbd9c089194fbebe30203?starttime=1393282818000&port=10627&pair=ADFC36D802A98BEB8DDDFD9BE07E8897AB050C2B&frameaddr=38a30e0&download=true
Accept-Language: en-US
User-Agent: Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1; WOW64; Trident/6.0)
Accept-Encoding: gzip, deflate
Host: bench.utorrent.com
Connection: Keep-Alive


HTTP/1.1 200 OK
Content-Type: text/html
Date: Wed, 02 Jul 2014 08:33:51 GMT
Server: nginx/1.4.7
X-Powered-By: PHP/5.4.30
Content-Length: 63
Connection: keep-alive
jQuery20309916557603343579_1404290020852({"response_code":200})HTTP/1.
1 200 OK..Content-Type: text/html..Date: Wed, 02 Jul 2014 08:33:51 GMT
..Server: nginx/1.4.7..X-Powered-By: PHP/5.4.30..Content-Length: 63..C
onnection: keep-alive..jQuery20309916557603343579_1404290020852({"resp
onse_code":200})..


POST /e?i=27 HTTP/1.1
Host: bench.utorrent.com
User-Agent: BTWebClient/3410(31105)
Accept-Encoding: gzip
Connection: Close
Content-Length: 127

{"h":"AJ_YwRVi29RbUrz-","cl":"uTorrent","v":109279617,"l":"en","w":"6.1","cts":1404290018,"eventName":"embeddedIE","version":9}
HTTP/1.1 200 OK
Content-Type: text/html
Date: Wed, 02 Jul 2014 08:33:47 GMT
Server: nginx/1.4.7
X-Powered-By: PHP/5.4.30
Content-Length: 21
Connection: Close
{"response_code":200}..


POST /e?i=D2544ACE4303E0E45B2240BD78E93A67FFE4B5B2 HTTP/1.1
Host: bench.utorrent.com
User-Agent: Hydra HttpRequest
Connection: close
Content-Length: 92

{"eventName":"hydra.compat.good","pid":"300","h":"D2544ACE4303E0E45B2240BD78E93A67FFE4B5B2"}
HTTP/1.1 200 OK
Content-Type: text/html
Date: Wed, 02 Jul 2014 08:33:44 GMT
Server: nginx/1.4.7
X-Powered-By: PHP/5.4.30
Content-Length: 21
Connection: Close
{"response_code":200}..


GET /ajax/libs/jquery/2.0.3/jquery.min.js HTTP/1.1
Accept: */*
Referer: hXXp://bundles.bittorrent.com/bundles/79b5f927c68a0bc7f648e016404705ab4f86772403bfbd9c089194fbebe30203?starttime=1393282818000&port=10627&pair=ADFC36D802A98BEB8DDDFD9BE07E8897AB050C2B&frameaddr=38a30e0&download=true
Accept-Language: en-US
User-Agent: Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1; WOW64; Trident/6.0)
Accept-Encoding: gzip, deflate
Host: ajax.googleapis.com
Connection: Keep-Alive


HTTP/1.1 200 OK
Vary: Accept-Encoding
Content-Encoding: gzip
Content-Type: text/javascript; charset=UTF-8
Last-Modified: Tue, 09 Jul 2013 11:31:25 GMT
Date: Thu, 26 Jun 2014 12:21:16 GMT
Expires: Fri, 26 Jun 2015 12:21:16 GMT
Access-Control-Allow-Origin: *
Timing-Allow-Origin: *
X-Content-Type-Options: nosniff
Server: sffe
Content-Length: 29361
X-XSS-Protection: 1; mode=block
Cache-Control: public, max-age=31536000
Age: 504745
Alternate-Protocol: 80:quic
............{{.../...."........o...I..Ik.n.4I):.DB.b...P...g?....`..Nz
.y..4...`.k.m...q....l......p4|z.=...........>5...7."..<SG.d.!..
.......d....L..........'/..:.....E....l..........M6G]~....2..E.p..G..T
.U..$.<..T.%.e>...t....U.U..r{..2.g1..~..]>R..a...t.......e4.
....T.t....jA.%....*...^].U..V......{....W..."_'Eu.n...^..]..,.......Q
...../3.0..FU.N]D'...l.O......68_..f.|9..t..N.2..6:9.38.Ro..w..|..6=.=
.a68....f........q.<:Q...g... ...'.3........-^.......D}.........Ypr
../.aTv..M..k....L|....\....d..$_....H.*......z.,.*<..E.....;.T.]|I
.L.;*./...1f/...........U.V..eUl.U^.w.3....2......K...f4.i.'^...E.....
.....=#.._....?..}....@2.....Szgn....i.Y..-4.........I.z.v. ...~....U.
m5..L|...!.........._.w.9*..VQu.R.8.c.w.j:...M.*)......:...../_....N..
|...qO.a~K .\.$.T...(...a...........2N.W..$....\R....Q...Wf.......}.W.
.Q.UE.)~2vVd..S..W..._.....<..*..S...~K}....=.....F.(....*...\n.d.`
*.D..%.D...LuR..L.6....LC,....i..E..........&...`..O>/....~....g..)
.V8RU..Bg_.....x....c.Zg.........l....pt&.........4...p..*..oT..<r.
............H.......FU;......A...N.=a....5R.[.QV)....,..e.PL.:..;c../.
D....d\\.....L..:TA....N-...!.B...1..:.,.$...(.5.....,..v?.&...l6..3..
.r...>...e..p...D..P6.?...g..4!.6P......Z.yQQ?..U.....|.S..:.......
u......."..EdA..C..........&....l/.........e.g5.(io/..Q....I.....|..6.
H.l.~I.J@-GQL.......`.9...`....,."?qZ.g..A...e....qR.~JBA.........4.Fx
,[...`.......[..}y........[...!.......I.J.6..R...m..k.?$w.8[..'..7....
qu=,.x...m..2.'...s..</PYN..%....*.P....Q.... ..U./.mL.w...;.!4

<<< skipped >>>

POST /e?i=32 HTTP/1.1
Host: bench.utorrent.com
User-Agent: BTWebClient/3410(31105)
Accept-Encoding: gzip
Connection: Close
Content-Length: 154

{"h":"AJ_YwRVi29RbUrz-","cl":"uTorrent","v":109279617,"l":"en","w":"6.1","cts":1404290019,"eventName":"changed_settings","tags":[ 112692, 193967, 93089 ]}
HTTP/1.1 200 OK
Content-Type: text/html
Date: Wed, 02 Jul 2014 08:33:50 GMT
Server: nginx/1.4.7
X-Powered-By: PHP/5.4.30
Content-Length: 21
Connection: Close
{"response_code":200}..


GET /utorrent-onboarding/welcome-upsell.btapp HTTP/1.1
Host: apps.bittorrent.com
User-Agent: BTWebClient/3410(31105)
Accept-Encoding: gzip
Connection: Close


HTTP/1.1 200 OK
x-amz-id-2: HCpaeLg6Uh9Sm3sk0S53QKUErij9Jl2BjFcA7W08S2omUK1lk3TxpoRJFmDYmH X
x-amz-request-id: A7F6CC8B72CD7AE0
Accept-Ranges: bytes
Content-Type: binary/octet-stream
Server: AmazonS3
Age: 128805
Date: Wed, 02 Jul 2014 08:33:35 GMT
Last-Modified: Tue, 08 Oct 2013 00:54:05 GMT
Content-Length: 28315
Connection: close
PK.........}?@................btappUT...4}(O..(Oux.............5.1.. .
.{^..b.N.Q.K.)...b#a8.G....S.4....`...Af..4........Q...S....G>..|.I
...1...]..j..............}q.b....u. ..<oE..N..w..D..A....GA..U.w.5W
=..`...PK.........L|>...9............empty_movie.gifUT......M..(Oux
.............GIF89a.............!.......,.............................
H...........L................L*......J......j............N............
.........(8HXhx..........)9IYiy..........*:JZjz.......... ;K[k{.......
...,<L\l|..........-=M]m}...........>N^n~........../?O_o........
..0......<.0....1...;PK.........Y.>.Pi-....T.......index.htmlUT.
.....M..(Oux..............W.n.6....8U.:.f)....IC.d..vk..C...-.Yt(R%)_0
..k...$;.l.r.!.......|.F...~.....k(m%R...-@09I..AJ.dyz....Z.Y..A...-..
....V`....r.7.i.y....Epy..E....hJD.@..H..q.f..`.5&........3..i${..L. ,
X#..~k...v[...XK...,.Jkk.:...-..R....&.T.i..c.M?7...Ix...6aE.NM..Q p..
.p...Q.......Z.5J..7..P..b:'.".........n...}..r....t.....q_...r%.dU...
Wxx..n....8trT....FH..42..K...O..;_...r.M.^.t.7._...p...B.%..o........
..D.0g...nL.`..e.U .....5.`.....i....?...)..Q.:n...E-....b......Be.y.R
j..C..<.R..lB...KC...6......1..;.=..KQ)c.....!...RcJ5.yWH......i.J.
..jq.c..8Y..v...(/..N...R.......:.L..z.s.T48.*..Q........7.....I.c.y..
o.`.....?........pv.9...S.|.'[.....>..F..U.......I@.a)....u}..7T.R.
...5..o...o..ZUp.j.zQ..T^...n........D.fGa...J....B.$.D....u..\.......
$.......././N...fJd."n..@...|q.....o....F....f.YE.G.|....N..1...N....F
h/?..l.T.=L..W.vtl8.i=.(.r[&...W4..OJ..g..a.V[.....d..36sC....l/.&

<<< skipped >>>

GET /Advertisers/0b9bbc295ea846bdba8e23749d787bbd HTTP/1.1
Host: static.ap.bittorrent.com
User-Agent: BTWebClient/3410(31105)
Accept-Encoding: gzip
If-Modified-Since: Sun, 1 Jan 1982 00:00:00 GMT
Connection: Close


HTTP/1.1 200 OK
Accept-Ranges: bytes
Content-Type: application/octet-stream
Date: Wed, 02 Jul 2014 08:33:45 GMT
Etag: "d3229c79858146bd53396b0e5cd15282"
Expires: Mon, 01 Jul 2024 07:48:23 GMT
Last-Modified: Fri, 27 Jun 2014 23:17:29 GMT
Server: ECS (ams/4998)
x-amz-id-2: wDCMxB212VBuvyB/mZ1x3WMDAkGk1sXNyMfmsbA4zQzMcNHTclZ7w0b6y6kNwyVaXlznTbgLMWw=
x-amz-request-id: 206B7D547B7D0413
X-Cache: HIT
Content-Length: 7043
Connection: close
.PNG........IHDR......."......V.....JIDATx...wXSW...7...........PP....
s...Uq.VE..U....h.BU.UpU.-.......(..@..3$.|.\I.,...m....&'g....o..PD..
`..a..a......`..a..a.,..b..a..a..z{..a.....hd{.....u..C.0....T.....:..
.r...l...,.Vvt............b.....>:OC-*n.O.1....0...'...a.....6j....
...&P....NR1..Z.. .H...;.._1.k?8I.0.k-D.|%.%...{......a.j8I.0.k.f...N.
Y...T..0.k..I*B ..E".P..(...VTW..P(....6....@....0........L.Z6v..qj.a.
'!.."...Z^IEE....7Z.,CCc.......l..V[.....1...d...c....|/=.........pJu.
....k.~3.0..B6I..k_..... .....uuu.|AYi.......,..X,..{......,.....p;-c.
.......4{{v...Dcc...I^^...g9o..?z.[..........~.S.k.*.......v...oM.....
F.OI.W^^.."S......=.'.......4r.....r..q_....R.....x...n.............4.
...p.}-....m........[...>L..~.....#..m.H...VR?...c..g.b...d....^C..
..:]...`......5.5.;.={..(..X......s....4?..o?......x!...j...m>..Q..
.]l..)....n.:.h.F......xJkz............~..h...F.....6..555..qSV.....9q
.2.......]..7IUm.0.....;...3..<.\..R..T...5.So>......a.8........
.A.!.....nE...w..e....l7....4.1?..-..zc......c:....4....*^\{.../..[.Sv
.a.?.l.ZTTfnjz....:..].KyE._..Q.=.......E4.MKKK ........o.i3F99.d<~
1/l..'/.|.W.n...hh.?tx_GG..]..{.~`go../m..'&.defw...t..G'k*...qG.76...
}..O..y4.T....x..) ......`G...s..=.io,.k..;^I..O_.vd..1.ee..c.....?w3.
.F;{.......$...C.;.s..._w.,...6.....s....y.........6.S...k.'....z'.._M
.zD......h..~$....%.....&l.....S2;:q^.zK.PX,.#C... .L..J...)))..oPg.-[
..@c......:uv .##b.2...2-m.^.\..O622..c.....zUL)........tu.U49..&.....
r..yac....,............ K.JZQ(...pz.....ov"d....v.zBz ... ...}..sr

<<< skipped >>>

GET /installstats.php?cl=uTorrent&v=109279617&h=AJ_YwRVi29RbUrz-&w=1DB10106&bu=0&pr=0&cmp=82&ocmp=82&showtorrentoffer&pid=1224&cau=0&toroffer=1&torofferid=ZedsDead&view=win32 HTTP/1.1
Accept-Encoding: gzip
User-Agent: uTorrent(31105)/3.4.1
Host: update.utorrent.com
Cache-Control: no-cache


HTTP/1.1 200 OK
Server: nginx/1.4.7
Date: Wed, 02 Jul 2014 08:30:20 GMT
Content-Type: text/html
Transfer-Encoding: chunked
Connection: close
X-Powered-By: PHP/5.4.30
0..


GET /Advertisers/39e6df9d0f9745dfa63fdd2cf5602a1a.jpg HTTP/1.1
Host: static.ap.bittorrent.com
User-Agent: BTWebClient/3410(31105)
Accept-Encoding: gzip
If-Modified-Since: Sun, 1 Jan 1982 00:00:00 GMT
Connection: Close


HTTP/1.1 200 OK
Accept-Ranges: bytes
Content-Type: image/jpeg
Date: Wed, 02 Jul 2014 08:33:45 GMT
Etag: "315233d76003a0110b85bd2141635e04"
Expires: Sun, 30 Jun 2024 19:21:10 GMT
Last-Modified: Wed, 14 May 2014 05:04:51 GMT
Server: ECS (ams/4994)
x-amz-id-2: txUwetNagj4vfBK6A7SCT1uO9JZNeQut2BbAEOECuEDGYQYHpBthXshtMQiCxspO
x-amz-request-id: F0E0B61AAF5D05D5
X-Cache: HIT
Content-Length: 13429
Connection: close
......JFIF.....H.H.....C..............................................
......... ...C................
....................................................
R...........................!.1."A..#27Qaq.....BRU..$3TVb....45C....r.
....%ESu....................................D........................!
...1AQ...."35aq..........RSbc..#$2B.Cr.%T............?....*.)...RR/.&g
t;q..-.pK.p..."./.P....%.....Zw..|T.=5...LII$.u.*.........k..$".r.EVr.
n..#.1..p.[...6Qn ..z...S...4..V$U.~V.B./$F..L...SN...s./....q.}...YY.
.Kk..g4.........b........|\cj.9..[-._.....d2..@.._..A.6.....z....C ...
hu.p..si.-._.....d2..@.._..A.6.....z....C ...hu.p..si.-._.....d2..@.._
..A.6.....z....C ...hu.p..si.-._.....d2..@.._..A.6.....z....C ...hu.p.
.si.-._.....d2..@.._..A.6.....z....C ...hu.p..si.-._.....d2..@.._..A.6
.....z...G..O.,.&2.{4..U.AQ..D...*u.P6...1.....gI...L7....U.s.35..a...
.t.%.S&b..u.Q..17..".(....g....$..K/...MbI.... .C ...hu.qf...I~.n.....
/.....=....PA..l..|^.;.........|\5...F.n...../.....=....PA..l..|^.;...
......|\5...F.n.....s.k.EAW.qqHtf-..$u....3..q1.1.y.IL......R..\JE.."-
g.i.9S!..!................n.E...P...c...1!Y.%H.....Y, S.v..M..\G..edr6
..:.}.9..WFn6.Y..i.g1....@.e......Xx.&s.4.m%.i...8...^..Z..I...3.....Q
..g..%.Vo4.Y..h...".V.C..*I..6....[....Ed'..#S....)..........'I*...Y..
gd_H2.....I7g.....L..NR.....h.b.V"5Yl./.1...r..d...Q.Y.@RL%_..qW.H:;..
q..@pI5.=@>........tED.e ,..<5G..9.|.m...l...H...W^.y...t...*...
.#...\...Z.....Q 5R...kV.v..j.... 4.^L.W.)..E..],Sn.T..)6.Sb..J.n.

<<< skipped >>>

GET /utorrent-onboarding/player.btapp?h=AJ_YwRVi29RbUrz-&v=109279617&ol=en&ul=&tk=beta&c=uTorrent HTTP/1.1
Host: apps.bittorrent.com
User-Agent: BTWebClient/3410(31105)
Accept-Encoding: gzip
Connection: Close


HTTP/1.1 200 OK
x-amz-id-2: kLnNrkgfGAUNBhBwOUtnTaaAPMzN4DSdXHzrxkam8f6mjZV0Qi/hOlv0ELXd7rpV
x-amz-request-id: 04253D8D9662B60E
Accept-Ranges: bytes
Content-Type: binary/octet-stream
Server: AmazonS3
Age: 50211
Date: Wed, 02 Jul 2014 08:33:39 GMT
Last-Modified: Tue, 08 Oct 2013 00:53:35 GMT
Content-Length: 3097
Connection: close
PK.........c.@!m@.............btappUT....8.O7N.Oux.............-.1.. .
.{^.....L...u.M....G..>v.i..f4.6....V/pO...q...S_...d..(..%.5.B.yp.
.H..Rk..$rb&.......*.......d....959...=&.`@.....(F..)Jz.....1.}....9..
PK.........c.@v.7.`...........main.cssUT....8.O7N.Oux..............S.n
.0.}. ".....[7e_c..k............i....9....`u...p.'4U..lH)...,.|.....Jn
.H...B.bm..:j.R...l@CU...cC.....IK._........,.K.b...<.I.F.]....A...
F|#...../.%.$...q8.........-.9%....3......h9 -V...)....gB../.Z.V@.&[..
a...!6..\)..QX....f...Qh.......H.....].ZD6....H(-.pSt...sH o^..nu.hB..
.a.ou......Ng.cEw.`....=_.............H..6..Y.>..7.}!.w...W.W'.....
....PK.........c.@..yI....6.......icon.bmpUT....8.O7N.Oux.............
U....@...>*....<..E.....;....{..Q.....yU-....<...D..4w..@/...
.c..................wf??...S.&...q.......}7k..).v..Z..l.R.8..;..;9..'.
.{:=yO.....{.E.>.`"...9..|$..G...#.H...<..<...:x......|!_....
|Y..[K...D.TP.Nk..;~......O679'...;~......w....;~....s.w....;~....S.w.
...;~....3.w....;~.....8~......w.....6...s._..?............N.~..X.....
./.)./../../.....K.....k........./../../..L...........%$../../../..|.G
.x.....-...........?............?............?..r.........,.|.e..?....
.....s...$xY...O..6.V.S....n....V/...k...x....2.....4.P....C..9.ka_.lC
3Ms..S.3.|..2....2......|..C.oS.y.iZ.......i..[.A.T_?.u......p.......F
=..i...u.G.......7..Y..M../PK.........u.@.W.@....m.......index.htmlUT.
...M.O.N.Oux..............U.r.0.}._..a...;i.\.0.r..tH..G...je.#.I...r.
.0I.O.v..v.J..........R...Y.. .ZF.....I.........Xt. ......'..n1...

<<< skipped >>>

GET /installstats.php?cl=uTorrent&v=109279617&h=AJ_YwRVi29RbUrz-&w=1DB10106&bu=0&pr=0&cmp=82&ocmp=82&wizardcomplete&pid=1224&cau=0&view=win32 HTTP/1.1
Accept-Encoding: gzip
User-Agent: uTorrent(31105)/3.4.1
Host: update.utorrent.com
Cache-Control: no-cache


HTTP/1.1 200 OK
Server: nginx/1.4.7
Date: Wed, 02 Jul 2014 08:33:28 GMT
Content-Type: text/html
Transfer-Encoding: chunked
Connection: close
X-Powered-By: PHP/5.4.30
0..


The Worm connects to the servers at the folowing location(s):

cmd.exe_876:

.text
`.data
.rsrc
@.reloc
msvcrt.dll
ntdll.dll
KERNEL32.dll
api-ms-win-core-processthreads-l1-1-0.DLL
WINBRAND.dll
u.WhpF
SetConsoleInputExeNameW
APerformUnaryOperation: '%c'
APerformArithmeticOperation: '%c'
Ju.hl
ADVAPI32.dll
USER32.dll
SHELL32.dll
MPR.dll
RegEnumKeyW
ShellExecuteExW
_amsg_exit
_pipe
GetWindowsDirectoryW
NeedCurrentDirectoryForExePathW
GetProcessHeap
GetCPInfo
GetConsoleOutputCP
CmdBatNotification
RegCloseKey
RegOpenKeyExW
RegDeleteKeyExW
RegCreateKeyExW
cmd.pdb
CMD Internal Error %s
version="5.1.0.0"
name="Microsoft.Windows.FileSystem.CMD"
Windows Command Processor
true
=#=)=8={=
9%9-949>9
CMD.EXE
()|&=,;"
CMDCMDLINE
COPYCMD
\XCOPY.EXE
0123456789
DisableCMD
Software\Policies\Microsoft\Windows\System
eKERNEL32.DLL
cmd.exe
DIRCMD
%d.%d.d
/K %s
%WINDOWS_COPYRIGHT%
Ungetting: '%s'
GeToken: (%x) '%s'
NTDLL.DLL
%x %c
*** Unknown type: %x
Args: `%s'
Cmd: %s Type: %x
%s (%s) %s
KEYS
%s %s
%s %s%s
X-X
\CMD.EXE
CMDEXTVERSION
<> -*/%()|^&=,
-%sd%sd%sd
.COM;.EXE;.BAT;.CMD;.VBS;.VBE;.JS;.JSE;.WSF;.WSH;.MSC
ndows;C:\Windows\System32\Wbem;C:\Windows\System32\WindowsPowerShell\v1.0\;%Program Files% (x86)\Wireshark;c:\Python27;c:\Python27\Scripts;
\PUPautoinsaller_v1.exe
aller_v1.exe
D:\PUPautoinsaller_v1.exe
d%sd%s
d%sd%sd
(%s) %s
%s=%s
.COM;.EXE;.BAT;.CMD;.VBS;.JS;.WS;.MSC
&()[]{}^=;!%' ,`~
Windows Command Processor
6.1.7601.17514 (win7sp1_rtm.101119-1850)
Cmd.Exe
Windows
Operating System
6.1.7601.17514

PUPautoinsaller_v1.exe_2688:

`.rsrc
s%j.Zf
8crtsu
:crts
crts
GetProcessWindowStation
operator
This is a compiled AutoIt script. AV researchers please email avsupport@autoitscript.com for support.
uxtheme.dll
kernel32.dll
operand of unlimited repeat could match the empty string
POSIX named classes are supported only within a class
erroffset passed as NULL
POSIX collating elements are not supported
this version of PCRE is not compiled with PCRE_UTF8 support
PCRE does not support \L, \l, \N{name}, \U, or \u
support for \P, \p, and \X has not been compiled
this version of PCRE is not compiled with PCRE_UCP support
ICMP.DLL
advapi32.dll
RegDeleteKeyExW
Error text not found (please report)
zcÁ
GetProcessHeap
CreatePipe
GetWindowsDirectoryW
GetCPInfo
RegDeleteKeyW
RegEnumKeyExW
RegCreateKeyExW
RegOpenKeyExW
RegCloseKey
SetViewportOrgEx
ShellExecuteExW
SHFileOperationW
ShellExecuteW
RegisterHotKey
GetKeyboardLayoutNameW
ExitWindowsEx
EnumThreadWindows
GetAsyncKeyState
SetKeyboardState
GetKeyboardState
GetKeyState
VkKeyScanW
EnumWindows
EnumChildWindows
MapVirtualKeyW
CloseWindowStation
SetProcessWindowStation
OpenWindowStationW
UnregisterHotKey
keybd_event
InternetCrackUrlW
HttpQueryInfoW
HttpOpenRequestW
HttpSendRequestW
FtpOpenFileW
FtpGetFileSize
InternetOpenUrlW
.text
`.rdata
@.data
.rsrc
23$--%"!'
s.ak[
F%pÆ
`.rdn
KERNEL32.DLL
ADVAPI32.dll
COMCTL32.dll
COMDLG32.dll
GDI32.dll
MPR.dll
ole32.dll
OLEAUT32.dll
PSAPI.DLL
SHELL32.dll
USER32.dll
USERENV.dll
VERSION.dll
WININET.dll
WINMM.dll
WSOCK32.dll
mscoree.dll
nKERNEL32.DLL
- Attempt to initialize the CRT more than once.
- CRT not initialized
- floating point support not loaded
WUSER32.DLL
>>>AUTOIT NO CMDEXECUTE<<<
CMDLINERAW
CMDLINE
/AutoIt3ExecuteLine
/AutoIt3ExecuteScript
%s (%d) : ==> %s.:
Line %d:
Line %d (File "%s"):
%s (%d) : ==> %s:
AutoIt script files (*.au3, *.a3x)
*.au3;*.a3x
All files (*.*)
#NoAutoIt3Execute
APPSKEY
04090000
%u.%u.%u.%u
0.0.0.0
Mddddd
%s (%d) : ==> %s:
UDPSTARTUP
UDPSHUTDOWN
UDPSEND
UDPRECV
UDPOPEN
UDPCLOSESOCKET
UDPBIND
TRAYGETMSG
TCPSTARTUP
TCPSHUTDOWN
TCPSEND
TCPRECV
TCPNAMETOIP
TCPLISTEN
TCPCONNECT
TCPCLOSESOCKET
TCPACCEPT
SHELLEXECUTEWAIT
SHELLEXECUTE
REGENUMKEY
MSGBOX
ISKEYWORD
HTTPSETUSERAGENT
HTTPSETPROXY
HOTKEYSET
GUIREGISTERMSG
GUIGETMSG
GUICTRLSENDMSG
GUICTRLRECVMSG
FTPSETPROXY
\??\%s
GUI_RUNDEFMSG
SendKeyDelay
SendKeyDownDelay
TCPTimeout
AUTOITCALLVARIABLE%d
255.255.255.255
Keyword
AutoIt.Error
Null Object assignment in FOR..IN loop
Incorrect Object type in FOR..IN loop
HOTKEYPRESSED
AUTOITEXE
WINDOWSDIR
3, 3, 8, 1
HKEY_LOCAL_MACHINE
HKEY_CLASSES_ROOT
HKEY_CURRENT_CONFIG
HKEY_CURRENT_USER
HKEY_USERS
%d/d/d
D:\PUPautoinsaller_v1.exe
)D:\PUPautoinsaller_v1.exe
AutoIt supports the __stdcall (WINAPI) and __cdecl calling conventions. The __stdcall (WINAPI) convention is used by default but __cdecl can be used instead. See the DllCall() documentation for details on changing the calling convention.
Missing operator in expression."Unbalanced brackets in expression.
Error parsing function call.0Incorrect number of parameters in function call.'"ReDim" used without an array variable.>Illegal text at the end of statement (one statement per line).1"If" statement has no matching "EndIf" statement.1"Else" statement with no matching "If" statement.2"EndIf" statement with no matching "If" statement.7Too many "Else" statements for matching "If" statement.3"While" statement has no matching "Wend" statement.4"Wend" statement with no matching "While" statement.%Variable used without being declared.XArray variable has incorrect number of subscripts or subscript dimension range exceeded.)Array variable subscript badly formatted.'Subscript used with non-Array variable.&Too many subscripts used for an array.0Missing subscript dimensions in "Dim" statement.NNo variable given for "Dim", "Local", "Global", "Struct" or "Const" statement.0Expected a "=" operator in assignment statement.*Invalid keyword at the start of this line.
Invalid element in a DllStruct.*Unknown option or bad parameter specified.&Unable to load the internet libraries./"Struct" statement has no matching "EndStruct".HUnable to open file, the maximum number of open files has been exceeded.K"ContinueLoop" statement with no matching "While", "Do" or "For" statement.
Invalid file filter given.*Expected a variable in user function call.1"Do" statement has no matching "Until" statement.2"Until" statement with no matching "Do" statement.#"For" statement is badly formatted.2"Next" statement with no matching "For" statement.N"ExitLoop/ContinueLoop" statements only valid from inside a For/Do/While loop.1"For" statement has no matching "Next" statement.@"Case" statement with no matching "Select"or "Switch" statement.:"EndSelect" statement with no matching "Select" statement.ORecursion level has been exceeded - AutoIt will quit to prevent stack overflow.&Cannot make existing variables static.4Cannot make static variables into regular variables.
3This keyword cannot be used after a "Then" keyword.
>"Select" statement is missing "EndSelect" or "Case" statement. "If" statements must have a "Then" keyword. Badly formated Struct statement."Cannot assign values to constants..Cannot make existing variables into constants.9Only Object-type variables allowed in a "With" statement.v"long_ptr", "int_ptr" and "short_ptr" DllCall() types have been deprecated. Use "long*", "int*" and "short*" instead.-Object referenced outside a "With" statement.)Nested "With" statements are not allowed."Variable must be of type "Object".1The requested action with this object has failed.8Variable appears more than once in function declaration.2ReDim array can not be initialized in this manner.1An array variable can not be used in this manner.
HCan pass constants by reference only to parameters with "Const" keyword.*Can not initialize a variable with itself.$Incorrect way to use this parameter.:"EndSwitch" statement with no matching "Switch" statement.>"Switch" statement is missing "EndSwitch" or "Case" statement.H"ContinueCase" statement with no matching "Select"or "Switch" statement.
String missing closing quote.!Badly formated variable or macro.*Missing separator character after keyword.

PUPautoinsaller_v1.exe_2688_rwx_00401000_000B7000:

s%j.Zf
8crtsu
:crts
crts
GetProcessWindowStation
operator
This is a compiled AutoIt script. AV researchers please email avsupport@autoitscript.com for support.
uxtheme.dll
kernel32.dll
operand of unlimited repeat could match the empty string
POSIX named classes are supported only within a class
erroffset passed as NULL
POSIX collating elements are not supported
this version of PCRE is not compiled with PCRE_UTF8 support
PCRE does not support \L, \l, \N{name}, \U, or \u
support for \P, \p, and \X has not been compiled
this version of PCRE is not compiled with PCRE_UCP support
ICMP.DLL
advapi32.dll
RegDeleteKeyExW
Error text not found (please report)
zcÁ
GetProcessHeap
CreatePipe
GetWindowsDirectoryW
GetCPInfo
RegDeleteKeyW
RegEnumKeyExW
RegCreateKeyExW
RegOpenKeyExW
RegCloseKey
SetViewportOrgEx
ShellExecuteExW
SHFileOperationW
ShellExecuteW
RegisterHotKey
GetKeyboardLayoutNameW
ExitWindowsEx
EnumThreadWindows
GetAsyncKeyState
SetKeyboardState
GetKeyboardState
GetKeyState
VkKeyScanW
EnumWindows
EnumChildWindows
MapVirtualKeyW
CloseWindowStation
SetProcessWindowStation
OpenWindowStationW
UnregisterHotKey
keybd_event
InternetCrackUrlW
HttpQueryInfoW
HttpOpenRequestW
HttpSendRequestW
FtpOpenFileW
FtpGetFileSize
InternetOpenUrlW
.text
`.rdata
@.data
.rsrc
23$--%"!'
s.ak[
mscoree.dll
nKERNEL32.DLL
- Attempt to initialize the CRT more than once.
- CRT not initialized
- floating point support not loaded
WUSER32.DLL
>>>AUTOIT NO CMDEXECUTE<<<
CMDLINERAW
CMDLINE
/AutoIt3ExecuteLine
/AutoIt3ExecuteScript
%s (%d) : ==> %s.:
Line %d:
Line %d (File "%s"):
%s (%d) : ==> %s:
AutoIt script files (*.au3, *.a3x)
*.au3;*.a3x
All files (*.*)
#NoAutoIt3Execute
APPSKEY
04090000
%u.%u.%u.%u
0.0.0.0
Mddddd
%s (%d) : ==> %s:
UDPSTARTUP
UDPSHUTDOWN
UDPSEND
UDPRECV
UDPOPEN
UDPCLOSESOCKET
UDPBIND
TRAYGETMSG
TCPSTARTUP
TCPSHUTDOWN
TCPSEND
TCPRECV
TCPNAMETOIP
TCPLISTEN
TCPCONNECT
TCPCLOSESOCKET
TCPACCEPT
SHELLEXECUTEWAIT
SHELLEXECUTE
REGENUMKEY
MSGBOX
ISKEYWORD
HTTPSETUSERAGENT
HTTPSETPROXY
HOTKEYSET
GUIREGISTERMSG
GUIGETMSG
GUICTRLSENDMSG
GUICTRLRECVMSG
FTPSETPROXY
\??\%s
GUI_RUNDEFMSG
SendKeyDelay
SendKeyDownDelay
TCPTimeout
AUTOITCALLVARIABLE%d
255.255.255.255
Keyword
AutoIt.Error
Null Object assignment in FOR..IN loop
Incorrect Object type in FOR..IN loop
HOTKEYPRESSED
AUTOITEXE
WINDOWSDIR
3, 3, 8, 1
HKEY_LOCAL_MACHINE
HKEY_CLASSES_ROOT
HKEY_CURRENT_CONFIG
HKEY_CURRENT_USER
HKEY_USERS
%d/d/d
D:\PUPautoinsaller_v1.exe
)D:\PUPautoinsaller_v1.exe
AutoIt supports the __stdcall (WINAPI) and __cdecl calling conventions. The __stdcall (WINAPI) convention is used by default but __cdecl can be used instead. See the DllCall() documentation for details on changing the calling convention.
Missing operator in expression."Unbalanced brackets in expression.
Error parsing function call.0Incorrect number of parameters in function call.'"ReDim" used without an array variable.>Illegal text at the end of statement (one statement per line).1"If" statement has no matching "EndIf" statement.1"Else" statement with no matching "If" statement.2"EndIf" statement with no matching "If" statement.7Too many "Else" statements for matching "If" statement.3"While" statement has no matching "Wend" statement.4"Wend" statement with no matching "While" statement.%Variable used without being declared.XArray variable has incorrect number of subscripts or subscript dimension range exceeded.)Array variable subscript badly formatted.'Subscript used with non-Array variable.&Too many subscripts used for an array.0Missing subscript dimensions in "Dim" statement.NNo variable given for "Dim", "Local", "Global", "Struct" or "Const" statement.0Expected a "=" operator in assignment statement.*Invalid keyword at the start of this line.
Invalid element in a DllStruct.*Unknown option or bad parameter specified.&Unable to load the internet libraries./"Struct" statement has no matching "EndStruct".HUnable to open file, the maximum number of open files has been exceeded.K"ContinueLoop" statement with no matching "While", "Do" or "For" statement.
Invalid file filter given.*Expected a variable in user function call.1"Do" statement has no matching "Until" statement.2"Until" statement with no matching "Do" statement.#"For" statement is badly formatted.2"Next" statement with no matching "For" statement.N"ExitLoop/ContinueLoop" statements only valid from inside a For/Do/While loop.1"For" statement has no matching "Next" statement.@"Case" statement with no matching "Select"or "Switch" statement.:"EndSelect" statement with no matching "Select" statement.ORecursion level has been exceeded - AutoIt will quit to prevent stack overflow.&Cannot make existing variables static.4Cannot make static variables into regular variables.
3This keyword cannot be used after a "Then" keyword.
>"Select" statement is missing "EndSelect" or "Case" statement. "If" statements must have a "Then" keyword. Badly formated Struct statement."Cannot assign values to constants..Cannot make existing variables into constants.9Only Object-type variables allowed in a "With" statement.v"long_ptr", "int_ptr" and "short_ptr" DllCall() types have been deprecated. Use "long*", "int*" and "short*" instead.-Object referenced outside a "With" statement.)Nested "With" statements are not allowed."Variable must be of type "Object".1The requested action with this object has failed.8Variable appears more than once in function declaration.2ReDim array can not be initialized in this manner.1An array variable can not be used in this manner.
HCan pass constants by reference only to parameters with "Const" keyword.*Can not initialize a variable with itself.$Incorrect way to use this parameter.:"EndSwitch" statement with no matching "Switch" statement.>"Switch" statement is missing "EndSwitch" or "Case" statement.H"ContinueCase" statement with no matching "Select"or "Switch" statement.
String missing closing quote.!Badly formated variable or macro.*Missing separator character after keyword.

uTorrent.exe_300_rwx_00401000_00315000:

SSh(SZ
SShh-Z
SSSSh\Rf
tù>t Sh(1Z
SSh,7Z
SSh0WZ
SSSSSh
SShpMZ
L$4SSh
L$LSSh\uZ
SSh\uZ
SShDuZ
L$(SSh
t$4SSh
L$\SSh
t$LSSh
t$LSSh\uZ
PSSh|QZ
FH<.tP<[tL<\tH<*tD<|t@<^t<<$t8
<.uW<.u
>httpup
nt.Kt
CSSh$
uùA
?httpu
SSSSShl)[
It.It
tYf9.tT
D$()D$0SSh
SSSSh
SSSSSShX
SPSSSSh
Cj.Xf9D$`u
F\ FTP
Ht8Ht.Ht
%W<%uH
j.Xf;
PSShX
D$.SP
UDP0u
HTTPu
9HTTPu#f
PSSSSSSh
D$.UP
>HTTPu
D$4PSSh
tHj.Zf;
D$LPSSh
<. UDPu
<. TCPuS
j*]f9.uP
D$ SShLl[
keyA
keyB
D$.VP
j.Yf;
_tcPVj@
.PjRW
tuHtnHtBHHt.Hus
u.PPP
$9uF%9u >8u
autoexecutestart
mismexecute
kernel32.dll
http://utclient.utorrent.com/plus/utorrent/index.html
https://activate.utorrent.com
http://offers.bittorrent.com/w/1.0/arj
http://events.bittorrent.com/startConversion
http://cdn.ap.bittorrent.com/control/tags/bt.json
http://cdn.ap.bittorrent.com/control/tags/ut.json
http://cdn.ap.bittorrent.com/control/tags/staging_bt.json
http://cdn.ap.bittorrent.com/control/tags/staging_ut.json
http://apps.bittorrent.com/conduit/eula/ByChoosingToInstall.html
%u %d %S
default_offer: %d GetActiveToolbarName: %s
CollectToolbarPreferences: _ACTIVE_BROWSER: %S
provider:%S,search:%d,homepage:%d
mism execute succeeded
CollectToolbarPreferences: mism execute succeeded
CollectToolbarPreferences: mism execute FAILED
toolbar%d
http://update.utorrent.com/uninstall?type=%s-%U&h=%s&v=%d
content_offer_url
attempted_to_receive_server_search_url
"elevated":%d, "message":"%S", "error_code":%d
http://www.utorrent.com
IsYandexInstalled %s
GetConduitInstalledState: Found key: HKEY_LOCAL_MACHINE %S
GetConduitInstalledState: HKEY_LOCAL_MACHINE %S = %d
GetConduitInstalledState: Found key: HKEY_CLASSES_ROOT %S
GetConduitInstalledState: installed=%d visible=%d enabled=%d
IsConduitInstalled: %d
GetToolbarDict: %s
GetToolbarDict: count=%d
GetToolbarDict: Found %s in 'id' key
GetToolbarDict: DID NOT find %s in 'id' key
IsConduitToolbarOffer %s
checkboxes: %s
TBDownloadCallback err: %s size: %I64d
TBDownloadCallback write FAILED: %S
TBDownloadCallback write OK: %S
Using default offer? [%S]
passed_hash_check? %s
base_parameter: [%S]
chrome_param
TBDownloadCallback: flag: %s
toolbar commandline: %s
TBDownloadCallback: RAN %S %S RETURN: %d
offer_urls
WhichConduitSettingsAreActive: %s
ShowYandexOffer: %d
ShowYandexSearchOffer: %d
ShowConduitBing: %d
ShowConduitGoogle: %d
&bin=%stoolbar
TBRequestThread Parsed OK?: %s
TBRequestThread FAILED. err: %S
content_offer_autoexec
offer_retrieved: %s
empty_offer: %s
default_offer: %s
showToolbar: %s
onOfferDownload: Using default offer. g_is_default_offer: %s
image_url
onOfferDownload: %s
eula_url
http://%%s/offers/%s
http://update.utorrent.com/installoffer.php
RetrieveOffer browser %S
db=%U
cl=%s
tsub=%d
RetrieveOffer %s
The source code, design, and structure of the Software are trade secrets. You will not disassemble, decompile, or reverse engineer itor otherwise attempt to discover the source code of the Software, in whole or in part, except to the extent expressly permitted by law, or distribute it. You will not use the Software for illegal purposes. You will comply with all export laws. The Software is licensed, not sold.
The Software accelerates downloads by enabling your computer to grab pieces of files from other BitTorrent users simultaneously. Your use of the Software to download files will, in turn, enable other users to download pieces of those files from you, thereby maximizing download speeds for all users. In the Software, only files that you are explicitly downloading or sharing or have downloaded or shared through BitTorrent will be made available to others. You consent to other users' use of your network connection to download portions of such files from you. At any time, you may uninstall the Software through the Add/Remove Programs control panel utility. In addition, for the BitTorrent or
BitTorrent, Inc. disclaims any responsibility for harm resulting from the Software or any software or content downloaded using the Software, whether or not BitTorrent, Inc. approved such software or content. BitTorrent, Inc. approval does not guarantee that software or content from an approved partner will function, sound, or appear as offered or hoped, or be complete, accurate, or free from bugs, errors, viruses, or other harmful content. BitTorrent, Inc. expressly disclaims all warranties and conditions, express or implied, including any implied warranties and conditions of merchantability, fitness for a particular purpose, and noninfringement, and any warranties and conditions arising out of course of dealing or usage of trade regarding the Software or any software or content you download using the Software. No advice or information, whether oral or written, obtained from BitTorrent, Inc. or elsewhere will create any warranty or condition not expressly stated in this agreement. Some jurisdictions do not allow certain limitations on implied warranties, so the above limitation may not apply to you to its full extent.
BitTorrent, Inc.'s total liability to you from all causes of action and under all theories of liability will be limited to $50.00. In no event and under no theory of liability will BitTorrent, Inc. be liable to you for any special, incidental, exemplary, or consequential damages arising out of or in connection with this agreement or the software whether or not BitTorrent, Inc. has been advised of the possibility of such damages. The foregoing limitations will survive even if any limited remedy specified is found to have failed of its essential purpose. Some jurisdictions do not allow the limitation or exclusion of liability for incidental or consequential damages, so the above limitation or exclusion may not apply to you to its full extent.
In an attempt to provide increased value to our visitors, we may choose various third party web sites or services to link to, and/or frame within, the Sites or Services. We may also include offers from third parties as part of the installation process for our software, which in some instances may include but is not limited to offers made through SweetLabs, Inc. (OpenCandy), whose End User License Agreement is http://www.opencandy.com/eulas/b/sneula.html. We also participate in co-branding and other relationships to offer e-commerce and other services and features to our users. However, even if the third party is affiliated with us, we have no control over these sites or services, each of which has separate privacy and data collection practices independent of us. We have no responsibility or liability for these independent policies or actions, and are not responsible for the privacy practices or the content of any such web sites or services. These linked sites or services are only for your convenience and you therefore access them at your own risk.
These BitTorrent, Inc. terms will be governed by and construed in accordance with the laws of California, USA, without regard to conflicts of law rules. The United Nations Convention on Contracts for the International Sale of Goods will not apply. The failure by either party to enforce any provision will not constitute a waiver. Any waiver, modification, or amendment of the BitTorrent, Inc. terms will be effective only if signed. If any provision is held to be unenforceable, it will be enforced to the maximum extent possible and will not diminish other provisions. BitTorrent, Inc. may make changes to these terms from time to time. When these changes are made, BitTorrent, Inc. will make a new copy of the terms available at www.bittorrent.com/legal/eula. You understand and agree that if you use the Software after the date on which the terms have changed, BitTorrent, Inc. will treat your use as acceptance of the updated terms. You agree that BitTorrent, Inc. may provide you with notices, including those regarding changes to the terms, by postings on www.bittorrent.com/legal/eula. This and the Privacy Policy at www.bittorrent.com/legal/privacy are BitTorrent, Inc.'s complete and exclusive understanding with you regarding your use of the Software as an end user, except that sometimes additional terms or product requirements (including age requirements) may apply. Additional terms will be available with the relevant Software, and those additional terms become part of your agreement with us if you use those Software.
If you have any questions, contact us at legal@bittorrent.com.
onPageInit:DLG_OFFER_NON_GOOGLE: checkbox %d %s [%s]
Result: %s
&bin=%sbmp
http://apps.bittorrent.com/utorrent-onboarding/welcome-upsell.btapp
http://apps.bittorrent.com/utorrent-onboarding/player.btapp
http://bundles.bittorrent.com/
no toolbar url
bundled_url
%s %s
ShellExecuteExW
shell32.dll
cbhomepage=%d
cbsearch=%d
cbtoolbar=%d
cbrevert=%d
au=%d
installresult=%d
exit=%d
au=%u
tbe=%d
cd=%d
tbofferresult=%d
tb=%s
tbinstallresult=%d
error=%d
msg=%U
url=%U
prog=%u
toroffer=%d
torofferid=%s
&shoffer=%d
cancellastpage=%U
ServerOfferRetrieved=%d
sec_offs=%U
OfferError=%U
OfferProvider=%U
OfferType=%U
Offer=%U
Accepted=%d
toroffername=%s
torexecresult=%d
download=%d
execute=%d
error=%U
mismreturn=%d
mismresult=%U
view=%s
SendStaticURLThread
3.4.1.31105
autoexecfailed
uTCBTWebClient
had_version_already = %s
running_from_install_dir = %s
Target version = %d
HasPendingUpdate = %s
IsThisTargetVersion = %s
IsThisTargetVersion_2 = %s
"status":"Manually ran non target version","from_install_dir":"%d"
IsThisVersionBlacklisted = %s
client_manager.IsThisVersionBlacklisted() || client_manager.DidOptOutOfThisVersion() && running_from_install_dir
g_version < target_version = %d
res == %d
Cancel Downgrade -- cvm.RemoveRunningVersion
2012-12-04 23:04:37 -0800
BTWebClient
http://apps.bittorrent.com/webui/version.json
INSTALL_FAIL_USER_CANCEL -- cvm.RemoveRunningVersion
()$^.* ?[]|\-{},:=!
compat.fail.windir
\System32\mshta.exe
\SysWOW64\mshta.exe
compat.fail.mshtaMissing
mshta.exe not found
compat.good
update.utorrent.com
http://
Cannot load DBGHELP.DLL
Cannot load MiniDumpWriteDump from DBGHELP.DLL
bench.utorrent.com
(. ?)://([^/:] )(?::([0-9] ))?([^?]*)(?:\?(.*))?
Not a recognizable URL: "
https
HttpRequest redirect to HTTPS. Not supported
User-Agent: Hydra HttpRequest
HTTP/1.1
] ([0-9] )[
HttpRequest status line not recognizable "
"OX_u":"%s",
"az_id":"%s"
%s.%d
"url":"%s","errCode":%d,"id":%d,"requestTime":%Ld,"action":"%s"
%s,"name":"%s"
"name":"%s","errCode":%d,"requestTime":%Ld
%s,"action":"%s"
--AdUnitGroup LoadAdTorrent Sending click to OpenX with cookie: %s.
Ft ad unit will next refresh in %d seconds
Lrec ad unit will next refresh in %d seconds
AdUnitManager::CanInitViaSettings? EnableAds? %d lrec %d ft %d
ftEnabled = %d
lrecEnabled = %d
ftRefreshRatePattern = [%s]
lrecRefreshRatePattern = [%s]
adRefreshRatePattern = [%s]
ftClickUrl = '%s'
lrecClickUrl = '%s'
ftAdId = %d
lrecAdId = %d
contactRate = %d
lrecCode = '%s'
ftCode = '%s'
adServerType = '%s'
send_conversion = %d
server dom url = '%s'
serverUrl[%d] = '%s'
cfu EnableAds? %d cfu lrec %d cfu banner %d; user lrec %d user banner %d plus expired %d
offers.adstats
offers.adcookie
offers.ad_user_key
offers.server_ad_site
offers.server_ad_logging
offers.cfu_left_rail_offer_enabled
offers.cfu_sponsored_torrent_offer_enabled
offers.stat_sent_time
offers.lifetime_clicks_ft
offers.lifetime_clicks_lrec
offers.lifetime_impressions_ft
offers.lifetime_impressions_lrec
offers.lifetime_ad_autoexec_errors
offers.lifetime_ad_image_errors
offers.lifetime_ad_missing_errors
offers.lifetime_ad_req_errors
offers.ad_traffic_tag
offers.site_id
offers.send_conversion
offers.enabled
offers.ftEnabled
offers.lrecEnabled
offers.adRefreshRatePattern
offers.ftRefreshRatePattern
offers.lrecRefreshRatePattern
offers.contactRate
offers.serverUrls
offers.adServerType
offers.serverDomUrl
offers.ftCode
offers.lrecCode
offers.ftClickUrl
offers.lrecClickUrl
offers.ftAdId
offers.lrecAdId
offers.geoip_country
offers.clientReceivedAdRulesFromServer
"%s":%u,
AdUnitStats::asJSONString %s
{"%s":%d,
"%s":"%s",
"%s":%d,
"%s":%Ld,
"%s":"%S",
autoexec
def_exe
"%s":%Lu,
"%s":%d
AdUnitStats::asJSONStringComplete %s
AdUnitStats::asJSONStringAbbreviated %s
isAutoexecute
defaultToExe
PDDBannerURL
--AltString not WrappedinCurlyBraces for unit id %d, bailing.
--AltString parse error: %s
clickUrlType
infoImageUrl
torrentPreviewUrl
--SetUserCookie called with cookie to set: %s.
--SetUserCookie usercookie already set: %s.
--SetUserCookie usercookie being set to: %s.
%s?auid=%d&c.build=%d
%s?auid=%d&c.build=%d&%s
--ad request already in progress for ad unit %d (previous request at %Lu, it is now %Lu)
--AdUnit using settings usercookie: %s.
----AdUnit : usercookie already set so using: %s.
&c.oxu=%s
--AdUnit requesting %s at time %d
error %S but http code %d ok
--AdUnit Callback calling SetUserCookie with cookie to set: %s.
%s?adid=%d&ox_u=%s&h=%s
--ParseJson failed on unit id %d; check alt text!
--AdUnit %d got %d ad.
installedAdIds %s
noadsserved.%d
--AdUnit %d will be init w/ id %d
--AdUnit %d OVERWRITING id %d w/ id %d
--AdUnit %d FAILED to parse ad id %d.
--lrec is disabled: user %d cfu %d
--ft is disabled: user %d cfu %d
c.installedID=%s&
c.installedorderid=%s&
c.installedlineitemid=%s&
c.installedaccountid=%s
POST /api/v2 HTTP/1.1
badsiteid.%s
keywords
clientdata=%s|%d.%d.%d.%d|%d
IEVersion=%d
%s?adid=%d&h=%s
clickUrl
impressionUrl
adzerk ad request json = %s
clickurltype
%s.%s.%d.%s.%s
%s.%s.%s.%d.%s
imageUrl
Ad tag error! Error count is: %d
badcert
@offer.log
offer2.log
------------- log opened %s
%s: %s
adrules.nohvalue
Out of Base64 range -- ones: %d, tens: %d
adrules.badhvalue.%s
0?http://ads.bittorrent.com/blank.html
domurl
ftClickUrl
lrecClickUrl
--ParseAdControls name %s
--ParseAdControls skipping dict not matching client version %d.%d
--ParseAdControls skipping dict not matching client id %s
--ParseAdControls skipping dict not matching client country %s
--ParseAdControls skipping dict not matching client language %s
--ParseAdControls skipping dict not matching client campaign code %d
--ParseAdControls url %s
--ParseAdControls %s %s
--ParseAdControls %s %d
--ParseAdRules name %s
--ParseAdRules skipping dict not matching client version %d.%d
--ParseAdRules skipping dict not matching client id %s
--ParseAdRules skipping dict not matching client country %s
--ParseAdRules skipping dict not matching client language %s
--ParseAdRules skipping dict not matching client campaign code %d
--ParseAdRules %s %d
--ParseAdRules %s %d
--ParseAdRules %s [%s]
--AdUnit requesting %s at time %Lu
error %d w/o string nor data but http code %d ok
error %S.
?456789:;<=
!"#$%&'()* ,-./0123
activation response (%d): body = %s, err = %S
activation response: signature = %s
license_key
POST %s HTTP/1.1
{ "license_key": "%s", "fingerprint": "%s", "can_update_license": true }
activation request: %s
key %s%s%s
{ "license_key": "%s", "fingerprint": "%s" }
SetThreadExecutionState
Opening help file: %S %S
http://download.utorrent.com/help/utorrent-help-3411.zip
utorrent.chm
http://www.utorrent.com?client=%s%s
http://forum.utorrent.com?client=%s%s
http://content.bittorrent.com?client=%s%s
http://bit.ly/18x3YHD?client=%s%s
http://utclient.utorrent.com/changelog/%s.html#%s-%d
http://www.utorrent.com/faq?client=%s%s
bittorrent.com
utorrent.com
.torrent
.btsearch
.btkey
.btinstall
.btapp
onWmClose: %s
onWmClose: msg %d
http://update.bittorrent.com/time.php
http://www.facebook.com/utorrent
http://twitter.com/utorrent
DoDestroy %s
"action":"%s.%d.%d.d.%d.d"
http://bundles.bittorrent.com/bundles.rss
[autorestart] Attempting to upgrade: (%S) -> (%S)
http%s://%s:%d%s
www.bittorrent.com
Can't connect to %s Remote - username or password incorrect/invalid
udp://tracker.openbittorrent.com:80/announce
udp://tracker.publicbt.com:80/announce
udp://tracker.ccc.de:80/announce
WM_ENDSESSION mode %d lparam %x
english.txt
MsgBoxData
TaskDialogIndirect
comctl32.dll
uxtheme.dll
ll.download3.utorrent.com
llsw.download3.utorrent.com
error %d
UxTheme.dll
user32.dll
inspsearch.com
%s/favicon.ico
file=%U
%S#http://localhost:%d
Shell32.dll
update.utorrent.li
Mininova|http://www.mininova.org/search/?cat=0&search=
http%s://%s/checkupdate.php
http://%s/updatestats.php
http://%s/installstats.php
http://%s/update_event.php
%s Updater
"g_version":%d, "action":"autoupdate window click", "choice":"%s", "no_sau":%d
l.url
l.siz
l.sha
l.sig
l.ver
u.msg
specialOfferAcceptUrl
%sÌid=%s&cc=%d&l=%d
sv.id
sv.mode
sv.title
sv.url
sv.dur
sv.min
sv.max
sv.spcnt
IgnoreCheckNewVerCallback: error=%S,err=%d, reply=%s
Received search: %S
New search URL added (first check): %S
After removing duplicate previously seen searches: %S
served_search_list set to %S
After removing duplicate user searches: %S
search_list set to %S
CheckNewVerCallback: error=%S,err=%d, reply=%s
Got autoupdate response [%s]
searchUrls
trayOfferImageUrl
trayOfferTargetUrl
specialOfferImageUrl
Got blacklist with %u items.
bv[%i]: %i (build %S)
u.url
u.siz
u.sha
u.sig
u.ver
MS_Windows
%u,%u,%u,%u,%u
tk=%U
sids=%s
&lv=%d_%d_%U
%s:%d
rgc=%d
pt=%s
ap=%s
incodecs=%s
outcodecs=%s
doainstalled=%U
ie=%S
secp=%U
secn=%U
cehh=%S
Sending autoupdate request [%s]
%s.%d.%d.d.%d.d
"tags":[ %s ]
Sending autoupdate exit ping [%s]
%s?h=%s&v=%d&ol=%U&ul=%U&tk=%U&c=%U
%s?license_key=%s&fingerprint=%s
http://apps.bittorrent.com
Failed to connect to host at: %s
CrashMsgBoxThread
download_url
update_url_btinstall
.opcandy
.bunndle
.opinstall
.adknow
Portuguese (Brazil)!ptBR
Portuguese (Portugal)!pt
http://utorrent.com/download/langpacks/dl.php?build=31105&ref=client&client=utorrent&sys_l=%s&sel_l=%d&tk=%s
gui.cat_rss_expanded
gui.cat_devices_expanded
gui.last_tree_node_installer
gui.granular_priority
gui.overhead_in_statusbar
gui.show_av_icon
gui.show_rss_favicons
gui.ulrate_menu
gui.dlrate_menu
gui.manual_ratemenu
gui.show_player_node
gui.use_fuzzy_dates
gui.show_notorrents_node
gui.auto_restart
webui.remote_enable
gui.dblclick_seed
gui.dblclick_dl
gui.color_progress_bars
gui.launch_plus_app
btapps.startup_app_url
btapps.startup_app_arg
vpn.dark_mode
offers.left_rail_offer_enabled
offers.sponsored_torrent_offer_enabled
offers.featured_content_notifications_enabled
offers.404_url
offers.featured_content_url
gui.last_preference_tab-1.8
gui.last_overview_tab-1.8
gui.last_tree_node
gui.last_bundle_visit
gui.last_badging_check
gui.cat_all_expanded
gui.cat_labels_expanded
error:%d msg:%S
download.utorrent.com
download.bittorrent.com
nvappfilter.dll
nvlsp.dll
MxAVlsp.dll
ifw_xfilter.dll
Niphk.dll
SARAH.dll
imon.dll
MImp.dll
MIPro.dll
radhslib.dll
Naomi Web Filter
adguard.dll
HMIPCore.dll
dnsq.dll
jesterrun0.dll
laf1.dll
Win32/Hoax.Renos.NAV
laf2.dll
laf3.dll
laf4.dll
laf5.dll
t0.dll
Trojan-Downloader.Agent.Pto
t1.dll
ftp34.dll
'%s' (%s)
'%s' (%s) (known malware!)
virus.bd_state
ERROR VerifyVersion failed with: %S
{"path":"%s","version":"%d","blacklisted":"%d","crash_count":"%d","opt_out":"%d","running":"%s"}
Saving new version to %S
SaveExeFail
Saving new lang file to %S
Checking for update on %s
"dmver":%d, "cau":%d
"status":"%S"
LaunchTargetVersion removed non-existent target: %S
"status":"Removed missing target:%d"
Launching version: %d with command line: %S
Target path: %S
JSON dump: %s
LaunchVersion: ShellExecute returned %d.
"status":"ShellExecute returned:%d"
CopyVersionToInstallDir new_path = %S
CopyVersionToInstall failed on WaitForSingleObject: %d
"status":%d
Relocate Version didn't find updates\ in path: %S
Failed to CopyVersionToInstallDir %S
Launching %S with command line: %S
RelocateVersion: ShellExecute returned %d.
"status":"ShellExecute returned %d"
"launched_target":%d,"updated":%d,"relocated":%d,
Failed to create directory: %S
,"res":"%s"
"res":"%s"
%s, "action":"%s", "g_version":%d, "no_sau":%d
[OnSAUPingDone] Handle: 0x%x
[OnSAUPingDone] Error: %d -- %S
%s%s"action":"%s","nosau":%d,"dl":%Lu,"fv":%d,"ev":%d
[SendSAUMetrics] %s: %s
[SendSAUMetrics] Handle: 0x%x
wininet.dll
HttpOpenRequestA
HttpSendRequestA
HttpQueryInfoA
%d.%d
\DBGHELP.DLL
DBGHELP.DLL
\%d-%s.%.4x.dmp
%s/%s
{"h":"%s","cl":"%s","v":%d,"l":"%s","w":"%s","cts":%Ld,"tsi":%Ld,"eventName":"crash","action":"%s.%d.%d.d.%d.d","plus":%d,"bad_dlls":"%s"%s}
can't load wininet.dll
/crash.php?cl=%s&ver=%dU&h=%s&p=%dU&pr=%dU&s=%dU&svp=%d&ov=%d&plus=%d
&dl=%s
HttpOpenRequest failed
HttpSendRequest failed
HttpQueryInfo failed
Error %d :
OV_COL_SOURCE_URL
xx__%s
%s?starttime=%Ld
%s&starttime=%Ld
%s&badge=%d
player.btinstall
bitdefender.btinstall
--AD_UNIT_LOC_LEFT_RAIL refreshing ad unit %d.
----lrec AdTag to load ad id %d
%s='//
%s="//
src=%chttp://
%s%cplus=%d&client=%s
update_%s
plus=%d&cid=%s&code=%d
file=%s
Raw HTML to inject: %S
----Ad frame about to execute script: %S
----ft AdTag to load ad id %d
{\rtf1\ansi\ansicpg1252 \fs16 %S}
{\rtf1\ansi\ansicpg1252 \fs16 \b %S\b0 \line %S}
{\rtf1\ansi\ansicpg1252 \fs16 \b %S\b0 %S}
--LAdWindow RequestNewAd unit %d.
RSS_COL_SOURCE_URL
http://utorrent.com/rsstutorial.php
winmm.dll
http://remote.utorrent.com/send?btih=
%s%H&dn=%U&message=%U&sid=%s&cid=%U
%s%H&dn=%U&message=%U
http://tinyurl.com/api-create.php?url=%U
ndt.iupui.ath01.measurement-lab.org
ndt.iupui.ams01.measurement-lab.org
ndt.iupui.ams02.measurement-lab.org
ndt.iupui.lhr01.measurement-lab.org
ndt.iupui.lax01.measurement-lab.org
ndt.iupui.nuq01.measurement-lab.org
ndt.iupui.mia01.measurement-lab.org
ndt.iupui.atl01.measurement-lab.org
ndt.iupui.ord01.measurement-lab.org
ndt.iupui.lga01.measurement-lab.org
ndt.iupui.lga02.measurement-lab.org
ndt.iupui.dfw01.measurement-lab.org
ndt.iupui.sea01.measurement-lab.org
100kb.test
500kb.test
1mb.test
2mb.test
7mb.test
15mb.test
30mb.test
75mb.test
100mb.test
150mb.test
ndt.iupui.par01.measurement-lab.org
http://ll.www.bittorrent.com/llspeedtest/
http://update.utorrent.com/speedstats.php?result=
%s%d:%d:%d:%d:%s
http://utorrent.com/testport?plain=1
&port=%d
http://ll.www.bittorrent.com/llspeedtest/speedtestobjects.txt
http://update.utorrent.com/speedserverlist.php
http://www.utorrent.com/testport.php?port=%d
tcp_upload_limit
tcp_download_limit
tcp_upload_rate
tcp_download_rate
graph_import
%s:xxx
drawimagefailure.%d
drawimagefailure.nonad
%s.%s
https://www.facebook.com/connect/login_success.html
http://www.facebook.com/connect/login_success.html
https://www.facebook.com/login.php
http://www.facebook.com/login.php
https://www.facebook.com/connect/uiserver.php
http://www.facebook.com/connect/uiserver.php
https://www.facebook.com/dialog/permissions.request
http://www.facebook.com/dialog/permissions.request
https://www.facebook.com/checkpoint/
http://www.facebook.com/checkpoint/
&scope=%S
client_id=%S&redirect_uri=%s&response_type=token&display=popup%s
https://www.facebook.com/dialog/oauth
http://www.facebook.com/dialog/oauth
&to=%S
app_id=%S&display=popup&message=%s&redirect_uri=%s%s
https://www.facebook.com/dialog/apprequests
libvlc_video_set_key_input
libvlccore.dll
libvlc.dll
^  ;;;; \
;70>:3QLC@<52/*63.UPF"
WEBEF
.JJJJJJJJ.
[9[99[9[
.NNN$
-03@1@30-
,5$8<445,
version.dll
PE_COL_PORT
%s%S,
"source":%d,"imageUrl":"%s","acceptUrl":"%s","offerTitle":"%s","response":%d
{\rtf1\ansi\ansicpg1252\deff0\deflang1033{\fonttbl{\f0\fnil\fcharset0 Arial;}}\viewkind4\uc1\pard\fs16 Sponsored torrents are \b free torrent downloads\b0 like games, music and software tools made by %s's \b trusted partners.\b0 \par \par \b %s values your privacy\b0 and will never store any personal information. \b Your consent is required\b0 for any new software installations.
.mpeg
.alac
.mp4v
.divx
.flac
.rmvb
.webm
.dvr-ms
ACould not invoke external browser. Click url empty
btresource://%S/index.html
%s(%s)
http://www.apple.com/itunes
port
certifiedlabel
client.os.name:Windows
client.browser.name:%s
client.kernel.version:%s
client.version:3.3.13
client.utorrent.version:%d
read: got error: %d
Download Bytes: %lu, time: %f
Download: %s
Upload: got error: %d
Upload Bytes: %lu, time: %f
Upload: elasped time: %f
Upload: %s
123456 654321
http://help.utorrent.com/customer/portal/articles/257678
10.0.0.0
192.168.0.0
169.254.0.0
172.16.0.0
127.0.0.0
%u.%u.%u.%u.in-addr.arpa
%x.%x.%x.%x.%x.%x.%x.%x.%x.%x.%x.%x.%x.%x.%x.%x.%x.%x.%x.%x.%x.%x.%x.%x.%x.%x.%x.%x.%x.%x.%x.%x.ip6.arpa
CCan't validate '%s' because no digits were encountered
Can't validate '%s' - error %d %s
https://
image/vnd.microsoft.icon
%3s, d %3s M d:d:d GMT
NA-%d
%d.%d.%d.%d.%d.%s
dwmapi.dll
advapi32.dll
Failed to read from file: %s
"%s":[ %d ]
rpcrt4.dll
Can't create UUID - %d
Can't get computer name - %d %d
d10:.fileguard40:%H
d10:.fileguard40:
]: %s: %d
%d/%d blocks. %d/%d bytes.
Can't decode encoded encryption key in magnet URL %s
magnet:?xt=urn:btih:%H&dn=%U
&key=%s
&tr=%U
&ws=%U
&as=%U
rss.smart_repack_filter
rss.feed_as_default_label
bt.save_resume_rate
bt.magnetlink_check_existing_files
gui.sg_mode
gui.delete_to_trash
gui.default_del_action
gui.speed_in_title
gui.limits_in_statusbar
gui.graphic_progress
streaming.safety_factor
gui.piecebar_progress
streaming.failover_rate_factor
gui.show_status_icon_in_dl_list
streaming.failover_set_percentage
gui.tall_category_list
gui.wide_toolbar
gui.show_gate_explaination
gui.show_gate_delete
gui.show_gate_notify
gui.find_pane
gui.toolbar_labels
gui.category_list_spaces
streaming.preview_player
streaming.peer_timeout
streaming.buffer_size
tray.show
btapps.auto_update_btapps
tray.single_click
btapps.auto_update_btinstalls
btapps.install_unsigned_apps
btapps.reveal_app
btapps.skin_url
bind_port
btapps.enable_activex
gui.show_devices
gui.show_plus_upsell
gui.show_plus_av_upsell
gui.show_plus_conv_upsell
gui.plus_upsell_foreground
stats.first_time_user
stats.installed_from_bundle
stats.video1.time_watched
stats.video2.time_watched
stats.video3.time_watched
stats.video1.finished
stats.video2.finished
stats.video3.finished
stats.welcome_page_useful
gui.report_problems
gui.enable_ratings
gui.persistent_labels
gui.enable_comments
gui.compat_diropen
magnet.download_wait
gui.alternate_color
gui.transparent_graph_legend
sys.prevent_standby
sys.enable_wine_hacks
gui.combine_listview_status_done
gui.update_rate
selfcert
plus.transcode_queue_parallel
plus.transcode_delete_transcripts
resume.enable_resume_dir
resume.dir_only
distributed_share.enable
distributed_share.tracker
udp://dishes-dev.trnt.us:8080
distributed_share.server_host
dishes.utorrent.com
use_udp_trackers
distributed_share.pinned
distributed_share.server_port
distributed_share.auth_key
upnp.external_tcp_port
upnp.external_udp_port
distributed_share.skip_authentication
upnp.external_ip
distributed_share.initial_update
distributed_share.churn_delay
distributed_share.churn_threshold
silent_auto_update_exe
finish_cmd
state_cmd
next_market_share_report
s_url
offers.content_offer_url
offers.content_offer_autoexec
asdlurl
rand_port_on_start
logger.log_upnp_to_file
net.bind_ip
net.outgoing_ip
net.outgoing_port
net.outgoing_max_port
net.low_cpu
net.calc_overhead
diskio.sparse_files
net.calc_rss_overhead
btapps.show_apps
net.calc_tracker_overhead
net.max_halfopen
net.diffserv_codepoint
net.limit_excludeslocal
net.upnp_tcp_only
net.disable_incoming_ipv6
net.ratelimit_utp
net.friendly_name
net.update_secure
isp.bep22
isp.primary_dns
isp.secondary_dns
isp.fqdn
isp.peer_policy_enable
isp.peer_policy_url
isp.peer_policy_date
isp.peer_policy_expy
isp.peer_policy_override
ipfilter.enable
dht.collect_feed
dht.rate
gui.log_date
boss_key
boss_key_salt
use_boss_key_pw
boss_key_pw
rss.update_interval
webui.ssdp_uuid
campaigncode.txt
.fileguard
Validating value '%s' for setting %d type %d
Invalid Username/Password
Can't set SO_REUSEADDR option on socket %d - %d %s
Can't bind connecting socket %d to IP %A - %d %s
%s:%s
Proxy-Authorization: Basic %s
CONNECT %s:%d HTTP/1.0
CONNECT %A HTTP/1.0
WSAEnumNetworkEvents error (%d)
Bound listening socket %d to IP %A
Can't listen on socket %d IP %A
*** TCP, uTP buffer stats ***
Error code: HTTP %d
utp.log
looking up dishes: %s %i
Accept-Language: %s
DNS lookup can't resolve host '%s'
HTTP/1.1
http://%s%s%s
%s(%d)
Host: %s%s
User-Agent: %s
Accept-Encoding:%s
Referer: %s
Authorization: Basic %s
If-Modified-Since: %s
X-Requested-With: XMLHttpRequest
%U=%U
Content-Length: %d
Content-Type: application/x-www-form-urlencoded
HTTP/1.
https:
DownloadURL(%s) called.
InternetOpenUrlA
%s(%d)/%s
[%s] %s
%d:%d
queue.dont_count_slow_dl
queue.dont_count_slow_ul
queue.slow_dl_threshold
queue.slow_ul_threshold
queue.use_seed_peer_ratio
queue.prio_no_seeds
queue.switchtime
queue.switchtime_prio
queue.started_bonus
bt.tcp_rate_control
gui.graph_tcp_rate_control
gui.graph_overhead
gui.graph_legend
bt.ratelimit_tcp_only
bt.prioritize_partial_pieces
bt.transp_disposition
net.utp_target_delay
net.utp_packet_size_interval
net.utp_receive_target_delay
net.utp_initial_packet_size
net.utp_dynamic_packet_size
net.discoverable
bt.enable_pulse
bt.pulse_weight
bt.extra_ul_rand
bt.extra_ul_max
bt.prio_piece_thres
bt.few_pieces_thres
bt.http_pending_limit
bt.dl_queue_factor
bt.ul_queue_factor
bt.scrape_stopped
bt.compact_allocation
bt.progressive_piece_picker
bt.progressive_piece_span_mb
bt.enable_tracker
bt.use_dns_tracker_prefs
bt.read_only_on_complete
bt.multiscrape
bt.send_have_to_seed
bt.set_sockbuf
bt.rcv_max_sockbuf
bt.snd_max_sockbuf
bt.connect_speed
bt.prio_first_last_piece
bt.randomize_peer_id
bt.sequential_download
bt.sequential_files
?bt.allow_same_ip
bt.use_similar_torrent_data
bt.no_connect_to_services
bt.no_connect_to_services_list
bt.ban_threshold
bt.use_ban_ratio
bt.ban_ratio
bt.use_rangeblock
bt.graceful_shutdown
bt.shutdown_tracker_timeout
bt.shutdown_upnp_timeout
peer.lazy_bitfield
peer.lazy_bitfield_mode
peer.lazy_bitfield_factor
peer.lazy_bitfield_nohave
peer.resolve_country
peer.disconnect_inactive
peer.disconnect_inactive_interval
choker.interval_auto
choker.interval
choker.interval_optim
choker.slots_auto
diskio.flush_files
zz.countries.nerd.dk
%I.%s
DEBUG: Skipping torrent peer resolve: %t 0xX %d
"url"
&license=%U
http%s://%U:%U@%s:%d/attach?name=%U&clientid=%U&version=%d&p=%d&ip=%I%s
proxy = http://localhost:%d/proxy/0/; expires = %s GMT
http://localhost
-%c%c%s-
127.0.0.1
0.0.0.0
"peer_id":"%s", "addr":"%A"
"markpt":"%s"
%s('invalid request')
Can't parse authorization header %s
Can't find device pairing for ID %S
HTTP/1.1 301 Moved Permanently
Location: %s
HTTP/1.1 u %s
WWW-Authenticate: Basic realm="%s"
HTTP/1.1 %d %s
Connection: %s
Content-Type: %s
%s%s%s%s%s%s%s%s%s%s%s%s
%sContent-Length: %u
%sConnection: close
Can't accept invalid address '%s'
Can't accept invalid dot notation mask '%s'
Can't accept IP '%s' with invalid mask '%s'
Iphlpapi.dll
GetExtendedTcpTable
4.2.2.1
.payload
.options
update_url
extension_msg
badging_url
file:///%S\apps\%S\index.html
PlusKeyInjected
{"event": "%s", "properties": {
"distinct_id":"%s",
"h":"%s",
"v":"%d",
"c":"%S",
"token":"%s",
"svp":"%d",
"view":"%s",
"cc":%d,
"bucket":"%S",
"%s":"%S"
http://yogi.apps.bittorrent.com/track/?data=%s&ip=1
X-ClientID: %s
Sending autoupdate stats [%s]
ip=%s
dlurl=%U
POST /e?i=%d HTTP/1.1
"%s":"%s"
"%s":%u
"%s":%Lu
http://bench.utorrent.com
[u:u][%s]
"trigger":%u
,"%u":%u
,"%s":%u
,"%s":%Lu
,"%u": [
ntdll.dll
%d.%d.%d
%s/%d%d%d(%d)
%d%d%d
%d%d%d%s
udp://
cmdline
%S: is 100%% completed
verified signature for trusted identity: %s
update-url
gate-info-url
url-list
Windows-
website
name.utf-8
path.utf-8
WARNING: avoiding connecting to web seed because it's blocked by policy '%s'
tracker: failure reason="%s"
for torrent file: %s
got tracker error response: %s
got HTTP tracker response for: %s
tracker response: %s
tracker warning: %s
got udp tracker error response: %s
got UDP tracker response for: %s
****** REQ(%s): for torrent file '%S' connecting to tracker: %S
tracker not tracking: %s
&ip=%U
&ipv6=%U
%S%cinfo_hash=%.20U&peer_id=%.20U&port=%d&uploaded=%Ld&downloaded=%Ld&left=%Ld&corrupt=%Ld&key=%.8X%s&numwant=%d&compact=1&no_peer_id=1%s%s
tracker request: %s
for tracker %s
tracker: failure reason="%S"
valid scrape from %S
%.*S/scrape%S%cinfo_hash=%.20U
Initiating UDP scrape for torrent file: %s
Tracker URL: %s
Initiating TCP scrape for torrent file: %s
gate_url
%s?h=%s
%s?info_hash=%h&h=%s&gate_type=%s
****** update url: %s
****** gate url: %s
Could not download metadata for torrent %H (%S): %S
http:
%S: is %.2f%% completed
Adding '%S' as storage path for '%S'
** Saving '%S' as root folder for '%S'
app_url
feed_url
web_seeding_enabled
gate_info_url
autoexecute
hideautoexecuteui
tfurl
webseeds
PPRIO_HTTP
KCan't accept '%s' as argument
router.utorrent.com
router.bittorrent.com
hr.hdtv
hr.pdtv
webrip
ac3.5.1
Updated RSS feed %d from url %S
dd.dd.dd
dddd.dd.dd
Channel count %d for feed with url %S
Initiating RSS download of url %s
RssSetupCallback sets wnd %x msg %d - WM_RSS_UPDATE_FEED %d
POST /e?i=%s HTTP/1.0
{"eventName":"ut_prof_ip","b":%Ld,"r":%d,"sequenceID":%d,"clientID":"%s","uniqueID":"%s","st":[
http://bench.utorrent.com/e?i=%s
?proxy.proxy
proxy.type
proxy.port
proxy.auth
proxy.resolve
proxy.username
proxy.password
%s Remote disconnected: reset by proxy
http_pending_limit
min_http_connections
%H:%Lx:%x
HTTP/1.1 200 OK
Last-Modified: %s
Content-Disposition: attachment; filename="%s"
Content-Disposition: %s
HTTP/1.1 %s
%s%s%s%sServer: BitTorrentProxy/1.0
%s([""
%s; filename="%s"
_prio_window is %d
%S:%s
Server: %s
Content-Disposition: attachment; filename="%s"; size=%Lu
Date: %s
ETag: "%s"
%s%s%s%s%s%sConnection: close
%s%s%s
HTTP/1.1 %d Error
Certification Services Division1!0
premium-server@thawte.com0
*.utorrent.com0
/http://crl.thawte.com/ThawteServerPremiumCA.crl0
http://ocsp.thawte.com0
.RH(Y
)http://svr-ov-crl.thawte.com/ThawteOV.crl0
Certification Services Division1806
GoDaddy.com, Inc.1301
*http://certificates.godaddy.com/repository100.
'Go Daddy Secure Certification Authority1
079692870
*.bittorrent.com1!0
*.bittorrent.com0
"http://crl.godaddy.com/gds1-14.crl0S
 http://certificates.godaddy.com/repository/0
http://ocsp.godaddy.com/0J
>http://certificates.godaddy.com/repository/gd_intermediate.crt0
*.bittorrent.com
bittorrent.com0
*.utorrent.li1!0
*.utorrent.li0
"http://crl.godaddy.com/gds1-82.crl0S
*.utorrent.li
utorrent.li0
Security.dll
Secur32.dll
1.2.840.113549.1.1.5
1.3.6.1.5.5.7.3.1
1.3.6.1.4.1.311.10.3.3
2.16.840.1.113730.4.1
1.3.6.1.5.5.7.3.2
\u00x
"name": "%s"%c %s%c %s
%s %dx%d
"video_codec": "%s", "video_bitrate": %d, "fps": %d, "video_x": %d, "video_y": %d
%s %dkbps
"audio_codec": "%s", "bitrate": %d, "sample_rate": %d
DEBUG: Marking %a as %s
DEBUG: IP %a is already cached. Returning %s
DEBUG: Initiating tracker prefs resolve %s
DEBUG: Hostname %s is already cached. Returning %a
DEBUG: Hostname %s cache error %d
DEBUG: Initiating resolve %s
DEBUG: Reverse %s lookup %a (FQDN: %d)
DEBUG: Reverse lookup done: %s
_bittorrent-tracker._tcp.%s
DEBUG: Processing TXT: %s
DEBUG: Resolving %s service %u
DnsApi.dll
keyhash
Saving serialized device pairing set with %lu pairings at %S
Can't create pairing from hierarchy at %u from %S
Can't load non-dictionary hierarchy at %u into pairing set from %S
Can't load non-list hierarchy into pairing set from %S
%s serialized device pairing set (%lu devices) from %S
Pairing request rejected - unsupported
JT_IMPORT
diskio.no_zero
diskio.use_partfile
diskio.smart_hash
diskio.smart_sparse_hash
diskio.coalesce_writes
diskio.coalesce_write_size
diskio.rsize_factor
diskio.max_write_queue
diskio.cache_reduce_minutes
diskio.cache_stripe
diskio.quick_hash
diskio.mark_of_the_web
diskio.minimize_kernel_caching
diskio.all_writes_sync
cache.override
cache.override_size
cache.reduce
cache.write
cache.writeout
cache.writeimm
cache.read
cache.read_turnoff
cache.read_prune
cache.read_thrash
Error: COMPACT_NOT_FOUND. P=%d,T=%d
** FileStorage::SetFolderRoot(%S) failed with _folder '%S'
** FileStorage::SetFolderRoot(%S) failed: _folder is NULL or empty.
** FileStorage::SetFolderRoot(%S): setting for folder '%S'
Warning: Delete to trash failed for %S. Error: %d. Deleting permanently.
"to_trash":%d, "error_code":%d
%s:%H:%d:%s
µTorrent Search
js%d();
HTTP/1.0 200 OK
%s/%s(%d)(%s)
features/device_pairing/supported_types
Can't install web UI archive version (%d)
Can't install default UI version (%d)
version.txt
{ "name": "%s", "version": %s }
GET /favicon.ico
Can't accept non-IPv4 address as IP match for %s
Can't match using invalid subnet mask %s
Found valid subnet mask %s %x
Ignoring filter IP containing invalid CIDR notation %s
IP matches IPv4 restriction %s%s%s
Can't match using IPv4 filter %s%s%s mip %x mask %x
Can't accept non-IPv6 restriction address %s
IP matches IPv6 restriction %s%s
Can't match using IPv6 filter %s%s
Can't support device pairing request lacking a PIN
Can't support invalid PIN '%s'
Can't support invalid PIN value %Ld
Can't support device pairing type '%s'
http://apps.bittorrent.com/torque/pairing/style.%s%scss

%s wants access to %s

If you click yes, this site will have access to your data

HTTP: IP %a: GET %.200s
HTTP: IP %a: Blocked: GET %.100s
"headers": { "Content-Type": %s
, "Set-Cookie": %s
"html":%s
"error": %s
,[%S,%J,%J,%I,%I,%I,%B,%I,%I,%I,%I,%J
,[%s,%s,%s,%I,%I,%S,%S,%I,%I,%I,%I,%I,%I,%I,%I,%I,%I,%I,%I,%I,%I,%I]
autoexec_hide_ui
Can't accept value '%s' for torrent property '%s'
Can't accept overflow value '%s' for torrent property '%s'
Can't accept negative value '%s' for torrent property '%s'
Can't accept value '%s' for unknown torrent property '%s'
{"hash": %s
,"trackers": %S
,"autoexec": %I
,"autoexec_hide_ui": %I
password
,"code": %I, "message": %s
Can't recognize torrent hash '%s'
Can't accept file number '%s'
Can't use file number '%s' - invalid for selected torrent
{"name":%S, "hash":%H, "sid":%s, "complete":%B, "completed_on":%J, "primary_label":%S, "files": [
{"name":%S, "fileno":%J, "length":%J, "complete":%B, "type":%s, "fullpath":%S,
{"name":%S, "fileno":%J, "length":%J, "complete":%B, "type":%s,
"codecs": [%s,%s]
{"name":%S, "fileno":%J, "media":%s, "length":%J, "complete":%B, "type":%s,
,"error": %S
add-url
get-url
add-unknown-url
Ignoring setting %d name %s value %s
{ "name": %s
app_update_url
,[%s,%I,%S,{"access":%s}]
, {"path": %s, "available": "%J"}
webui
, %s : [
, "name" : %s, "version" :
,{"guid":%s, "created":%J, "updated":%J, "peer_ip":%a, "sock_ip":%a, "reported_ip":%s, "user_agent":%s, "persistent":true, "custom":%s }
,{"guid":%s, "created":%J, "updated":%J, "peer_ip":%a, "sock_ip":%a, "reported_ip":%s, "user_agent":%s, "persistent":%B, "custom":%s }
Can't log out session - invalid GUID %s specified
Can't log out requester's session %s
%s out current session %s
[%S,%s,%s]
,"token": %s
Can't accept configuration change from other than administrative login
webui.uconnect_question_opted_out
webui.uconnect_username
webui.uconnect_password
webui.uconnect_enable
, "movetorrent":{"target":%S, "status":%d}
[%H,%I,%S,%J,%I,%J,%J,%I,%I,%I,%I,%S,%I,%I,%I,%I,%I,%I,%J,%s,%s,%S,%s,%J,%J,%s,%S,%I,%s]
[%S, %I]
[%I,%B,%B,%B,%B,%I,%S,%I,[
[%S,%S,%s,%I,%I,%J,%I,%I,%I,%I,%B,%B]
[%I,%I,%S,%S,%S,%S,%I,%I,%S,%I,%I,%I,%I,%S,%B,%B]
getmsg
%s({"encbody":"
,"GUID":"%s"
,"x-bt-seq":"%s"
.html
token.html
HTTP/1.1 304 Not Modified
Please wait while the µTorrent WebUI is installed... You will be automatically redirected.
index.html
The µTorrent WebUI does not seem to be installed. Click here to try to install it, or see the guide for more details.
index.html?error=1
There was a problem installing µTorrent WebUI, please see the µTorrent log for more details.

download_webui
HTTP/1.1 404 Not Found
%s({response:%s, guid:"%s"})
%s({ "sessionid": "%s", "message": "%s", "code": %d })
%s({ "message": "%s", "code": %d })
Can't create session for device ID %s
Can't accept remote pairing key
Can't accept device pairing key '%s'
Can't process pair connection authentication request without pairing key
/gui/guest.html
Unable to listen for HTTP traffic on port %d
Unable to listen for HTTP traffic on v6 port %d
%s({ "pairing_key": "%s", "pairing_type": %d, "code": %d })
http://www.google-analytics.com
POST /collect HTTP/1.1
psapi.dll
BaseCreateTorr::OnDoneBitrate: error(%s): %u
BaseCreateTorr::OnDoneBitrate: parse error(%s): %u
BaseCreateTorr::OnDoneBitrate: success(%S) rate=%u, duration=%u, width=%u, height=%u
http://%s/talon/seed/%S/content/%x
[%u] log closed
rss_feed_url
supported_msgs
streaming_url
JS> %S
webui.restrict
Setting value of setting %s key %d to %s
UDP setsockopt(SO_RCVBUF, %d) failed: %d
UDP setsockopt(SO_SNDBUF, %d) failed: %d
DEBUG: ICMP%s is not available on this platform
webui.enable
webui.enable_guest
webui.enable_listen
webui.token_auth
webui.token_auth_filter
webui.username
webui.password
webui.hashword
webui.uconnect_hashword
webui.uconnect_username_anonymous
webui.uconnect_hashword_anonymous
webui.uconnect_computername
webui.allow_pairing
webui.salt
webui.guest
webui.port
webui.cookie
webui.pair_hashes
webui.download_folders
webui.raptor_host
raptor.utorrent.com
webui.raptor_port
webui.raptor_secure
webui.talon_host
remote.utorrent.com
webui.talon_port
webui.talon_secure
webui.uconnect_toolbar_ever
webui.uconnect_enable_ever
webui.uconnect_connected_ever
webui.uconnect_actions_count
webui.uconnect_actions_list_count
webui.uconnect_cred_status
webui.update_message
webui.proxy_auth
webui.update_url
http://pr.apps.bittorrent.com/client-webui/3.4/client-webui.json
239.255.255.250
Created SSDP UUID %s
The external port cannot be wild-carded
The port mapping entry specified conflicts with a mapping assigned previously to another client
Internal and External port values must be the same
The NAT implementation only supports permanent lease times on port mappings
ExternalPort must be a wildcard and cannot be a specific port
UPnP: Discovered host: %s
UPnP: Checking cached host %s
UPnP: Cached host %s (%I) is not part of our subnet %I/%I.
UPnP: Queueing cached host %s
UPnP: Unable to bind to UPnP port: %d
UPnP: Joined multicast group
M-SEARCH * HTTP/1.1
HOST: 239.255.255.250:1900
NOTIFY * HTTP/1.1
LOCATION: http://%A
SERVER: %s/%s UPnP/1.1 %s/%s
NTS: %s
USN: uuid:%s
FRIENDLYNAME:%S
HH:%s
%s(%s)(%s)
CACHE-CONTROL: max-age = %d
LOCATION:http://%A
USN:uuid:%s
recvfrom ERROR: %d
UPnP: Found location from upnp notify: %s
urlbase
controlurl
eventsuburl
scpdurl
NewExternalPort
NewInternalPort
http://%s:%d/%s
UPnP: The device "%s" is not a UPnP router (%s)
AddPortMapping
DeletePortMapping
GetGenericPortMappingEntry
%d%s%d%I1%s (%s)0
%d%s
%d
GET %s HTTP/1.1
Host: %s:%d
HOST: %s:%d
CONTENT-LENGTH: %d
SOAPACTION: "%s#%s"
%s port %d -> %I:%d
%s port %d
UPnP: %s is already mapped. Not re-mapping.
UPnP: Removed %s
UPnP: ERROR removing %s: (%d) %s
UPnP: Mapped %s
UPnP: %s mapped successfully.
UPnP: Host '%s' added to cache.
UPnP: ERROR mapping %s. Deleting mapping and trying again: (%d) %s
UPnP: ERROR mapping %s: (%d) %s
UPnP: Device error "%s": (%d) %S
UPnP: Could not map UPnP Port on this pass, retrying.
UPnP: Could not detect external IP on this pass, retrying.
UPnP: Unable to map port %I:%d with UPnP.
Unsupported Version
Not Authorized/Refused (e.g. box supports mapping, but user has turned feature off)
Unsupported opcode
NAT-PMP: error: %s
NAT-PMP: %s %s port %d -> %I:%d
NAT-PMP: Unable to map port with NAT-PMP.
keys
,"os":"%d.%d.%d.%d.%d.%s"
msg_type
8:msg_typeiÞ
3:numiÞ
6:filter%d:
255.255.255.255
UTP_GET_UDP_MTU
UTP_GET_UDP_OVERHEAD
%sversion-%s
http://utorrent.com/webui/webui-%s-%s.zip
Web UI archive entity tag '%s'
Could not match any version from json %s
Attempting to download file %s to %S
Attempting to download web UI archive from %s to %S
Moving %S to %S
Moving %S back to %S
Attempting to read archived file %s
%p %s d %s
MTU [PROBE] floor:%d ceiling:%d current:%d
MTU [PROBE-TIMEOUT] floor:%d ceiling:%d current:%d
Packet timeout. Resend. seq_nr:%u. timeout:%u max_window:%u cur_window_packets:%d
MTU [DONE] floor:%d ceiling:%d current:%d
MTU [RESET] floor:%d ceiling:%d current:%d
Packet %u lost. Resending
actual_delay:%u our_delay:%d their_delay:%u off_target:%d max_window:%u delay_base:%u delay_sum:%d target_delay:%d acked_bytes:%u cur_window:%u scaled_gain:%f rtt:%u rate:%u wnduser:%u rto:%u timeout:%d get_microseconds:%I64u cur_window_packets:%u packet_size:%u their_delay_base:%u their_actual_delay:%u average_delay:%d clock_drift:%d clock_drift_raw:%d delay_penalty:%d current_delay_sum:%I64ucurrent_delay_samples:%d average_delay_base:%d last_maxed_out_window:%I64u opt_sndbuf:%d current_ms:%I64u
MTU [DUPACK] floor:%d ceiling:%d current:%d
MTU [ACK] floor:%d ceiling:%d current:%d
UTP_Connect conn_seed:%u packet_size:%u (B) target_delay:%u (ms) delay_history:%u delay_base_history:%u (minutes)
MTU [ICMP] floor:%d ceiling:%d current:%d
%A: [%s (%:.1d)] picked no blocks
%A: [%s (%:.1d)] picked %u blocks, first: %u
8:msg_typei%ue
5:piecei%ue
5:added%d:
7:added.f%d:
6:added6%d:
8:added6.f%d:
7:dropped%d:
8:dropped6%d:
ut_app_%s
d1:eiÞ
12:complete_agoiÞ
11:upload_onlyiÞ
%d:ut_app_%siÞ
11:lt_donthaveiÞ
12:ut_holepunchiÞ
11:ut_metadataiÞ
6:ut_pexiÞ
10:ut_commentiÞ
13:metadata_sizeiÞ
1:piÞ4:reqqiÞ%s1:v%d:%s2:ypiÞ
%s: scrape response had %d torrents, request had %d
unsupported action
UDP Tracker disabled
UTrackAnnounce(%s) called.
UTrackScrape(%s) called.
UDP Trackers disabled.
Invalid tracker URL.
Windows
OS info: name %s release %s version %s machine %s
** Generated %d character session cookie: GUID=%s
reported_ip
global_key
Searching for device pair session with id %s
Can't accept id %s as a GUID
UPnP(XP): Removed TCP port %d
UPnP(XP): Removed UDP port %d
UPnP(XP): %s port %d -> %I:%d is already mapped. Not re-mapping.
UPnP(XP): %s port %d -> %I:%d mapped successfully.
-----BEGIN CERTIFICATE-----
com.bittorrent
%s trusted
5:owner%d:%s4:text%d:%s9:timestampi%Lde4:likeiÞ
239.192.152.143
BT-SEARCH * HTTP/1.1
Host: 239.192.152.143:6771
Port: %u
Infohash: %s
port:
CbDP.jR6YD6wAj2ByQWxQxQZ7.9J9xkn2.Uqb3zVm16vQyizprhBw9hi80psatZ8k54vwZfiIeEHZVsDnyqeWSSIpWso.wh5GD4OFgdhVI3
iqJ7nFZ4bGCRjE1F.FXEwL085Zb0kLM2TdHDaVVCdq0cKxvnH/0FLskJTKlDtt6sDl89dc//aEULTVFGtcbA/tDzc.bnFE.DWthQOu2n2JwKjgKfgCR2lZFWXdnWmoOh
Ewl2hcjiutMd3Fu2lgFnUXWSc67TVyy2vwYCKoS9MLsrdJVT9RgWTCuEqWJrfB6uE3LsE9GkOlaZabS7M29sj5TnzUqOLJMjiwEzArfiLr9WbMRANlF68N5AVLcPWvNx6Zjl3m5Scp0BzJBz9TkgfhzKJZ.WtP3Mv/67I/0wmRZ
F//////////oG/QeY5emZJ4ncABWDmSqIa2JWYAPynq0Wk.fZiJco9HIWXvZZG4tU.L6RFDEaCRC2iARV9V53TFuJLjRL72HUI5jNPYNdx6z4n2wQOtxMiB/rosz0QtxUuuQ/jQYP.bhfya4NnB7.P9A6PHxEPJWV//////////
3NUKQ2Re4P5BEK0TLg2dX3gETNNNECPoe92h4OVMaDn3Xo/0QdjgG/EvM.hiVV1BdIGklSI14HA38Mpe5k04juR5/EXMU0r1WtsLhNXwKBlf2zEfoOh0zVmDvqInpU695f29Iy7sNW3U5RIogcs740oUp2Kdv5wuITwnIx84cnO.e467/IV1lPnvMCr0pd1dgS0a.RV5eBJr03Q65Xy61R
dUyyhxav9tgnyIg65wHxkzkb7VIPh4o0lkwfOKiPp4rVJrzLRYVBtb76gKlaO7ef5LYGEw3G.4E0jbMxcYBetDy2YdpiP/3GWJInoBbvYHIRO9uBuxgsFKTKWu7RnR7yTau/IrFTdQ4LY/q.AvoCzMxV0PKvD9Odso/LFIItn8PbTov3VMn/ZEH2SqhtpBUkWtmcIkEflhX/YY/fkBKfBbe27/zUaKUUZEUYZ2H2nlCL60.JIPeZJSzsu/xHDVcx
2iQzj1CagQc/5ctbuJYLWlhtAsPHc7xWVyCPAKFRLWKADpASkqe9djWPFWTNTdeJtL8nAhImCn3Sr/IAdQ1FrGw0WvQUstPx3FO9KNcXOwisOQ1VlL.gheAHYfbYyBaxXL.NcJx9TUwgWDT0hRzFzqSrdGGTN3FgSTA1v4QnHtEygNj3eZ.u0MThqWUaDiP87nqha7XnT66bkTCkQ8.7T8L4KZjIImrNrUftedTTBi.WCi.zlrBxDuOM0da0JbUkQlXqvp0yvJAPpC11nxmmZOAbQOywZGmu9nhZNuwTlxjfIro0FOdthaDTuZRL9VL7MRPUDo/DQEyW.d4H.UIlzp
///////////93zgY8MZ2DCJ6Oek0t1pHAG9E28fdp7G22xwcEnER8b5A27cED0JTxvKPiyqwGnimAmfjybyKDq/XDMrjKS95v8MrTc9UViRqJ4BffZVjQml/NBRq1hVjxZXh.rg9dwMkdoGHV4iVvaaePb7iv5izmW1ykA5ZlmMOsaWs75NJccaMFwZz9CzVWsLT8zoZhPOSOlDM88LIkvxLAGTmbfPjPmmrJagyc0JnT6m8oXWXV3AGNaOkDiuxuvvtB1WEXWER9uEYx0UYZxN5NV1lJ5B9tYlBzfLO5nWvbKbywfLgvHNI9XYO.WKG5NAEMeggn2sjCnSD151wCwXL8QlV7BfaxFk515ZRxmgAwd5NNGOCVREN3uMcuUJ7g/MkZDi9CzSUZ9JWIYLXdSxZqYOQqkvhyI/w1jcA26JOTW9pFiXgP58VAnWNUo0Ck.4NLtfXNMnt2OZ0kjb6uWZYJw1qvQinGzjR/E3z48vBWj4WgJhIol//////////
F//////////oG/QeY5emZJ4ncABWDmSqIa2JWYAPynq0Wk.fZiJco9HIWXvZZG4tU.L6RFDEaCRC2iARV9V53TFuJLjRL72HUI5jNPYNdx6z4n2wQOtxMiB/rosz0QtxUuuQ/jQYP.bhfya4NnB7.P9A6PHxEHRFS80VBYXOxy5cDf8DXnLqvff5Z.e/IJFNuDbNIFSewsM76BpLY25KhkUrIa7S9QMRMSCDKvAl9W4yNHi2CeO8Nmoa5v6BZREE.EUTomO3eO3coU3ekm7ee.rnLtmRqnIoTuho/QLM1SOEPL9VEgLQkKLqYOOcFe541LoZbgAgiGjhJCN3GHGUZEeLI6htnowPEpxXGHOs.yAYkfnLrq637spbm.5fk7anwlrhepR2JFN7eoKu4ebOPtEuz8c6jBkQ/4l.WRPYWXas7O2Spx8QcHI7oiO5tiW3BlX5rTwOLriTmc8mBhPHk88ua.WTEMhCKFRM/pW/H2EIuBH8AaX204QSZmIfuVcruXncX2zkbiccSCd66hquZmQb6WqjXKBsYM3wSegr4pesxl2smJUZlakZlmK7xxAfYXyMKTEQy1TcRAMJw2Gmw8ZEw66KLldxHzXAN3EujUlk1lTTY5mI1pG1f4drR1QgPEqwfYDZzt1Xl.tt92cm8zDz3N9D0OncV//////////
///////////93zgY8MZ2DCJ6Oek0t1pHAG9E28fdp7G22xwcEnER8b5A27cED0JTxvKPiyqwGnimAmfjybyKDq/XDMrjKS95v8MrTc9UViRqJ4BffZVjQml/NBRq1hVjxZXh.rg9dwMkdoGHV4iVvaaePb7iv5izmW1ykA5ZlmMOsaWs75NJccaMFwZz9CzVWsLT8zoZhPOSOlDM88LIkvxLAGTmbfPjPmmrJagyc0JnT6m8oXWXV3AGNaOkDiuxuvvtB1WEXWER9uEYx0UYZxN5NV1lJ5B9tYlBzfLO5nWvbKbywfLgvHNI9XYO.WKG5NAEMeggn2sjCnSD151wCwXL8QlV7BfaxFk515ZRxmgAwd5NNGOCVREN3uMcuUJ7g/MkZDi9CzSUZ9JWIYLXdSxZqYOQqkvhyI/w1jcA26JOTW9pFiXgP58VAnWNUo0Ck.4NLtfXNMnt2OZ0kjb6uWZYJw1qvQinGzjR/E3z48vBWj4WgI480HfoF1AdX.RNY76Q4BswMoQPmoSOQlJYF1gKQ3Is5GlQ9OFfoYhKJEZRkyBR1DwE.IwE/1GVligcA7nPHqvhm5sPifPFe933eYCxeOPHM.Vj7s4fSCxYrw.u6zrs8N187D06aIVLi5gfaxJgc8sFtS66/xVSaAR0ZqtqDSaq0eIIDiFwjD9yS2R1rDooO2P6tibr7dOzkZUz.F.K1gsUKmxbspWlGJ01hh1gK.sG9zWn5vSdi8PQYHZQFjlhpviKxKJERBhErBiRstyKH.RC9Kip855HAzUlGc.uz04tZDA/MOFA0SPBakpmCkeLqN8T0/I2ryvkTFxsrLvmBqQO38Arg40na0iSdbddoN..n.Zp8wbwVZRCYBuF7KMt/rXQnKlK1x8hGLIgp8zjVhz8uTWKp5xI3u0tuAUN5Uxoc.Ce1g7LYxV5sdRrKAezYX./yEiPpB6Z4zLSsbR9x2xobZ8uV.ZNRZm4Q0G.ZsO/I63k4hyjMmjqTDRcbFaURSn09F//////////
3//////////yaFsg8XQC8qnCPYYu3S7D4f0au8YcVCT08BlgOx4viYKKe8UOuq1DtlbHcppJf36p0h2ctoNnGtJ.4rRMrHmaNaXRLsObv.nlHCGkccD.rh2/zSjlG6j.tkE6lxMecVfQwV915yIn/cIIXcKUpaMpt207oueME/1PZQI3OSLTEQQHO/gFqapr.3PLqZtAEjbXnYyrOWXLAxdjKf1t2Mbcrd33LEIhoO1F5qR0ZA625yCf1UHYuspZlZddSi60w60vidWwBi1wAFjSLTy6zCKidUAylsbLWN63cLINpgbMhb5T8c69Zw1H0LSevQYgh4BQqp5mq4K7epg5KXgzySkcJi.uK4MDll2ehgSLTT1WnzivSFXQRXvCUhzQwCsmaprnwCbE1A9M6TpkFI9XhIxclnB/e6sOe8PDXs0dC.o6faKXyh61Tx80oxuHTNUc5TR7S9YC2wsKRY2E9Fe7Jbgp53srlyuFqGZak2qI2f8GW16d8y4gU7vjU8SPeGlRfR9fd39nXgzE8y6fHeDBOL2zebW.dAAjHCwDkxmji4texvBexy51..ogOeV5b7Jcl0NPcoba.WaCEY8pkXXb5Rv.qVOIbmpkBNhxWRtNOXS4WSq0QH9zMmMgcJjEgOZO/TmOR/jzoGfi2FJVGroJG2X98sm/gqqdnm9i7KtB9W9aRUoNKUTZswDxtu/vG6hPvJ3kNRE2z1C06ki6fJxP0ds34NboUmXbg96De.s.lFcnJjHCvikixKknlRVnH7vimbIpCWKL4hrwz2RxZq0JUCqhzPWye1nakIxF0owXNHSXq3z8BNpcvq/lRLNd0lHfWCWhMeG36G2noUMUV9Vxx7wFCZgNf.Dio8lWyTHRV/M5h5IzG7iYj1LAhCZsr.lqZXs1JCNj8FW3VWfvSLxlARuoW6eTMBjyNQTlLGgZsA7x/mwndCiQCJrLpQLidiBlAMCZX/wDTkF0He13wFPZz8OEuIlorR2tHqrkQK.HvjlX5PTAEIRnB.vUGuTtosgJBVZDY.nD1pkJ6wEyWojesTqm1q7wU/Yln7xILszfDhf2HcEgjZd5hazMWq8xHqA/79U2EF5ilZdMKju/sullo4YjaY8Yu4f0Dy1nFhLwWQ8/37D7FyP6pgC6jBoyY6BuE5tVgTIt.Ym8VeUMWp0.rRtJe6Appriw9ufcqg4/W/HFWjtp4Eu7IhQZP5b.YPe2LTmMJp7CK8HeKT.Qj86LtjVg6nrH2zVkTDS/hpQyCUpw9eDP16zEk7dv902KEBI1niruYQ02xLxZWhoHaDflm2RaULMEH7LdVfgfumKE9sLfJVo1zMw82vRd5WoO3TcEtJt///////////
TEMP_PASSWD.conf
TEMP_PASSWD
.btskin
AVI header too large in %S
Can't find AVI header chunk in %S
Cookie: %s
%s/%s/%s
%s%s/%s
4:port
12:implied_porti1e
DHT: %s
Num buckets: %d. My DHT ID: %s
Bucket %d: %.8X%.8X%.8X%.8X%.8X (nodes: %d replacement-nodes: %d, span: %d)
%dm %ds
Total peers: %d (in replacement cache %d)
Outstanding add nodes: %d
%d: %s/%s: %d peers
Total peers: %d
Total torrents: %d
5:nodes%d:
1:vliÞiÞiÞiÞiÞe
1:t%d:
1:v4:%c%c%c%c
1:n%d:%.*s
d1:eli%ue%zu:%se
1:k%d:
3:sig%d:
%d:%s
5:token%d:
4:voteiÞ
implied_port
invalid object key (must be a string)
object key and value must be separated by a colon (':')
after key and value, inside map, I expect ',' or '}'
function not supported
operation canceled
address_family_not_supported
operation_in_progress
operation_not_supported
protocol_not_supported
operation_would_block
address family not supported
broken pipe
inappropriate io control operation
not supported
operation in progress
operation not permitted
operation not supported
operation would block
protocol not supported
Visual C   CRT: Not enough memory to complete call to strerror.
Operation not permitted
Inappropriate I/O control operation
Broken pipe
GetProcessWindowStation
operator
http://%s
http://www.mybrowserbar.com/images/pixel.gif?tb=1&cnid=%d
/cnid \"%d\" %s
http://download.mybrowserbar.com/kits/sds/SearchProtectionSetup.exe
--IEClientSite::PixelCallback error: %S
.bittorrent.com
.utorrent.com
cleverbridge.com
.cleverbridge.com
&&&&6666????
""""****
2222::::
$$$$\\\\
00006666
####====
0123456789
y:\jenkins\utbuildslavetest\ut_win\Build\Win32\Release\utorrent.pdb
About %s
Publisher: %S
Release Date: %S
Version: %S
Description: %S
Update URL: %S
A single purchased copy of %s Plus can only be installed on a set number of computers. This copy has been installed on too many different computers.
Please either purchase a new copy for this computer, or contact us at http://help.bittorrent.com if you think you're getting this message in error.
The directory you chose is not on the same drive as the %s client. It will not come along when you move the USB drive. Are you sure you want to continue?
Would you like to add "%s" to your search list?
%s application %s failed to copy to %s
This app was downloaded from %S
Installing %s
This %s app was downloaded from a website.
Title: %s
Are you sure you want to open the containing folders for %d torrents?
Are you sure you want to open the converted files for %d torrents?
Are you sure you want to open %d torrents?
Unable to find '%s'.
Error '%s' while downloading URL.
The contents of this torrent were verified to be free of viruses and spyware on %s
All files (*.*)
The app '%s' is requesting access to:
%s%s%s%s%s%s%s%s%s%s
Missing update url
Missing index.html
GetContentFile() does not contain [btinstall.txt]
App load failed (%s)
BtApp does not contain index.html
Are you sure you want to add %d torrents?
The installation of "%s" is complete
Can't open .torrent file: %s
Warning: Delete to trash failed for %s. Error: %d. Deleting permanently.
Failure: %s
Executing: %s
Unable to load "%s": %s!
Unable to save .torrent to '%s'.
Warning: %s
Checking auto portmap configuration ...
Checking queue ... we are #%d.
Unable to save to '%s'.
The directory you have selected contains more than 1000 files. The resulting .torrent will get very large. A better idea is to put the files into a compressed file and then share that file.
Please enter a valid tracker URL. Do you want to continue without having any trackers?
There was an error computing the hash: (%d) %s
The tracker protocol is invalid. udp, http and https are the only valid ones. Do you want to continue without having any trackers?
*.torrent
You have selected to share your entire My Documents folder and all its files. It is not advisable to do so unless you are certain you want to share all the contents, including possibly private documents.
The file or directory '%s' cannot be found. Please enter a different filename. Note that you can't share the root of a drive.
Select where to save the .torrent
Let Windows decide based on media type
%u Ratings
Click here to learn more about BitTorrent Certified devices
http://www.bittorrent.com/certified-devices/
Plug USB into BitTorrent Certified playback device
Stream to BitTorrent Certified MOVE device
Make media playable in BitTorrent Certified devices
Check out these apps to experience %s\u00ae on tablets, mobile devices and more
Simple, secure access to your %s client on any device
%s\u00ae For Android
%s\u00ae For Mobile
%s\u00ae Remote
Webpage
BitTorrent Certified Device
BitTorrent Certified
Feed URL:
Enter Password
Web Seeds:
Website:
Website
Portable mode
The following options automate the configuration of some additional settings in Windows.
Torrent in Windows Firewall
Torrent when Windows starts up
.torrent (BitTorrent files)
.btsearch (BitTorrent Search Engine files)
Add Torrent from URL
Please enter the location of the .torrent you want to open:
Windows Integration
Torrent when Windows Starts
&Boss-Key:
Use Boss-Key password
Location of .torrents
Store .torrents in:
Move .torrents for finished jobs to:
&Automatically load .torrents from:
&Delete loaded .torrents
Listening Port
Port used for incoming connections:
Random port
Enable &UPnP port mapping
&Randomize port each start
Enable &NAT-PMP port mapping
Add Windows &Firewall exception
Password:
Disable connections unsupported by the proxy
Apply rate limit to transport overhead
Enable UDP tracker support
IP/Hostname to report to tracker:
Enable &Web UI
&Password:
Alternative &listening port (default is the connection port):
Just enable the connection below, choose a computer name and password and remember to leave this computer on.
Visit http://remote.utorrent.com/ and enter this computer name and password.
%1 stands for the command which is the chosen streamable file outputted by the build-in local loopback http server. You could add extra parameters for the player you selected.
Note: Web player may not support streamable files except avi.
Search Engines [Format: name|URL]
Current Port: (0:random)
Automatic Port Mapping (Recommended)
&Run speed test at: www.dslreports.com
Current Port: [0: auto]
&Test if port is forwarded properly
We recommend downloading a clean version directly from the content provider's website.
Web Seeds
%F - Name of downloaded file (for single file torrents)
%D - Directory where files are saved
%S - State of torrent
Update URL
A newer version of uTorrent, %d.%d.%d build %d is already installed. Would you like to downgrade to %d.%d.%d build %d?
Downloading %s ...
Failed to download your plus licence key. Please try again
unsupported piece size (%Z)
unsupported torrent size (%Z)
ffmpeg Process aborted with error %d. Unknown error
More information may be found in the transcript log at %%appdata%%\%S\media
File move target %s already exists. Overwrite?
Search the web for content
A web page showing results will launch
But you can alternately copy and paste Torrent URLs into the client.
There was an error opening %s.
There is no media player associated with the %s%sfile type.
Today is your lucky day! By entering your email you will be able to automatically unlock more free stuff from %s.
Before you delete %s, have you unlocked all the free content? One click and you'll get more.
The BitTorrent Bundle %s has new content available. Click update to get the new content!
The BitTorrent Bundle %s has new content that just downloaded. View the new content by clicking below!
You will leave uTorrent and your browser will open to unaffiliated Web sites.
%#Z (%d hashfails)
%d x %#z (have %u)
scrape not supported
%d of %d connected (%d in swarm)
Grid: %d days
%d days
Time (%s step)
Could not download help file. Error: %s
Invalid redirect (%S)
invalid http reply
invalid URL
Too many redirects (%S)
Installing %s ...
By clicking "I Agree", you acknowledge that you have read and agree to the End User License Agreement and Privacy Policy.
Beware of online scams! A number of websites have taken our free uTorrent client and attempt to charge money for it through some sort of "fee" or "subscription" or else they install it for free but infect your computer with malicious code in the process. To protect yourself, be sure to only download our software from http://www.utorrent.com. You should NEVER under any circumstances pay for free uTorrent software.
Unsupported Operating System (OS)
This wizard will guide you through the installation of %s
Version: %s (Build %s) by BitTorrent, Inc.
This wizard will guide you through the installation of the official %s
Version: %s (Build %s)
%s does not not support the Windows 2000 OS and may not
a newer Windows OS.
error: %d
Kill hanging %s processes?
There were errors loading the language file. Please see the file uTorrent.exe.log in the application directory.
The install of %s failed.
Log WebUI requests
Unable to copy .torrent from '%s' to '%s': (%d) %s
Choose where to download '%s' to:
Choose where to save %s
Failed to connect to %s Remote because your client is not compatible.
Some software installed on your computer prevents %s
from working properly. This is possibly caused by the following DLLs '%S %S'
Last %d days
(Login)
DHT: %d nodes%s
Torrents (*.torrent)
%s detected '%S' (%S) appears to be installed on your computer. That is known malware, and might cause %s to crash or behave strangely, including but not limited to using up all your RAM and freezing. Please run a virus/malware checker.
Would you like to make %s the default torrent application?
You appear to be running version d.d of the NVIDIA Network Access Management tool.
This version has known issues which may create problems with %s.
Please upgrade your NVIDIA software to at least version d.d.
Are you sure you want to exit %s?
Registration failure%S%S
Failure reclaiming account%S%S
Failure registering security question%S%S
D: %s%z/s
U: %s%z/s
Select a .torrent to open
%s: ERROR MSG: %s
%s: ERROR: received message type %d (expected %d)
Transferred last %d days: %#Z
Total Running Time: %d:%.2d:%.2d
Number of torrents added: %d
Program launched: %d times
Last launched: %s
# incoming conns since start: %d
# outgoing conns since start: %d
# handshake: %d
# connections: %d
# uTP connecting: %d
# TCP connecting: %d
# half-open: %d (%d queued)
Disk Cache overloaded %d %%
You should change the listen port.
A firewall/router is limiting your network traffic. You need to open up a port so others can connect to you.
%d(%d) downloading, %d(%d) seeding
D:%s U:%s - %s
Select a .torrent to update to
Be sure to exit %s before you unplug the USB drive!
Failed to connect to %s Remote %S%S%s
Press "OK" to review your login settings.
Failed to connect to %s Remote because the username or password was wrong.
Would you like to register a new account under the name "%S"?
Add Torrent from &URL...
&Bundle Webpage
Test hang report
Torrent &Webpage
%s - %z/s
%s %#Z of %#Z
%s - %s remaining
%s - Initializing download
%s - WARNING: Possibly insufficient sources
&Delete .torrent
D&elete .torrent   Data
Open URL in Bro&wser
Remove and d&elete .torrent   Data
Error moving file: %S (%d)
Failed to relocate file %s, %s
Today is your lucky day! %s will automatically update periodically - with new content delivered right to you.
In order to gain access to any free updates from %s, you have to keep it in your queue. Easy, right?
Bad port number
Bad Port number received
Checking for forwarded port
Server does not support this client
%s error: %s (%d)
Problem reading web100 variables.
Float denormal operand
Float invalid operation
Add Url
Bw.Alloc
Source URL
Are you sure you want to remove the %d selected torrents%s?
Are you sure you want to remove the selected torrent%s?
unsupported
Error: %s
Flushing to disk (%d)
Ready in %s
%d days ago
%d hours ago
%d minutes ago
%d months ago
%d weeks ago
%d years ago
Failed to connect to %s Remote. This appears to have happened because you are running a peer blocking application such as PeerGuardian or PeerBlock. These programs are not currently compatible with %s Remote. You should either disable your peer blocking application, or disable %s Remote.
Port
Upgrade to %s Plus to protect yourself from viruses hiding in torrents.
Upgrade to %s Plus to convert this file so it can be played.
Port Forward test complete. %s
Results: Port not open.
%u Comments
RSS: Feed already exists "%s"
Really delete RSS Feed "%s"?
Open URL in &Browser
Date of last match: %s
Last episodes matched: %s
Really delete RSS Filter "%s"?
Really delete %d history entries?
RSS: Smart filter has rejected "%S"
RSS: Unable to load "%S": %s
RSS: Unable to download "%s": %s
Failed to disconnect correctly. Error %d
Could not establish secure connection. Error %d
Could not initialize security context. Error %d
Could not decrypt data. Error %d
Could not send data. Error %d
Could not encrypt data. Error %d
Could not validate server cert chain
Transfer files converted for BT Certified Device.
The file '%s' could not be read.
The file '%s' could not be written to.
The file '%s' is in use by another process and can't be opened.
The file '%s' was not found.
Unknown error opening file '%s'
The file '%s' has been recovered.
You have to restart %s for the changes to take effect.
Executable (*.exe)
*.exe
More info is in the FAQ and at portforward.com
PostMessage failed h:%d i:%d t:%d e:%d
Results: Port is not open (you are still able to download).
Port mapping will speed downloads and enable seeding. More info in FAQ and at portforward.com
Results: Port is open. Your network is properly configured.
This test will use Measurement Lab tools to check and set your bandwidth limits.
If no location is near, you can test at dslreports and input your upload speed.
%s Setup Guide
%s Bandwidth Configuration
%s will test your network and configure itself for best performance.
Please enter a valid port number from 0-65535.
This is a likely service port. Please choose another.
(You can change this setting in bt.no_connect_to_services_list)
Tried to redirect to invalid url
Will redirect to URL: %S
Automatic Shutdown will initiate in %d seconds.
Hibernating computer... %s
Restarting computer... %s
Shutting down computer... %s
Stand-by computer... %s
(Alternate speed test at dslreports)
TCP upload rate
TCP download rate
import
TCP upload rate limit
TCP download rate limit
%s is still starting up
Web UI
HTTPS
Contains: "%s"
This operation cannot be undone.
A security question can be used later to transfer your %s Remote username to another computer. Would you like to create one now?
Ý %dh
%dh %dm
%dw Ý
%dy %dw
Enter the IP:port / [IPv6]:port of the peer to add:
Executable files (*.exe)
Download Complete|%s has finished downloading.
New Bundle Release|"%S" released the new bundle, click to review.
New Download from RSS|%s has started downloading.
New version|A new version of %s is now available!
!Error|There is not enough disk space to move %s to its final location
!Torrent Error|File: %s
Can't accept %S with invalid character '%S'
Can't accept %S with length %u greater than %d characters.
Please enter a %S.
Are you sure you want to remove the %d selected trackers?
You must enter a password to use %s Remote.
Could not contact the %s Remote service to register.
There is already a computer using the username "%S".
That was not the correct security answer for the username "%S". Try again.
Status: Reconnecting in %d seconds
Status: failed to load Secur32.dll or Security.dll
Uninstalling %s ...
Are you sure you'd like to uninstall %s?
This will remove the %s app only. None of your in-
%s failed to update. Please try again.
%s update failed. Unable to start the new process.
failed to launch exe %s
failed to acquire mutex %s
attempted downgrade %x -> %x
mismatching exe versions
%s Upgrade
This wizard will guide you through the %s upgrade process.
Updates are now build into %s, so you'll always have the latest and greatest stable version of the software including security enhancements, bug fixes and new features.
Updates are now built into %s, so you'll always have the latest and greatest stable version of the software including security enhancements, bug fixes and new features.
This wizard will guide you through the upgrade of %s by BitTorrent, Inc. - the world's premiere, feature-rich torrent client.
Password did not match.
Could not download WebUI file. Error: %s
Could not download WebUI information. Error: %s
WebUI file not found - attempting to download
%s has requested permissions on %s:
%s has requested access to %s.
cfgmgr32.dll
Crypt32.dll
CertFreeCertificateContext
PFXImportCertStore
PFXExportCertStoreEx
CertEnumCertificatesInStore
CertCloseStore
CertCreateSelfSignCertificate
CertOpenStore
CertStrToNameW
CertAddCertificateContextToStore
CertSetCertificateContextProperty
CryptMsgClose
CertFindCertificateInStore
CryptMsgGetParam
CertGetNameStringW
CertVerifyCertificateChainPolicy
CertGetCertificateChain
CertFreeCertificateChain
wintrust.dll
zcÁ
<.KwCk
;.up<.uA?.u
.uMj.u
190.204.114.115:22564
C:\Users\"%CurrentUserName%"\AppData\Roaming\uTorrent\uTorrent.exe
d%%d%Ý%%d%%d%Ý%%d%%d%Ý%%d%%d%Ý%%d%%d%Ý%%d%%d%Ý%%d%%d%Ý%%d%%d%Ý%%d%%d%Ý%%d%%d%Ý%%d%%d%Ý%%d%%d%Ý%%d%%d%Ý%%d%%d%Ý%%d%%d%Ý%%d%%d%Ý%%
O&%dYVm
dg.uJ
R~R.vY
.Ot`T
.0%Uh
22222222222
hiTXtXML:com.adobe.xmp
" id="W5M0MpCehiHzreSzNTczkc9d"?>        02
" id="W5M0MpCehiHzreSzNTczkc9d"?>        
uB.Fw
p:\|w
J%U.\h
?j%FH
siTXtXML:com.adobe.xmp
" id="W5M0MpCehiHzreSzNTczkc9d"?>        GUW
" id="W5M0MpCehiHzreSzNTczkc9d"?>        
" id="W5M0MpCehiHzreSzNTczkc9d"?>        ]Q|
" id="W5M0MpCehiHzreSzNTczkc9d"?>        
Created with ajaxload.info
99999999
66666662
62222222
9999999555
[[[73322223
____[[[_
66666666
222222222
1.css
1.html
2.css
2.html
jq.js
]\D`;%F
%fko)
.Ht":
H6l.Emj
GetProcessHeap
PeekNamedPipe
CreatePipe
GetCPInfo
GetWindowsDirectoryW
WinExec
CryptDestroyKey
CryptGenKey
RegOpenKeyExW
RegEnumKeyExW
RegDeleteKeyW
RegCreateKeyExW
RegCloseKey
RegQueryInfoKeyW
ShellExecuteA
ShellExecuteW
SHFileOperationW
SHDeleteKeyW
MsgWaitForMultipleObjects
GetAsyncKeyState
RegisterHotKey
UnregisterHotKey
ExitWindowsEx
EnumWindows
CreateDialogIndirectParamW
EnumChildWindows
SetWindowsHookExW
GetKeyNameTextW
MapVirtualKeyA
keybd_event
UnhookWindowsHookEx
.text
`.rdata
@.data
.rsrc
%s\stats-%s.txt
chrome
firefox
toolbar.log
Software\Classes\%s\shell\open\command
Software\Classes\%s\shell
Software\Classes\%s
Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\%s\OpenWithProgids\%s
Software\Classes\MIME\Database\Content Type\%s
MIME\Database\Content Type\%s
Software\Microsoft\Windows\CurrentVersion\Uninstall\uTorrent
uTorrent.exe
application/x-bittorrent-key
Software\Classes\Applications\uTorrent.exe
Software\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\uTorrent
INSTALLDEBUG: QueryDisplayVersion. Installed version: %s
%s%s%s%s
RunElevatedInstall: %s with params [%s]
%s /STARTAPP %s
%s /LAUNCHBUNDLEDURL %s
%s /LAUNCHBUNDLEDURLTYPE %s
%s /AUTOMATION
%s /MINIMIZED
%s /NOINSTALL /BRINGTOFRONT
dht.dat
flags.conf
ipfilter.dat
resume.dat
rss.dat
settings.dat
INSTALLDEBUG: Could not create installation directory [%s]
%d.%d.%d.%d
mURLInfoAbout
"%s" "%%1"
Software\Classes\.torrent\OpenWithProgids
Software\Classes\.btsearch\OpenWithProgids
Software\Classes\Applications\uTorrent.exe\shell
Software\Classes\Applications\uTorrent.exe\shell\open\command
INSTALLDEBUG: Version String returned: %s
INSTALLDEBUG: Parsed version : major: %d minor: %d tiny: %d build: %d
CLSID\{3041D03E-FD4B-44E0-B742-2D9B88305F98}
CLSID\{F0D4B239-DA4B-4daf-81E4-DFEE4931A4AA}
CLSID\{D4027C7F-154A-4066-A1AD-4243D8127440}
CLSID\{91397D20-1446-11D4-8AF4-0040CA1127B6}
{88c7f2aa-f93f-432c-8f0e-b7d85967a527}
{ad06fb5f-fef7-4a84-8c58-dca34f8e3d36}
{ef79f67a-6ad7-4715-a0f8-932fca442023}
{1d03a978-ac0c-4004-b9fd-9cf361c7bd3f}
{64ead72b-ffd4-4e01-aa3a-4c71665d73e4}
{29acf17c-1713-4286-8f40-bfd05f1e70c8}
{7b6de06c-7013-4a87-957e-d27d7b977d21}
{2d8d9acc-f6d7-4362-8876-a275ca929591}
{656461ef-40f6-4115-9ff1-bced9812ccbb}
{1fd59ce2-6236-467c-9539-3d8c93fea5e0}
{49C795C2-604A-4D18-AEB1-B3EBA27E5EA2}
{7473B6BD-4691-4744-A82B-7854EB3D70B6}
{B6AC5E3C-5CEB-4E72-B451-F0E1BA983C14}
{5BA8E555-8C08-4CC8-80E6-1F8CDD26AE3A}
{6DA66498-839A-42A7-8324-FF7D2A532835}
{4E871705-D1F3-49D9-814F-1E46E85986B0}
{bf7380fa-e3b4-4db2-af3e-9d8783a45bfc}
{db131c55-60c8-4adc-84dc-9e76ab06e2dc}
{05eeb91a-aef7-4f8a-978f-fb83e7b03f8e}
{4ae0c3d6-f713-4eed-bc65-25dc3ffdaac1}
{c840e246-6b95-475e-9bd7-caa1c7eca9f2}
{e0301295-ab3e-4af3-979f-3d453c5f9f48}
{87775fdb-6972-41f9-ae51-8326e38cb206}
{181f104b-b000-4010-bb18-41b8205f774d}
{03ea5b10-2efa-4311-ac10-04427b02d663}
{e9df9360-97f8-4690-afe6-996c80790da4}
CLSID\%s
SOFTWARE\Conduit\Platforms\%s
SOFTWARE\AppDataLow\Software\%s\toolbar\IE5
Software\Microsoft\Windows\CurrentVersion\Ext\Settings\%s
http://www.mybrowserbar.com/images/pixel.gif?tb=%d&cnid=%s
,Riched20.dll
%s %S %S %S
%s %S
Initializing OfferAPI supported-> %d
Stoolbar_offer.benc
toolbar.benc
3.4.1
apps\featuredContent.btapp
apps\plus.btapp
apps\welcome-upsell.btapp
apps\player.btapp
INSTALLDEBUG: Unable to create firewall rules for path [%s]
path:[%s]
\uTorrent.exe
INSTALLDEBUG: Volume: %s, Drive: %s
INSTALLDEBUG: Returning early. Installed version: %d, Our version: %d
/PERFORMINSTALL %d "%s" %u
INSTALLDEBUG: Returning...installResult = (%d)
INSTALLDEBUG: running from installed path = %d running from different drive = %d
INSTALLDEBUG: DoInstall(%d, %s)
"%s" %s
netsh.exe
interface ipv6 set teredo %s
netsh.exe interface ipv6 set teredo %s
Could not setup teredo, result was: [%s]
netsh.exe interface ipv6 install
Could not install teredo, result was: [%s]
Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\%s
Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\%s\UserChoice
Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\%s\OpenWithProgids
Software\Classes\%s\OpenWithProgids
Software\Microsoft\Windows\Roaming\OpenWith\FileExts\%s\UserChoice
maindoc.ico
%s URI
URL Protocol
%s\%s
%s\shell
%s\shell\%s\command
%s\Application
%s\Progid
%s\UserChoice
%s\OpenWithProgids
Software\Microsoft\Windows\CurrentVersion\Run
Torrent.lnk
TerminateSessionClientInstances failed; hp:0x%X result:%d
INSTALLDEBUG: Initial GetVolumeInformation failed and detected possible UNC path [%s] without appended [\]; calling again
Failed to install bundled btapp: %s to: %s
Bundled btapp "%s" is ill formed: %s
Failed to unpack bundled btapp: %s to: %s
"%s" /UNINSTALL
plus_license.btkey
RunAsAdministrator: %s with params [%s]
lRunAsAdministrator(error executing %s with params [%s]): Error: %d
RunAsAdministrator(error executing %s with params [%s]): Unexpected exit code %d (expecting %d)
DDE operation timed out.
DDE operation failed.
DDE operation is busy.
RunAsAdministrator(error %d executing %s with params [%s]): %s
Software\Microsoft\Windows NT\CurrentVersion\AppCompatFlags\Layers
%s is running in Vista compatibility mode which is known to cause problems. Please allow %s to fix this by clicking "Yes" in the next dialog.
REG DELETE "HKLM\Software\Microsoft\Windows NT\CurrentVersion\AppCompatFlags\Layers" /v "%s" /f
/C %s
RemoveCompatibilityModeKey(removal from HKLM returned %s)
Software\Classes\.torrent
client.exe
updates.log
netprofm.dll
bt.log
PORTABLE
Ads %s -- GdiPlus.dll %s
Settings path: [%s]
Setting log file to '%s'
Log file set to path:[%s]
dht_feed.dat
LAUNCHBUNDLEDURL
LAUNCHBUNDLEDURLTYPE
http://bundles.bittorrent.com/inclient/yes
http://apps.bittorrent.com/featuredcontent/featuredcontent.btapp
INSTALLDEBUG: /PERFORMINSTALL with flags [%d] and path [%s]
.btapp?
Version: %s
valid plus key, but not activated. Attempting activation...
{CF59774A-CE9D-454D-AF29-1556367E1AC7}
{E3DC5C2B-082C-4800-8C52-B9F655B94D2C}
\StringFileInfo\xx\ProductName
\StringFileInfo\xx\ProductVersion
Z/IDFILE "%s"
flash=%s
%S: default value assigned
%S: %d
%S: %S
%S:empty text: fatal error
Invalid rating: %S
%S: default value assigned: %S; added: %S
%S: fatal error: size - no value
adnative.log
noerrormsg
key_expired
invalid_key
no_license_key
{A4D77A09-10EA-4574-8C09-9B6E1A21C95F}
Activation error: %s
activation.log
HTTP %d
iPod Touch 1.Gen
iPod Touch 2.Gen
iPod Touch 3.Gen (8GB)
iPod Touch 3.Gen
iPod Touch 4.Gen
utorrent.lng
Your DNS server does not support AAAA lookups. Installing IPv6 is NOT recommended.
KERNEL32.DLL
tray.ico
\hh.exe
ms-its:%s::%s
utorrent-341-31105.chm
utorrent-help.zip
%s|%S
LoadKnownFileType called with %s, %s, %s
btkey
current.btskin
Accepted launch|Type: %s Location: %s
Memory Compacting, system memory is low (%u%% CPU usage)
social.bmp
shutdown.log
autorestart.log
Unable to send crash report to server:
Error opening Windows firewall: 0x%X %s
[%dK]
2%d %s
HTTP Error 400
HTTP Error 401
transcode.btinstall
%s%s %d.%d
[Portable mode]
%s (build %d) [%d-bit]
main.ico
Local\%s
An older version of %s is running.
Please shut down %s and try again.
It seems like %s is already running, but not responding.
Please close all %s processes and try again.
%s\BunndleOfferManager.dll
%s\ADKAppsOfferManager.dll
Delete file failed: %s error: %d
Congratulations! Your software is turning into %s Plus as we speak, and all features will be ready to use in about a minute.
To learn about your new features, please refer to the %s Plus Alpha forums.
Installing '%s' to '%s'.
t.lang.txt
%s.lng
Player.Path
Windows Media Player
\smplayer.exe %1
http://download.utorrent.com/public/DivXPlayer.html?url=%1
http://download.utorrent.com/public/DivXPlayer.html
Web player
http://www.bittorrent.com
http://127.0.0.1:%d/search?q=%%s
shell32.dll,OpenAs_RunDLL %s
RUNDLL32.EXE
http://127.0.0.1:%d/proxy?sid=%S&file=%d
http%:%/%/localhost%:%d%/proxy%?sid%=%S%&fast_if_no_peers=false%&file=%d&width=%d&height=%d
http%:%/%/localhost%:%d%/proxy%?sid%=%S%&fast_if_no_peers=false%&file=%d
/select,"%s"
\flash*.ocx
ping.exe
%s -n 2 127.0.0.1
%s /BRINGTOFRONT
cfu.log
SBitTorrent|http://www.bittorrent.com/search?client=%v&search=
INSTALLDEBUG: LoadFile of current exe failed
V8 bundle: Failed to open exe
ui.btapp
b.btapp
Installing bundle: %s to %s
apps.btapp
Failed to find bundled btapp: %s
Submit a crash report to the developers.
%s has crashed. A crash dump has been saved as:
uTorrent.exe /RECOVER "%s"
uTorrent.exe /RECOVER
%s has crashed. Unable to generate crash dump. %S%S
btinstall.txt
BTAPPS="%s\" PAIRINGKEY="%S"
ESoftware\Microsoft\Windows\CurrentVersion\Uninstall\%s
g[unknown url]
/redirect.html#userinterface/preferences/general
/redirect.html#userinterface/preferences/uisettings
/redirect.html#userinterface/preferences/antivirus
/redirect.html#userinterface/preferences/directories
/redirect.html#userinterface/preferences/connection
/redirect.html#userinterface/preferences/bandwidth
/redirect.html#userinterface/preferences/bittorrent
/redirect.html#userinterface/preferences/transfercap
/redirect.html#userinterface/preferences/queueing
/redirect.html#userinterface/preferences/scheduler
/redirect.html#userinterface/preferences/uconnect
/redirect.html#userinterface/preferences/streaming
/redirect.html#userinterface/preferences/devices
/redirect.html#userinterface/preferences/paireddevices
/redirect.html#userinterface/preferences/label
/redirect.html#userinterface/preferences/advanced
/redirect.html#userinterface/preferences/advanced/uiextras
/redirect.html#userinterface/preferences/advanced/diskcache
/redirect.html#userinterface/preferences/webui
/redirect.html#userinterface/preferences/advanced/run_program
*https://remote.utorrent.com
help.ico
%s, %d:00 - %d:59
http://bit.ly/HTwxBj
%s
"%s"%s
%s %d%%
Failed to post GUI Update message: %s
Buggy DLL warning: %S (%S)
%s\VirusGuard\
BitTorrentAntivirus.exe
VirusGuard.exe
.DEFAULT\Software\SetID\Internal
%u.%u.%u_%u
updates\%s.exe
lupdates\%x.lng
tupdates.dat
SAUMetrics.log
Can't parse webui description json: %S
tabs.bmp
toolbar.bmp
http://127.0.0.1:%d/proxy?sid=%x&file=%d
tstatus.bmp
http://update.utorrent.com/survey
%s %d %s
%s.btskin
Failed to load skin: %s. SaveFile failed.
Failed to load skin: %s. Read from btresource failed.
%d (%d)
%d.%.3d
=.%%
id_%S
document.write('\n
window.location="about:blank";
OnRefreshAd::url = %S
OnRefreshAd::title = '%s'
download size = %s
%.2f %s
%.1f %s
G%s|%s
p%dx%.2d
E\\.\pipe\privateaccessvpn
G%s %d
%s %d
Tris: %d points [high score: %d]
%s (build %d)
G%s.torrent
%s\%s\*.*
http://www.utorrent.com/faq.php
yellow_check_8bit.ico
green_check_8bit.ico
red_cross_8bit.ico
\\.\X:
\\?\%s
%s(%d). [%s] [%s]
V%s (%d)
10  %s
%s(%d). [%s]
App store install failed: %s
Got bogus main app. Update URL does not match download source.
%s != %s
%s\%S
%s\%s\%S
%s "%s"
H%sBunndleOfferManager.dll
9944A343-2613-4177-A30C-3D868D1D0D9F
C6D65593-16C7-44ED-BC08-B46F22EA7353
BunndleOfferManager.dll
%sADKAppsOfferManager.dll
%s %:.1d %%
Oflags.bmp
%d | %d
%d| %d
%S%S%S%S%S%S
%S:%d
(%d%%) %s
%s (%s)
%dx%d
A: %S V: %S
&%d %s
O%s
|[%d Torrents]|
IInstalling %d of %d ...
%s (%d of %d)
%s:\%s
%s (powered by %s)
Failed to load html resource %d
http://pairing:%H@127.0.0.1:%d/fileserve?token=%H&pairing=%H
top: %d;
Device ID %s : %s
Failed to load HTML resource %d
$('body').ready(function() { devicehelper.initialize();
devicehelper.setClient("%s");
devicehelper.setText({
%s"%S":"%s"
notify.configure(%d,'%H'); devicehelper.setPort(%d); devicehelper.setPair('%H');
devicehelper.adddevice('%S', %d, '%d', '%s');
devicehelper.adddevice('devicesection', %d, '%d', '%s');
OCSetupHlp.dll
ADKAppsOfferManager.dll
CLSID\{DC0C2640-1415-4644-875C-6F4D769839BA}
J%s (%s:)
cexe
rpmsg
hangreport.log
%s\*.*
Found %d entries using filter %s in directory %s
\\?\%s%s
c:\%u%u.tmp
full %s root %s
Created canonical path %s from %s
bf2.exe
bf2142.exe
crysis.exe
gw.exe
halo.exe
hl.exe
hl2.exe
ut2003.exe
ut2004.exe
wolfmp.exe
wow.exe
quake.exe
glquake.exe
qw.exe
glqw.exe
quake2.exe
quake3.exe
quake4.exe
iourbanterror.exe
goldslam.exe
nksp.exe
pilauncher.exe
pistory.exe
rnclient.exe
twelvesky.exe
domo.exe
dreamlords.exe
stoneage2.exe
projecttorque.bin
iexplore.exe
firefox.exe
mplayer.exe
mplayerc.exe
wmplayer.exe
vlc.exe
peerblock.exe
pg2.exe
pglite.exe
peerguardian.exe
%s.%u.tmp
%s.new
GetMaxFileSize() returning %Ld for "%s"
K%s.exe
0123456789._
\uac_test.tmp
\Sysnative\..\explorer.exe
\explorer.exe
iError %d
%s.%u.%s
[%s] %s
[%.2d:%.2d:%.2d] %s
HFile not found during integrity check: %s
%s.old
File failed verification: %s
Failed file save: %s
Safely saved file '%s'
File passed integrity check: %s
Warning: file integrity check failed (%s): %s
Ignore this warning if you switched to 1.6.1 or older and back
Windows ran out of memory. Unable to allocate %d bytes.
Bits on Wheels/1.0.%d
Bits on Wheels/%c%c%c
%s/%d.%d%d%d
Torrent .NET
Unknown %c%c
%s/%d.%d.%d.%d
Unknown %c
BitTorrent %c.%c.%c
BitTorrent %c.%c%c.%c
%s %i.%i
BitSpirit v2 UDP0
BitSpirit v2 HTTPBT
Blizzard %d.%d
Burst! %c.%c.%c
FlashGet %u.%u
MLdonkey %c.%c.%c
Opera %c%c%c%c
e208.67.222.222
208.67.220.220
KNOTE: Settings file found in directory of executable; using that.
The file '%s' was damaged/missing. It has been recovered.
Settings integrity check failed (duplicate keys: %d count: %d), repaired: %s
Error 73: %d/%d/%d/%d
TCP Half Open limit: %d
TCP Sockets: %d, Half Open: %d (total %d)
TCP Pending: %d
Total Sockets: %d
Read buffers: %u (%u bytes), avg %u
Write buffers: %u (%u bytes), avg %u
TCP-halfopen
[%d]: %d %s %A mode: %d state: %d
*** %s
Elevation:Administrator!new:%s
(TCP-In)
(UDP-In)
HNetCfg.FwPolicy2
HNetCfg.FwRule
Allow %s network traffic with Edge Traversal
L%s-%s
HTTP Error %d
REDIRECT:%S%S%S
Proxy connect error: %s
Proxy error: %S
Mozilla/5.0 (Windows NT %s%s; Trident/%d.0; EIE10; ENUSMSN; rv:%s)
Mozilla/%d.0 (compatible; MSIE %s Windows NT %s%s; Trident/%d.0
Mozilla/5.0 (Windows NT %s%s; rv:%s) Gecko/20100101 Firefox/%s
Mozilla/5.0 (Windows NT %s%s) Chrome/%s
MSIE %s;
Google Chrome
Software\Wow6432Node\Mozilla\Mozilla Firefox
Software\Mozilla\Mozilla Firefox
chrome.exe
HTTP Error 404
HTTP Reply %d
gCan't open log file '%s': %d %s
]25,80,110,443,6666,6667
Checking if torrent data files already exist in %s
Torrent data files already exist in %s
Setting storage folder to '%s' for torrent '%s' (directory '%s')
Torrent '%s' storage at '%s', root at '%s'
aError contacting WebUI proxy service: %s
HTTP Error
Got proxy service response (%S:%d, %Ld bytes): %S
Disconnected from WebUI proxy service
sConnecting to raptor at %S
Sent raptor attach cookie: %S
****** DELETING FILE: %s
*.dat
global_resume.dat
%H.dat
resume.dat.temp
TCP port bind failed %A: (%d) %s
HTTP: IP %a: Bad Range value
HTTP: IP %a: can't accept cookie - incorrect format
HTTP: IP %a: Bad authentication header
HTTP: IP %a: Bad username/password
1Can't handle name length %d (> %d) for archive %s
Can't read entry name from archive %s: %d %S
Can't seek %d farther in archive %s: %d %S
Can't handle entry with flags %x in archive %s
Can't handle header with mismatched sizes %d %d in archive %s
Can't handle header method %d != 8 in archive %s
Accepting entry for file %S in archive %s
Found %d files in archive %s
Can't open archive file %s
Can't read directory of archive file %s
Can't find requested file %s in archive %s
Can't handle decompressed size %d/%d >= %d for archive %s
Can't set pointer in archive file %s to %d
Can't read from archive file %s
Can't decompress entry in archive %s
Can't read header of %s
Can't set pointer in btinstall file %s to %d
Can't read sectiontable of %s
Can't read section %d of %s
icon.bmp
%s\apps\%s\%s
%H.btapp
k%s/*.btapp
Lapps\%s
RegKey: Could not write string valuename %s value %s; Error %d
RegKey: Could not write binary valuename %s length %d; Error %d
RegKey: Could not write DWORD valuename %s value %d; Error %d
RegKey: Could not delete value %s: %d
RegKey::DeleteKey fail (%d): %s
RegKey::DeleteTree fail (%d): %s
content-type = %S error code = %d
invalid key size
license key expired
invalid key
Mwebui
couldn't download webui info
Murladder
load missing index.html
missing index.html
missing update url
failed to verify certificate
bad url
unsupported piece size
unsupported torrent size
Unable to save .torrent
no uconnect password
%s %d.%d
%s %d.%d.%d
BError parsing URL: %s
*** %s: PIECE %d FAILED HASH CHECK
%s: Piece %d complete
download.log
e%s: Unable to move: %s
Moved file storage for torrent '%s' to '%s'
Adding job to move file storage for torrent '%s' from '%s' to '%s'
Could not move data to completed download folder. Error: [0x%X]
"%s\%s"
run.txt
%S %S
"%s\%S"
%s: HTTP invalid URL: %S
%s: HTTP preventing DNS lookup: %S
%s.alt
DNS resolution failed for %s %S
http://%S/announce
pTracker reports an invalid external IP
Finished receiving metadata for '%s' in %d seconds
ERROR: Metadata for '%s' could not be loaded! ("%s")
BAN peer: Responsible for '%s' metadata not being loaded!
Got metadata size %u, pieces %u
Got metadata size %u when I already thought it was %u
Peer send unsolicited metadata message: chunk %d
dError: %s - %s
%s (%S)
%s\%H.dat
rBanned %T until %S
*** Sending BTMSG_TF_SEEDING_DONE for torrent '%s'
%s.%d.torrent
%s.loaded
Unable to rename/delete '%s'.
NTMP=%s
TEMP=%s
Loading settings from path '%s'
HR.HDTV
HR.PDTV
WebRip
Can't download url %s - msg %d - %s
Can't download RSS feed - %s
Can't add duplicate feed with url %s
RSS Channel title %s
d%dx%.*d-%dx%.*d
%dx%.*d
I/O error: %d
C=US,ST=CA,L=San Francisco,O=BitTorrent,OU=%s,CN=%s
O%s%s|
Deleting original torrent file %s
Can't delete original torrent file %s
-i %%s -y -f %s %s %s %%s
-vcodec %S -maxrate %dm -bufsize %dm -flags  loop -cmp  chroma -me_method hex -subq 5 -me_range 16 -b_strategy 1 -bf %d -flags2 %s%s%s%s%s -refs 2 -directpred 3 -trellis 1
-r %d
-s %dx%d
-crf %f
-b %d
-level %d
-acodec %S %s -ar %d -ab %d
-ac %d
Omedia%s%s
%s_(%s).%s
%s%s\%s
%s-devpair.dat
Can't add duplicate device pairing %s
Adding device pairing with id %s name %s
Found device pairing %s at %d of %d
Can't match key hash to device pair %s
IIO Error:%d line:%d pos:%Ld count:%d actual:%d
Error opening "%s": %E
ReadFile error: %s:%Ld:%d:%d:%d
%S(%x): %x:%x (fs %x)
~%sPartFile_%LX.dat
thumbs.db
.DS_Store
delete.log
Moving files from '%s' to '%s'
%s\%s\%s
ffmpeg.exe
s%s\~~%s
%s.log
Checked %:.1d%% (Active Num:%d)
Can't %s device pair for %s
Can't add torrent %S because it is a duplicate of an existing torrent
URL: %S: OK
uT HTTP add torrent %S completed
Deleting temporary torrent file '%s'
WebUI Proxy Error: %s
!Proxy: %s
Can't download to directory '%s' which is outside of download directory '%s'
Chose download directory '%s' from dir %d '%s' sub-path '%s'
uT HTTP add torrent %S completion failed - status: %s
/Can't add torrent: %s
Settings %s
uT HTTP can't add torrent '%s': %s
uT HTTP torrent add of '%s' succeeded
Can't save temporary torrent file '%s'
Encoded rate %d duration %d for file %s
Need more header for file %s
Unrecognized type for file %s
Unknown error %S
Access denied %S
Unknown property %S
Read only property %S
Type mismatch %S
sendappmsg
sendmsg
fb_login
set_license_key
JAVASCRIPT LOG: %s
window.btapp = null; window.onunload = null;
set_webseed
verify_rsa_signature_appkey
rsa_generate_key
web seed
EUDP port bind failed %A: (%d) %s
mICMP port bind failed %A: (%d) %s
The file "%s" is signed and the signature was verified.
The file "%s" is not signed.
An unknown error occurred trying to verify the signature of the "%s" file.
Verify Sig Error: 0x%x.
CertGetNameString failed.
CryptQueryObject failed with %x
CryptMsgGetParam failed with %x
CertFindCertificateInStore failed with %x
Signer certificate mismatch
%S [%d]: %S
upnp_log.txt
UPnP: Unable to create socket: %d
UPnP: Unable to setsockopt: %d
UPnP: Could not join multicast group: %d
UPnP: Could not setup socket to send multicast packets: %d
UPnP: Could not set unicast TTL: %d
UPnP: Could not set multicast TTL: %d
DEBUG: UPnP: Send error [socket %p]: %d
DEBUG: UPnP: Not replying to Service Type [%S]
UPnP: Discovered new device: "%S" %S
Not yet supported
[nf]%s
%s does not exist in object
key does not exist in object
activeds.dll
adsldpc.dll
apphelp.dll
atl.dll
authz.dll
bcrypt.dll
bcryptprimitives.dll
browseui.dll
clbcatq.dll
comdlg32.dll
comres.dll
comsvcs.dll
credssp.dll
credui.dll
crypt32.dll
cryptbase.dll
cryptdll.dll
cryptsp.dll
cryptui.dll
cscapi.dll
cscdll.dll
cscui.dll
devobj.dll
dhcpcsvc.dll
dhcpcsvc6.dll
dnsapi.dll
dot3api.dll
dot3dlg.dll
dssenh.dll
dui70.dll
duser.dll
eapolqec.dll
eappcfg.dll
eappprxy.dll
ehstorshell.dll
esent.dll
explorerframe.dll
fastprox.dll
firewallapi.dll
fltlib.dll
fwpuclnt.dll
gdi32.dll
gdiplus.dll
gpapi.dll
hnetcfg.dll
icmp.dll
iconcodecservice.dll
ieframe.dll
iertutil.dll
imagehlp.dll
imm32.dll
iphlpapi.dll
kernelbase.dll
linkinfo.dll
lpk.dll
mpr.dll
mprapi.dll
msacm32.dll
msasn1.dll
msctf.dll
msctfime.ime
msdart.dll
msi.dll
msimg32.dll
msls31.dll
msv1_0.dll
msvcp60.dll
msvcp80.dll
msvcr80.dll
msvcr90.dll
msvcrt.dll
mswsock.dll
msxml3.dll
napinsp.dll
ncrypt.dll
netapi32.dll
netman.dll
netshell.dll
nlaapi.dll
normaliz.dll
npmproxy.dll
nsi.dll
ntdsapi.dll
ntmarta.dll
ntshrui.dll
ole32.dll
oleacc.dll
oleaut32.dll
onex.dll
peerdist.dll
pnrpnsp.dll
profapi.dll
propsys.dll
qutil.dll
rasadhlp.dll
rasapi32.dll
rasman.dll
riched20.dll
rpcrtremote.dll
rsaenh.dll
rtutils.dll
samcli.dll
samlib.dll
schannel.dll
sechost.dll
secur32.dll
sensapi.dll
setupapi.dll
sfc.dll
sfc_os.dll
shdocvw.dll
shfolder.dll
shlwapi.dll
shunimpl.dll
slc.dll
srvcli.dll
ssdpapi.dll
sspicli.dll
sxs.dll
tapi32.dll
tiptsf.dll
upnp.dll
urlmon.dll
userenv.dll
usp10.dll
utorrent.exe
vfbasics.dll
vfcompat.dll
vrfcore.dll
wbemcomn.dll
webio.dll
windowscodecs.dll
winhttp.dll
winnsi.dll
winrnr.dll
winspool.drv
winsta.dll
wldap32.dll
wmi.dll
ws2_32.dll
ws2help.dll
wshbth.dll
wship6.dll
wshtcpip.dll
wsock32.dll
wtsapi32.dll
wzcsapi.dll
wzcsvc.dll
xmllite.dll
xpsp2res.dll
%s: No longer have piece: %u
IpFilter invalid line: [%S]
Loaded ipfilter.dat (%d entries)
webui.zip
Web UI storage base '%s' archive path '%s'
Can't open web UI archive file '%s'
Can't read directory in web UI archive '%s'
Can't download web UI information - %s
S.tmp
Attempting to read unarchived file %s
%s%s%s%s%s
S%A%s(%s):
%A%s:
[%s (%:.1d)]:
Requesting Metadata %d/%d
Disconnect: %s
Requesting %d:%d->%d
Rejecting %d:%d->%d
Cancelling %d:%d->%d
Send Have %d
Send Donthave %d
Got unchoke from %s (%A), for seed only torrent
Got unchoke from %s (%A), can't request immediately because request queue is full (%d)
Got Expected Reject: %d:%d->%d
Got Reject: %d:%d->%d
Got Reject Unrequested!: %d:%d->%d
Sending Piece %d:%d->%d
Got PieceRequest I don't have: %d:%d->%d
Got Bad Request in SS mode: %d:%d->%d
Got Request while choked: %d:%d->%d
Got Request: %d:%d->%d
Got Cancel: %d:%d->%d
Got Cancel In Queue: %d:%d->%d
Got Cancel Unrequested: %d:%d->%d
Got Piece: %d:%d->%d
Got OLD Piece: %d:%d->%d
Got Piece Unrequested: %d:%d->%d
Banning peer: too many pex messages. %d since %S
Got PEX: %d added/%d dropped
received metadata message from peer that didn't advertise support
Reading msg %d piece %d
Got request for metadata which I do not have %d %d/%d
Metadata requests exceeded maximum request limit %d
Got request for metadata which I have %d/%d
Got zero metadata size. %d/%d
Got unrequested or cancelled metadata! %d %d %d/%d
Got metadata %d/%d
Got reject for unrequested metadata %d %d %d/%d
Got reject for metadata %d %d/%d
Got request for metadata which I can not read %d %d/%d
Send PEX: %d added/%d dropped
Sent Holepunch failure(%u)
Got Holepunch failure(%u)
Bad lt_donthave message (invalid length): %d
Bad lt_donthave message (piece index exceeds maximum): %d
Got Donthave %d
Bad lt_donthave message (piece already not had): %d
Extension: ipv4:[%a] for '%s'
Extension: ipv6:[%a] for '%s'
Got Have %d
Got Bad Have %d
Got Suggest Piece %d
Got Allowed Fast %d
No supported crypto methods
Connecting: source: %S
Disconnect: Proxy connect error: %s
Peer error: %s
TCP connections are not allowed
Dropping peer that has metadata, though we still want it for %s
Exceeded 5 seconds for %s metadata chunk %d
Sending %d bytes of aggregated data
DNS resolution failed for tracker %S
blocking DNS lookup for %s
[DISTSHARE] Authentication key appears to be missing.
[DISTSHARE] Authentication key appears to be the wrong size: %i/%i bytes.
[DISTSHARE] Authentication key does not exist!
[DISTSHARE] Invalid Distributed Share response command %c
magnet:?xt=urn:btih:%S&tr=%S
twebcache.dat
Expiring all device pairing sessions associated with device %s
ICMP.DLL
bittorrent.crt
RangeBlock detected range %S
tracker.openbittorrent.com
tracker.publicbt.com
tracker.ccc.de
tracker.istole.it
SNeed more media header for %s: will reparse.
Error %d parsing media header for %s
**** Successfully determined encoded rate of file %s
IO Error:%d line:%d align:%d pos:%Ld count:%d actual:%d
Can't download %s via HTTP - %s
THTTP server
file %S redirected to %S
sHTTP Connecting to: %S
invalid http reply (%S)
invalid request or temporarily unavailable (%d)
invalid http response code (%d): %S (%S)
Got redirection response (%d) but no location header
Invalid redirection url: %S
Redirection limit (%d) reached (recursive redirections?)
HTTP response did not include content-length nor content-range
HTTP server sent more responses than it was requested to
Disconnect: a range of type %S is not supported
Invalid range in HTTP response (%d)
Invalid transfer encoding (%S)
The data received from the HTTP server was not the part that was requested
The size of the data received from the HTTP server did not match the requested size
Timed out. num_tries=%d
HTTP Reconnecting to: %S
HTTP Disconnect: Peer error: %s
content-length (%Lu) does not correspond to the requested length (%d)
B0rked reason: %s
Vmscoree.dll
combase.dll
- CRT not initialized
- Attempt to initialize the CRT more than once.
- floating point support not loaded
2.cmd
USER32.DLL
portuguese-brazilian
/cnid "%d" %S
http://apps.bittorrent.com/cl_search/thanks.html
http://apps.bittorrent.com/cl_search/thanksbundles.html
http://featuredcontent.utorrent.com/
http://featuredcontent.staging.utorrent.com
http://www.facebook.com/plugins/like.php?
errorUrl
Script Error: line=%d char=%d code=%d message=%s url=%s
%cport=%d&pair=%H
%cport=%d
&frameaddr=%x
%clangs=%U
Y. (%s)
Torrent 3.4.1 nightly
Torrent 3.4.1 nightly (build 31105) [32-bit]
C:\Users\"%CurrentUserName%"\AppData\Roaming\uTorrent
0364783266
msctls_hotkey32


Remove it with Ad-Aware

  1. Click (here) to download and install Ad-Aware Free Antivirus.
  2. Update the definition files.
  3. Run a full scan of your computer.


Manual removal*

  1. Terminate malicious process(es) (How to End a Process With the Task Manager):

    TPAutoConnSvc.exe:1620
    aff_setup.exe:1428
    install.exe:3692
    CloudBackup404.exe:1692
    makecab.exe:4060
    utt5372.tmp.exe:1808
    rundll32.exe:1728
    TrustedInstaller.exe:3868
    vcredist_x64.exe:3660
    RunDll32.exe:2568
    SearchProtocolHost.exe:2868
    %original file name%.exe:1224
    MyPC Backup.exe:4084

  2. Delete the original Worm file.
  3. Delete or disinfect the following files created/modified by the Worm:

    C:\Users\"%CurrentUserName%"\AppData\Local\Temp\CloudBackup404.exe (467810 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Temp\aff.conf (379 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Temp\nsx5B78.tmp (3344 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Temp\nsx5B79.tmp\nsJSON.dll (15 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Temp\nsx5B79.tmp\NSISdl.dll (30 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Temp\nsx5B79.tmp\LogEx.dll (1597 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Temp\log.txt (384 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Temp\nsx5B79.tmp\nsRandom.dll (808 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Temp\dd_vcredistUI1104.txt (130934 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Temp\dd_vcredistMSI1104.txt (203315 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Temp\VWLC80F.tmp (392 bytes)
    C:\54383a505f02045ba70726cebb\install.res.1033.dll (94 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\MyPC Backup\Uninstall.lnk (858 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Temp\nsx9AD9.tmp\NSISdl.dll (30 bytes)
    %Program Files% (x86)\MyPC Backup\syncing.ico (12088 bytes)
    %Program Files% (x86)\MyPC Backup\Database\mpcb_file_cache.db (7 bytes)
    %Program Files% (x86)\MyPC Backup\Service Start.exe (14 bytes)
    %Program Files% (x86)\MyPC Backup\es_ES.mo (1856 bytes)
    %Program Files% (x86)\MyPC Backup\pt_PT.mo (1856 bytes)
    %Program Files% (x86)\MyPC Backup\Database\mpcb_backup_conf.db (16 bytes)
    %Program Files% (x86)\MyPC Backup\AlphaVSS.60.x64.dll (6360 bytes)
    %Program Files% (x86)\MyPC Backup\AlphaVSS.52.x86.dll (5064 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Temp\nsx9AD9.tmp\AccessControl.dll (20 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MyPC Backup.lnk (1 bytes)
    %Program Files% (x86)\MyPC Backup\Crypto64.dll (1856 bytes)
    %Program Files% (x86)\MyPC Backup\diffstack.dll (1552 bytes)
    %Program Files% (x86)\MyPC Backup\Shared Stack.dll (89498 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Temp\mpbtrk.log (8 bytes)
    %Program Files% (x86)\MyPC Backup\ObjectListView.dll (13584 bytes)
    %Program Files% (x86)\MyPC Backup\Database\mpcb_queues.db (13 bytes)
    %Program Files% (x86)\MyPC Backup\BackupStack.exe (1552 bytes)
    %Program Files% (x86)\MyPC Backup\GetText.dll (12 bytes)
    %Program Files% (x86)\MyPC Backup\AWSSDK.dll (106386 bytes)
    %Program Files% (x86)\MyPC Backup\Configuration Updater.exe (784 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Temp\nsx9AD9.tmp\nsSCM.dll (13 bytes)
    %Program Files% (x86)\MyPC Backup\Database\mpcb_sig_cache.db (6 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Temp\nsx9AD9.tmp\DotNetChecker.dll (1597 bytes)
    C:\Users\"%CurrentUserName%"\Desktop\MyPC Backup.lnk (1 bytes)
    %Program Files% (x86)\MyPC Backup\AlphaVSS.60.x86.dll (5520 bytes)
    %Program Files% (x86)\MyPC Backup\tick.ico (12088 bytes)
    %Program Files% (x86)\MyPC Backup\Updater.exe (31856 bytes)
    %Program Files% (x86)\MyPC Backup\MyPC Backup.exe (93176 bytes)
    %Program Files% (x86)\MyPC Backup\RegisterExtensionDotNet20_x86.exe (784 bytes)
    %Program Files% (x86)\MyPC Backup\mypcbackup.ico (13368 bytes)
    %Program Files% (x86)\MyPC Backup\fr_FR.mo (1856 bytes)
    %Program Files% (x86)\MyPC Backup\LogicNP.EZShellExtensions.dll (8560 bytes)
    %Program Files% (x86)\MyPC Backup\uninst.exe (1546 bytes)
    %Program Files% (x86)\MyPC Backup\x64\System.Data.SQLite.dll (33633 bytes)
    %Program Files% (x86)\MyPC Backup\AlphaVSS.52.x64.dll (5520 bytes)
    %Program Files% (x86)\MyPC Backup\MPCBContextMenu.dll (217172 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Temp\nsx9AD9.tmp\System.dll (23 bytes)
    %Program Files% (x86)\MyPC Backup\syncicon.ico (1856 bytes)
    %Program Files% (x86)\MyPC Backup\MPCBIconOverlays.dll (124204 bytes)
    %Program Files% (x86)\MyPC Backup\de_DE.mo (1856 bytes)
    %Program Files% (x86)\MyPC Backup\it_IT.mo (1856 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Temp\nsx9AD9.tmp\nsExec.dll (14 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\MyPC Backup\MyPC Backup.lnk (1 bytes)
    %Program Files% (x86)\MyPC Backup\Database\mpcb_settings.db (9 bytes)
    %Program Files% (x86)\MyPC Backup\AlphaVSS.51.x86.dll (4992 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Temp\nsi9AC9.tmp (604687 bytes)
    %Program Files% (x86)\MyPC Backup\MPCBClient.dll (39329 bytes)
    %Program Files% (x86)\MyPC Backup\RegisterExtensionDotNet20_x64.exe (16 bytes)
    %Program Files% (x86)\MyPC Backup\RestartExplorer.exe (16 bytes)
    %Program Files% (x86)\MyPC Backup\AlphaVSS.Common.dll (2392 bytes)
    %Program Files% (x86)\MyPC Backup\Crypto32.dll (1856 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Temp\vcredist_x64.exe (424037 bytes)
    %Program Files% (x86)\MyPC Backup\UnRegisterExtensions.exe (15 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Temp\nsx9AD9.tmp\nsRandom.dll (808 bytes)
    %Program Files% (x86)\MyPC Backup\Signup Wizard.exe (33877 bytes)
    %Program Files% (x86)\MyPC Backup\x86\System.Data.SQLite.dll (30464 bytes)
    C:\Windows\Temp\cab_4060_2 (564989 bytes)
    C:\Windows\Temp\cab_4060_3 (76 bytes)
    C:\Windows\Logs\CBS\CbsPersist_20140702083402.cab (11744 bytes)
    C:\Windows\Temp\cab_4060_4 (564989 bytes)
    C:\Windows\Temp\cab_4060_5 (76 bytes)
    C:\Windows\Temp\cab_4060_6 (8 bytes)
    C:\ProgramData\APN\APN-Stub\BTR-V7\Setup.ini (5 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\3Y5KZMDN\Setup[1].ini (1436 bytes)
    C:\ProgramData\APN\APN-Stub\BTR-V7\ApnSetup.exe (3073 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Temp\APN-Stub\BTR-V7\Stb226aaf9d-7a1e-4eed-92b1-6a2c8500b37f.log (6715 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\YL7ROG0G\impression[2].png (109 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Temp\i_temp.temp (109 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\3Y5KZMDN\impression[1].png (109 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\WBDJL3LL\impression[2].png (109 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\WBDJL3LL\impression[3].png (109 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Temp\mypcbackup_ww.temp (327 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Temp\aff_setup.exe (18277 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\RM4KMRI1\aff_setup[1].exe (20065 bytes)
    C:\Windows\winsxs\Temp\bffed561d095cf011e0000001c0fc80f\bffed561d095cf01210000001c0fc80f_mfc90u.dll (38780 bytes)
    C:\Windows\System32\config\TxR\{016888cc-6c6f-11de-8d1d-001e0bcde3ec}.TxR.0.regtrans-ms (20440 bytes)
    C:\Windows\winsxs\Temp\eb593c62d095cf013f0000001c0fc80f\eb593c62d095cf01400000001c0fc80f_manifest (766 bytes)
    C:\Windows\winsxs\Temp\38589361d095cf01090000001c0fc80f\38589361d095cf010a0000001c0fc80f_manifest (760 bytes)
    C:\Windows\System32\config\SOFTWARE (55139 bytes)
    C:\Windows\winsxs\Temp\3a63a661d095cf010f0000001c0fc80f\9ac4a861d095cf01120000001c0fc80f_msvcp90.dll (7701 bytes)
    C:\Windows\winsxs\Temp\2da24a62d095cf01450000001c0fc80f (4 bytes)
    C:\Windows\winsxs\Temp\a7061b62d095cf012e0000001c0fc80f\07681d62d095cf01340000001c0fc80f_mfc90deu.dll (670 bytes)
    C:\Windows\System32\config\COMPONENTS{15e3db1a-917a-11e2-9ef7-000c29a8bd90}.TMContainer00000000000000000002.regtrans-ms (28680 bytes)
    C:\Windows\winsxs\Temp\b0b15061d095cf01020000001c0fc80f\10135361d095cf01050000001c0fc80f_catalog (21 bytes)
    C:\Windows\winsxs\Temp\3a63a661d095cf010f0000001c0fc80f\9ac4a861d095cf01130000001c0fc80f_msvcm90.dll (1526 bytes)
    C:\Windows\winsxs\Temp\2da24a62d095cf01450000001c0fc80f\2da24a62d095cf01480000001c0fc80f_catalog (22 bytes)
    C:\Windows\winsxs\Temp\bffed561d095cf011e0000001c0fc80f\bffed561d095cf01200000001c0fc80f_mfcm90.dll (670 bytes)
    C:\Windows\winsxs\Temp\a7061b62d095cf012e0000001c0fc80f\07681d62d095cf01360000001c0fc80f_mfc90fra.dll (670 bytes)
    C:\Windows\winsxs\Temp\a7061b62d095cf012e0000001c0fc80f\07681d62d095cf01350000001c0fc80f_mfc90enu.dll (113 bytes)
    C:\Windows\winsxs\Temp\a7061b62d095cf012e0000001c0fc80f\07681d62d095cf01390000001c0fc80f_mfc90kor.dll (95 bytes)
    C:\Windows\winsxs\Temp\a7061b62d095cf012e0000001c0fc80f\07681d62d095cf01380000001c0fc80f_mfc90jpn.dll (95 bytes)
    C:\Windows\winsxs\Temp\a7061b62d095cf012e0000001c0fc80f\07681d62d095cf01310000001c0fc80f_mfc90cht.dll (79 bytes)
    C:\Windows\winsxs\Temp\3a63a661d095cf010f0000001c0fc80f\9ac4a861d095cf01100000001c0fc80f_manifest (5 bytes)
    C:\Windows\winsxs\Temp\bdf3c261d095cf01180000001c0fc80f\bdf3c261d095cf01190000001c0fc80f_manifest (760 bytes)
    C:\Windows\winsxs\Temp\b0b15061d095cf01020000001c0fc80f\b0b15061d095cf01030000001c0fc80f_manifest (859 bytes)
    C:\Windows\winsxs\Temp\65be0c62d095cf01280000001c0fc80f\65be0c62d095cf012a0000001c0fc80f_catalog (21 bytes)
    C:\Windows\System32\config\COMPONENTS{15e3db19-917a-11e2-9ef7-000c29a8bd90}.TxR.2.regtrans-ms (856 bytes)
    C:\Windows\winsxs\Temp\a7061b62d095cf012e0000001c0fc80f\a7061b62d095cf01300000001c0fc80f_mfc90chs.dll (78 bytes)
    C:\Windows\winsxs\Temp\cf4b5b62d095cf014c0000001c0fc80f\cf4b5b62d095cf014d0000001c0fc80f_manifest (676 bytes)
    C:\Windows\Logs\CBS\CBS.log (87992 bytes)
    C:\Windows\winsxs\ManifestCache\a786a517e28d5687_blobs.bin (4409 bytes)
    C:\Windows\winsxs\Temp\bffed561d095cf011e0000001c0fc80f\bffed561d095cf011f0000001c0fc80f_manifest (6 bytes)
    C:\Windows\winsxs\Temp\a7061b62d095cf012e0000001c0fc80f\07681d62d095cf013b0000001c0fc80f_catalog (21 bytes)
    C:\Windows\winsxs\Temp\3a63a661d095cf010f0000001c0fc80f\9ac4a861d095cf01110000001c0fc80f_msvcr90.dll (4811 bytes)
    C:\Windows\System32\config\COMPONENTS{15e3db19-917a-11e2-9ef7-000c29a8bd90}.TxR.0.regtrans-ms (76489 bytes)
    C:\Windows\System32\config\COMPONENTS{15e3db19-917a-11e2-9ef7-000c29a8bd90}.TxR.1.regtrans-ms (856 bytes)
    C:\Windows\winsxs\Temp\a7061b62d095cf012e0000001c0fc80f\a7061b62d095cf012f0000001c0fc80f_manifest (13 bytes)
    C:\Windows\winsxs\Temp\eb593c62d095cf013f0000001c0fc80f\eb593c62d095cf01410000001c0fc80f_catalog (21 bytes)
    C:\Windows\winsxs\Temp\a7061b62d095cf012e0000001c0fc80f\07681d62d095cf013a0000001c0fc80f_mfc90rus.dll (127 bytes)
    C:\Windows\winsxs\Temp\2da24a62d095cf01450000001c0fc80f\2da24a62d095cf01460000001c0fc80f_manifest (864 bytes)
    C:\Windows\winsxs\Temp\3a63a661d095cf010f0000001c0fc80f\9ac4a861d095cf01140000001c0fc80f_catalog (21 bytes)
    C:\Windows\System32\config\TxR\{016888cc-6c6f-11de-8d1d-001e0bcde3ec}.TxR.blf (1640 bytes)
    C:\Windows\winsxs\Temp\b0b15061d095cf01020000001c0fc80f\b0b15061d095cf01040000001c0fc80f_atl90.dll (853 bytes)
    C:\Windows\System32\config\SYSTEM.LOG1 (4395 bytes)
    C:\Windows\winsxs\Temp\65be0c62d095cf01280000001c0fc80f\65be0c62d095cf01290000001c0fc80f_manifest (760 bytes)
    C:\Windows\winsxs\Temp\a7061b62d095cf012e0000001c0fc80f\07681d62d095cf01320000001c0fc80f_mfc90esn.dll (130 bytes)
    C:\Windows\System32\config\SOFTWARE.LOG1 (58998 bytes)
    C:\Windows\System32\config\TxR\{016888cd-6c6f-11de-8d1d-001e0bcde3ec}.TMContainer00000000000000000002.regtrans-ms (14808 bytes)
    C:\Windows\winsxs\Temp\bffed561d095cf011e0000001c0fc80f\80c1da61d095cf01230000001c0fc80f_mfcm90u.dll (670 bytes)
    C:\Windows\winsxs\Temp\a7061b62d095cf012e0000001c0fc80f\07681d62d095cf01370000001c0fc80f_mfc90ita.dll (129 bytes)
    C:\Windows\System32\config\COMPONENTS.LOG1 (195404 bytes)
    C:\Windows\winsxs\Temp\bffed561d095cf011e0000001c0fc80f\80c1da61d095cf01240000001c0fc80f_catalog (21 bytes)
    C:\Windows\winsxs\Temp\cf4b5b62d095cf014c0000001c0fc80f\cf4b5b62d095cf014e0000001c0fc80f_catalog (22 bytes)
    C:\Windows\winsxs\Temp\bffed561d095cf011e0000001c0fc80f\1f60d861d095cf01220000001c0fc80f_mfc90.dll (38780 bytes)
    C:\Windows\winsxs\Temp\bdf3c261d095cf01180000001c0fc80f\bdf3c261d095cf011a0000001c0fc80f_catalog (21 bytes)
    C:\Windows\System32\config\COMPONENTS{15e3db19-917a-11e2-9ef7-000c29a8bd90}.TxR.blf (8230 bytes)
    C:\Windows\winsxs\Temp\2da24a62d095cf01450000001c0fc80f\2da24a62d095cf01470000001c0fc80f_vcomp90.dll (120 bytes)
    C:\Windows\winsxs\Temp\a7061b62d095cf012e0000001c0fc80f\07681d62d095cf01330000001c0fc80f_mfc90esp.dll (130 bytes)
    C:\Windows\winsxs\Temp\38589361d095cf01090000001c0fc80f\98b99561d095cf010b0000001c0fc80f_catalog (21 bytes)
    C:\54383a505f02045ba70726cebb\eula.1042.txt (650 bytes)
    C:\54383a505f02045ba70726cebb\install.ini (844 bytes)
    C:\54383a505f02045ba70726cebb\eula.1033.txt (10 bytes)
    C:\54383a505f02045ba70726cebb\Program Files(64)\Microsoft Visual Studio 9.0\Vc7\WinSXS\AMD64 catalogs\Microsoft.VC90.DebugCRT.cat (9 bytes)
    C:\54383a505f02045ba70726cebb\Program Files(64)\Microsoft Visual Studio 9.0\Vc7\WinSXS\AMD64 catalogs\policy.9.00.Microsoft.VC90.CRT.cat (630 bytes)
    C:\54383a505f02045ba70726cebb\eula.1040.txt (657 bytes)
    C:\54383a505f02045ba70726cebb\install.res.2052.dll (1632 bytes)
    C:\54383a505f02045ba70726cebb\install.res.1042.dll (1988 bytes)
    C:\54383a505f02045ba70726cebb\Program Files(64)\Microsoft Visual Studio 9.0\Vc7\WinSXS\AMD64 catalogs\Microsoft.VC90.CRT.cat (9 bytes)
    C:\54383a505f02045ba70726cebb\Program Files(64)\Microsoft Visual Studio 9.0\Vc7\WinSXS\AMD64 catalogs\policy.9.00.Microsoft.VC90.ATL.cat (9 bytes)
    C:\54383a505f02045ba70726cebb\$shtdwn$.req (788 bytes)
    C:\54383a505f02045ba70726cebb\eula.1036.txt (12 bytes)
    C:\54383a505f02045ba70726cebb\eula.3082.txt (12 bytes)
    C:\54383a505f02045ba70726cebb\Program Files(64)\Microsoft Visual Studio 9.0\Vc7\WinSXS\AMD64 catalogs\Microsoft.VC90.MFCLOC.cat (9 bytes)
    C:\54383a505f02045ba70726cebb\install.res.1031.dll (1160 bytes)
    C:\54383a505f02045ba70726cebb\eula.2052.txt (3 bytes)
    C:\54383a505f02045ba70726cebb\install.res.1040.dll (2110 bytes)
    C:\54383a505f02045ba70726cebb\vc_red.cab (65618 bytes)
    C:\54383a505f02045ba70726cebb\Program Files(64)\Microsoft Visual Studio 9.0\Vc7\WinSXS\AMD64 catalogs\policy.9.00.Microsoft.VC90.MFC.cat (658 bytes)
    C:\54383a505f02045ba70726cebb\Program Files(64)\Microsoft Visual Studio 9.0\Vc7\WinSXS\AMD64 catalogs\Microsoft.VC90.ATL.cat (155 bytes)
    C:\54383a505f02045ba70726cebb\install.res.1049.dll (1720 bytes)
    C:\54383a505f02045ba70726cebb\Program Files(64)\Microsoft Visual Studio 9.0\Vc7\WinSXS\AMD64 catalogs\policy.9.00.Microsoft.VC90.OpenMP.cat (297 bytes)
    C:\54383a505f02045ba70726cebb\Program Files(64)\Microsoft Visual Studio 9.0\Vc7\WinSXS\AMD64 catalogs\Microsoft.VC90.DebugMFC.cat (9 bytes)
    C:\54383a505f02045ba70726cebb\eula.1049.txt (13 bytes)
    C:\54383a505f02045ba70726cebb\install.res.1036.dll (1355 bytes)
    C:\54383a505f02045ba70726cebb\vc_red.msi (3176 bytes)
    C:\54383a505f02045ba70726cebb\Program Files(64)\Microsoft Visual Studio 9.0\Vc7\WinSXS\AMD64 catalogs\policy.9.00.Microsoft.VC90.DebugCRT.cat (9 bytes)
    C:\54383a505f02045ba70726cebb\globdata.ini (1 bytes)
    C:\54383a505f02045ba70726cebb\Program Files(64)\Microsoft Visual Studio 9.0\Vc7\WinSXS\AMD64 catalogs\Microsoft.VC90.DebugOpenMP.cat (9 bytes)
    C:\54383a505f02045ba70726cebb\vcredist.bmp (5 bytes)
    C:\54383a505f02045ba70726cebb\eula.1041.txt (5 bytes)
    C:\54383a505f02045ba70726cebb\Program Files(64)\Microsoft Visual Studio 9.0\Vc7\WinSXS\AMD64 catalogs\policy.9.00.Microsoft.VC90.DebugMFC.cat (236 bytes)
    C:\54383a505f02045ba70726cebb\Program Files(64)\Microsoft Visual Studio 9.0\Vc7\WinSXS\AMD64 catalogs\Microsoft.VC90.MFC.cat (9 bytes)
    C:\54383a505f02045ba70726cebb\install.exe (13918 bytes)
    C:\54383a505f02045ba70726cebb\install.res.3082.dll (989 bytes)
    C:\54383a505f02045ba70726cebb\eula.1028.txt (3 bytes)
    C:\54383a505f02045ba70726cebb\install.res.1028.dll (1130 bytes)
    C:\54383a505f02045ba70726cebb\Program Files(64)\Microsoft Visual Studio 9.0\Vc7\WinSXS\AMD64 catalogs\Microsoft.VC90.OpenMP.cat (9 bytes)
    C:\54383a505f02045ba70726cebb\Program Files(64)\Microsoft Visual Studio 9.0\Vc7\WinSXS\AMD64 catalogs\policy.9.00.Microsoft.VC90.DebugOpenMP.cat (9 bytes)
    C:\54383a505f02045ba70726cebb\eula.1031.txt (229 bytes)
    C:\54383a505f02045ba70726cebb\install.res.1041.dll (1126 bytes)
    C:\54383a505f02045ba70726cebb\Program Files(64)\Microsoft Visual Studio 9.0\Vc7\WinSXS\AMD64 catalogs\policy.9.00.Microsoft.VC90.MFCLOC.cat (9 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\3Y5KZMDN\btappCAOTAHKC.js (673 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\YL7ROG0G\collect[2].gif (35 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\YL7ROG0G\gui[3].js (599 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\RM4KMRI1\btappCACMKZ4X.js (693 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\YL7ROG0G\btappCAN3LJEL.js (25 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\RM4KMRI1\logo.2c586cc7a3f8c7e684be335d22b13d8d[1].png (988 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\YL7ROG0G\btappCA9487S3.js (44 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\YL7ROG0G\btapp[4].js (44 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Roaming\uTorrent\apps\72F0D3E2141065DACF6134D07A06A2DF20590748 (4 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\WBDJL3LL\btappCAJLQGA4.js (434 bytes)
    C:\Users\"%CurrentUserName%"\Downloads\Somewhere Else\01 - Zeds Dead (feat. Twin Shadow) - Lost You (Official Music Video).mp4 (45687 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\WBDJL3LL\btapp[10].js (44 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\YL7ROG0G\btappCAJB4CG5.js (44 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\YL7ROG0G\btappCABSFWYL.js (556 bytes)
    C:\Users\"%CurrentUserName%"\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\7D266D9E1E69FA1EEFB9699B009B34C8_0A9BFDD75B598C2110CBF610C078E6E6 (1 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\WBDJL3LL\btappCAIHVX1F.js (44 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\WBDJL3LL\btappCA4U6SRR.js (44 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\RM4KMRI1\guiCA21OWJN.js (601 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\WBDJL3LL\btappCAYE1AA4.js (44 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\3Y5KZMDN\__utm[1].gif (35 bytes)
    C:\Users\"%CurrentUserName%"\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\23B523C9E7746F715D33C6527C18EB9D (1 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\RM4KMRI1\btappCAIP1IYS.js (44 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\3Y5KZMDN\btappCA778LC6.js (44 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\YL7ROG0G\btappCAXR4HNZ.js (676 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\WBDJL3LL\btappCAASGOOL.js (235 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\3Y5KZMDN\gui[3].js (587 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Roaming\uTorrent\apps\plus.btapp.new (796 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\YL7ROG0G\version[1].json (511 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\3Y5KZMDN\btapp[10].js (44 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\3Y5KZMDN\gui[4].js (644 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Roaming\Microsoft\Windows\Cookies\3MXDA1LM.txt (93 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\RM4KMRI1\gui[1].js (580 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\RM4KMRI1\mobile-payment[1].png (1601 bytes)
    C:\Users\"%CurrentUserName%"\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\C46E7B0F942663A1EDC8D9D6D7869173_42820CDFEA41DC84AAB89A6B63561873 (1496 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\RM4KMRI1\btappCAMY9X6B.js (524 bytes)
    C:\Users\"%CurrentUserName%"\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\1060B7ADDE0FF6DE85637BF89FC4CEBC_49ED5C6881BAA22BDB94D2786FA54449 (1480 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\YL7ROG0G\btappCALM4ZI7.js (44 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\WBDJL3LL\fontawesome-webfont.8b27bc96115c2d24350f0d09e6a9433f[1].eot (23601 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\WBDJL3LL\btappCAYX2SIW.js (618 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\RM4KMRI1\btappCA5AL4HI.js (434 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\3Y5KZMDN\btappCARLJ5L7.js (44 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\YL7ROG0G\btappCANSH0L2.js (76 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\RM4KMRI1\btappCA1XXCQY.js (434 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\YL7ROG0G\btappCANHU5TD.js (44 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\YL7ROG0G\btappCAX40LOW.js (44 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\YL7ROG0G\btappCANDH1UE.js (561 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\3Y5KZMDN\btapp[6].js (44 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\WBDJL3LL\btappCAP9X0YK.js (44 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Temp\utt6BA3.tmp (9760 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\3Y5KZMDN\btappCAI1SEDV.js (912 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\WBDJL3LL\btappCAK62SP0.js (44 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\WBDJL3LL\guiCAV1ZLRH.js (645 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\YL7ROG0G\e[2].htm (63 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\YL7ROG0G\btappCA963F70.js (44 bytes)
    C:\Users\"%CurrentUserName%"\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\7B8944BA8AD0EFDF0E01A43EF62BECD0_251DAA28139FC527316726DEB16CC0E9 (1 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\RM4KMRI1\btappCAZ7TZ21.js (25 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\3Y5KZMDN\icon[2].ico (200 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\3Y5KZMDN\gui[7].js (599 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Roaming\uTorrent\apps\72F0D3E2141065DACF6134D07A06A2DF20590748\btapp (196 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\WBDJL3LL\btappCABEADLJ.js (44 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\YL7ROG0G\jquery.min[1].js (53489 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\RM4KMRI1\btappCAZ6PAOM.js (25 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\RM4KMRI1\btappCAHO2WZM.js (44 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\3Y5KZMDN\btappCAB6S9W0.js (878 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\RM4KMRI1\gui[4].js (644 bytes)
    C:\Users\"%CurrentUserName%"\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\0D6ED27B76F0582A8D2120DF24D1E180_B52DB0DD355A2D437E4D65686FF6F4AD (1448 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\WBDJL3LL\btappCA0MBQNV.js (44 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\YL7ROG0G\other[1].png (1213 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\WBDJL3LL\btapp[8].js (44 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\3Y5KZMDN\btappCAWCJC1T.js (25 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\WBDJL3LL\btappCA5OHO0O.js (526 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\RM4KMRI1\btappCAH68RE4.js (44 bytes)
    C:\Users\"%CurrentUserName%"\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\8059E9A0D314877E40FE93D8CCFB3C69_631D72ECDAF6CA83C992AE241849F034 (1432 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\YL7ROG0G\btappCAFGFLHM.js (434 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\RM4KMRI1\gui[3].js (644 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\WBDJL3LL\btappCAACE0LB.js (44 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\WBDJL3LL\btapp[2].js (431 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\3Y5KZMDN\btappCA210BHZ.js (556 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Roaming\uTorrent\dlimagecache\1B484B7F8E392004E0C4152F6E4FF038101F7EDE (5821 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\WBDJL3LL\btappCAWRJFH4.js (434 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\3Y5KZMDN\btapp[2].js (145 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\RM4KMRI1\fileserve[1].js (42281 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Roaming\uTorrent\utorrent.lng (1 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\3Y5KZMDN\btappCALXCXAG.js (815 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\WBDJL3LL\guiCAV65NEG.js (598 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\3Y5KZMDN\icon[3].ico (200 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\YL7ROG0G\nr-411.min[1].js (5834 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\YL7ROG0G\ut-premium-logo[1].png (2529 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\RM4KMRI1\btappCA2YAXJ4.js (44 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\WBDJL3LL\gui[5].js (588 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\3Y5KZMDN\btappCAX1X2DB.js (44 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\RM4KMRI1\btappCAFQXV1H.js (44 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\3Y5KZMDN\btappCA96VO2K.js (528 bytes)
    C:\Users\"%CurrentUserName%"\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\7B8944BA8AD0EFDF0E01A43EF62BECD0_251DAA28139FC527316726DEB16CC0E9 (1504 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\3Y5KZMDN\btappCAD467JM.js (44 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\3Y5KZMDN\gui[6].js (645 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\WBDJL3LL\btapp[1].js (1585 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\YL7ROG0G\btappCAFU1UP5.js (25 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\WBDJL3LL\gui[9].js (594 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\WBDJL3LL\btappCAH4KFBG.js (44 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\YL7ROG0G\index[1].htm (3446 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\RM4KMRI1\btappCAUSRT22.js (518 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\3Y5KZMDN\collect[3].gif (35 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\3Y5KZMDN\icon[4].ico (200 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\WBDJL3LL\btapp[6].js (361 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\WBDJL3LL\MTP_ySUJH_bn48VBG8sNSnZ2MAKAc2x4R1uOSeegc5U[1].eot (14266 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\3Y5KZMDN\btappCA3FWYSL.js (1 bytes)
    C:\Users\"%CurrentUserName%"\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\C46E7B0F942663A1EDC8D9D6D7869173_42820CDFEA41DC84AAB89A6B63561873 (1 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\RM4KMRI1\guiCAR17YG6.js (645 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\YL7ROG0G\btappCA3JEIHI.js (700 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\WBDJL3LL\btappCA1TJFK9.js (717 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\WBDJL3LL\btapp[4].js (383 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\3Y5KZMDN\btappCAALBUUU.js (527 bytes)
    C:\Users\"%CurrentUserName%"\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\D47DBD2F9E3365FBBE008D71FB06716F_D33192D58AA9CA2B9097E848E9FE86DE (1 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\RM4KMRI1\btappCA39HSJF.js (44 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\WBDJL3LL\fileserve[1].js (917 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\WBDJL3LL\btappCA5R7NCY.js (25 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\YL7ROG0G\btappCAE7J16R.js (44 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\YL7ROG0G\btappCAQBQCRY.js (614 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\YL7ROG0G\btapp[10].js (521 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\RM4KMRI1\btappCA00E5GV.js (25 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\WBDJL3LL\oigklpHfR96yCGJVAjuK_Zeds Dead Press Photo 2014[1].jpg (93008 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\RM4KMRI1\btappCAKM05J7.js (890 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\3Y5KZMDN\btapp[7].js (44 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\3Y5KZMDN\btapp[9].js (352 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\YL7ROG0G\e[1].htm (63 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\WBDJL3LL\btapp[3].js (44 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\RM4KMRI1\btappCA7C4UE2.js (564 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\3Y5KZMDN\btappCA5CLTO0.js (44 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\YL7ROG0G\paypal[1].png (1345 bytes)
    C:\Users\"%CurrentUserName%"\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\0D6ED27B76F0582A8D2120DF24D1E180_B52DB0DD355A2D437E4D65686FF6F4AD (1 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\YL7ROG0G\btapp[9].js (44 bytes)
    C:\Users\"%CurrentUserName%"\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\23B523C9E7746F715D33C6527C18EB9D (876 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\RM4KMRI1\btappCAUX0ZW2.js (44 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Roaming\uTorrent\apps\D944B3378FAB35793B7951FA53E41B2AB9CC462B\empty_movie.gif (282 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\3Y5KZMDN\btappCAQX3FCF.js (44 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Roaming\uTorrent\apps\D944B3378FAB35793B7951FA53E41B2AB9CC462B\info_icon.png (250 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\RM4KMRI1\btappCAV6EYCH.js (44 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\YL7ROG0G\btapp[2].js (44 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\WBDJL3LL\btapp[9].js (44 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\RM4KMRI1\btappCA2XITXU.js (671 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\YL7ROG0G\btappCAPJ3ACS.js (500 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\WBDJL3LL\btappCA048LH9.js (44 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\WBDJL3LL\btapp[5].js (44 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Roaming\uTorrent\apps\72F0D3E2141065DACF6134D07A06A2DF20590748\index.js (1 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\YL7ROG0G\btappCAJHYB4S.js (44 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\YL7ROG0G\gui[4].js (645 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\RM4KMRI1\fontawesome-webfont.3293616ec0c605c7c2db25829a0a509e[1].woff (30247 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Roaming\uTorrent\apps\D944B3378FAB35793B7951FA53E41B2AB9CC462B\index.html (3 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\RM4KMRI1\btappCA5LHIR0.js (44 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\3Y5KZMDN\gui[8].js (645 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Roaming\uTorrent\apps\72F0D3E2141065DACF6134D07A06A2DF20590748\index.html (1 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\RM4KMRI1\gui[10].js (600 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\RM4KMRI1\jquery.min[1].js (62159 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Roaming\Microsoft\Crypto\RSA\S-1-5-21-2858020935-2156992550-3658131804-1003\fa5cdd5fe742f2b4881510ea4f5e4af8_c0322acd-5e5d-42f0-b163-c591ee6ff5b9 (80 bytes)
    C:\Users\"%CurrentUserName%"\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\D47DBD2F9E3365FBBE008D71FB06716F_D33192D58AA9CA2B9097E848E9FE86DE (1520 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\3Y5KZMDN\btappCAM5BHA1.js (703 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\YL7ROG0G\gui[1].js (588 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Roaming\uTorrent\updates\2ebed0.lng (1 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Roaming\uTorrent\apps\72F0D3E2141065DACF6134D07A06A2DF20590748\main.css (946 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\YL7ROG0G\btappCAHVY1OA.js (432 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\RM4KMRI1\btapp[1].js (64 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\RM4KMRI1\btappCAQS5F6O.js (587 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\3Y5KZMDN\btapp[5].js (331 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\YL7ROG0G\css[1].css (25 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\YL7ROG0G\btappCAIJXTHP.js (44 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\YL7ROG0G\ga[1].js (25856 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\RM4KMRI1\btapp[11].js (404 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\RM4KMRI1\streaming[1].js (489 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\3Y5KZMDN\btappCAD3XICN.js (44 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Roaming\Microsoft\Windows\Cookies\NMVVK3JL.txt (146 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\YL7ROG0G\btapp[8].js (44 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\YL7ROG0G\btappCA4QWBF0.js (44 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\3Y5KZMDN\btappCASPOAP0.js (44 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Roaming\uTorrent\apps\welcome-upsell.btapp (28 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\YL7ROG0G\btappCA5TV6CN.js (44 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\WBDJL3LL\btappCA6EP25E.js (44 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\WBDJL3LL\btappCABZ84EW.js (775 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\YL7ROG0G\btappCAIXQKVD.js (1 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\YL7ROG0G\collect[1].gif (35 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\3Y5KZMDN\btappCAYR54VH.js (25 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\RM4KMRI1\btappCAUCRJ2V.js (44 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\WBDJL3LL\e[2].htm (63 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\3Y5KZMDN\collect[2].gif (35 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Roaming\uTorrent\dlimagecache\F70279A5F7D321E839A0873E003F124BD9C287BF (3615 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Roaming\uTorrent\updates\3.4.2_32176.exe (50 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\WBDJL3LL\btappCAVQQE14.js (44 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\3Y5KZMDN\client2[1].js (6611 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\WBDJL3LL\btappCAG3TACF.js (44 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\3Y5KZMDN\btappCAHLEACN.js (44 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\3Y5KZMDN\btappCAX9P68Z.js (405 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Roaming\uTorrent\dlimagecache\10E6FBE4D921B475FA5FEC6E9A535A540D6FEED1 (318 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\YL7ROG0G\btappCATG3807.js (44 bytes)
    C:\Users\"%CurrentUserName%"\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\1060B7ADDE0FF6DE85637BF89FC4CEBC_49ED5C6881BAA22BDB94D2786FA54449 (1 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\3Y5KZMDN\btappCAS4LXX1.js (527 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\YL7ROG0G\btappCAKIQXE3.js (44 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Roaming\uTorrent\apps\player.btapp (3 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\3Y5KZMDN\btappCAOXC37A.js (1 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\YL7ROG0G\btappCARZB9ET.js (994 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\YL7ROG0G\DXI1ORHCpsQm3Vp6mXoaTXZ2MAKAc2x4R1uOSeegc5U[1].eot (11583 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\3Y5KZMDN\visa-mastercard[1].png (2207 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Roaming\uTorrent\trusted\bittorrent.crt (974 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\YL7ROG0G\btappCAU7PWD5.js (828 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\WBDJL3LL\btappCA90I9LP.js (523 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\3Y5KZMDN\btappCA4IC4EI.js (44 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Temp\utt60D6.tmp (11855 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\RM4KMRI1\btapp[8].js (44 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\WBDJL3LL\btappCAWUHN3F.js (44 bytes)
    C:\Users\"%CurrentUserName%"\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\49514950C94E8026A2B06312597DFF49_569BD946168DB279A65378F7D088CFD0 (1 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\YL7ROG0G\btappCA629LMC.js (44 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\WBDJL3LL\base.fcc9358c8aaae43d85b310d2804259c0.gz[1].js (112243 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\RM4KMRI1\btapp[5].js (44 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Roaming\Microsoft\Windows\Cookies\9XQA70PW.txt (93 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Roaming\Microsoft\Windows\Cookies\V21PO3O0.txt (91 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\RM4KMRI1\btapp[9].js (352 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\YL7ROG0G\8b9486d826[1].js (21 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\RM4KMRI1\btapp[2].js (63 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\WBDJL3LL\btappCARN147M.js (406 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\RM4KMRI1\btappCAIDRGA2.js (563 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\RM4KMRI1\btappCA80ANGI.js (528 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Roaming\Microsoft\Windows\Cookies\OHD0ACBN.txt (133 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\RM4KMRI1\modernizr.gz[1].js (5898 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\RM4KMRI1\btapp[7].js (218 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\WBDJL3LL\gui[8].js (588 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\WBDJL3LL\btappCA0MI4SC.js (1 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\RM4KMRI1\btappCAQAHJIQ.js (526 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\WBDJL3LL\cJZKeOuBrn4kERxqtaUH3fY6323mHUZFJMgTvxaG2iE[1].eot (13365 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\RM4KMRI1\btappCA9PXKS9.js (44 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\RM4KMRI1\btapp[6].js (44 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\WBDJL3LL\gui[6].js (644 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\RM4KMRI1\btapp[3].js (111 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\RM4KMRI1\gui[9].js (599 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\YL7ROG0G\btappCABW9F69.js (406 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\RM4KMRI1\btappCACM5MQ5.js (716 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\YL7ROG0G\btappCA4PP5LM.js (25 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\3Y5KZMDN\btappCA87F6CC.js (982 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\WBDJL3LL\guiCABUB5LG.js (646 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Roaming\uTorrent\apps\72F0D3E2141065DACF6134D07A06A2DF20590748\icon.bmp (1 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Roaming\Microsoft\Windows\Cookies\0PV85N9Z.txt (300 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\RM4KMRI1\styles[1].css (2314 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\YL7ROG0G\btappCAEM9EFW.js (44 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\3Y5KZMDN\btappCA0SHLHE.js (44 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\3Y5KZMDN\btappCAQWS4UB.js (44 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Roaming\uTorrent\updates.dat (4237 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\YL7ROG0G\btappCAJOTHEK.js (25 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\WBDJL3LL\btappCAQ9U81J.js (528 bytes)
    C:\Users\"%CurrentUserName%"\Downloads\Somewhere Else\00_What's-Inside.html (3 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\YL7ROG0G\btappCAC9K4T3.js (44 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\RM4KMRI1\btappCAGNGETW.js (556 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\RM4KMRI1\btappCAK170RA.js (44 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\RM4KMRI1\btappCAQ6BBKW.js (44 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\3Y5KZMDN\btappCAS66QNZ.js (589 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\WBDJL3LL\gui[11].js (600 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\YL7ROG0G\btapp[7].js (44 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\YL7ROG0G\btappCA2JZ00R.js (44 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\3Y5KZMDN\social-sprite.3c63010ad741960298c76cf7aabd3627[1].png (1435 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\YL7ROG0G\btapp[3].js (44 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\YL7ROG0G\btappCAGT9B0L.js (674 bytes)
    C:\Users\"%CurrentUserName%"\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\49514950C94E8026A2B06312597DFF49_F4692EBD578D04048E176E82BB8369BB (1 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\WBDJL3LL\bootstrap.min[1].css (34469 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\RM4KMRI1\btappCASQ65XP.js (434 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\RM4KMRI1\public.6e99eab4adc332040f74e65e06c4942b.gz[1].css (64379 bytes)
    C:\Users\"%CurrentUserName%"\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\8059E9A0D314877E40FE93D8CCFB3C69_631D72ECDAF6CA83C992AE241849F034 (463 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\YL7ROG0G\btappCAYM14ER.js (704 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\3Y5KZMDN\btappCA9M4812.js (432 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\YL7ROG0G\btappCATWWPG9.js (524 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\3Y5KZMDN\btappCAGVHF75.js (564 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\WBDJL3LL\btapp[7].js (232 bytes)
    C:\Users\"%CurrentUserName%"\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\49514950C94E8026A2B06312597DFF49_569BD946168DB279A65378F7D088CFD0 (1158 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\RM4KMRI1\analytics[1].js (17373 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\RM4KMRI1\gui[5].js (588 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\RM4KMRI1\btappCA4EU6T6.js (44 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\YL7ROG0G\ecommerce[1].js (25 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\YL7ROG0G\btapp[11].js (44 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Roaming\uTorrent\settings.dat.new (73 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Roaming\uTorrent\Somewhere Else.torrent (26 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\WBDJL3LL\btappCAORHTYW.js (25 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\3Y5KZMDN\icon[1].ico (200 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\YL7ROG0G\btappCA2YL915.js (44 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\3Y5KZMDN\icon[5].ico (200 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\RM4KMRI1\gui[11].js (645 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\RM4KMRI1\btapp[10].js (571 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\WBDJL3LL\btappCA60IRQ9.js (44 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Roaming\uTorrent\apps\D944B3378FAB35793B7951FA53E41B2AB9CC462B\x.png (265 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\WBDJL3LL\guiCAYOMHHW.js (645 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\RM4KMRI1\gui[8].js (645 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\RM4KMRI1\e[2].htm (63 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\WBDJL3LL\gui[1].js (587 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\RM4KMRI1\fileserve[1].png (200 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\WBDJL3LL\btappCA76YDBI.js (44 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\3Y5KZMDN\btappCALGLIDR.js (527 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\3Y5KZMDN\amex-discover[1].png (2529 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\WBDJL3LL\btappCA893JQU.js (674 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\RM4KMRI1\gui[2].js (586 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\3Y5KZMDN\btappCAYV6RLD.js (44 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\RM4KMRI1\btappCA16OKIJ.js (25 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\YL7ROG0G\btappCA0HQ2IF.js (25 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\WBDJL3LL\btappCAJ86T5M.js (434 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Roaming\Microsoft\Windows\Cookies\6T8M8RS9.txt (146 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\RM4KMRI1\btappCAKQNK1W.js (44 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\RM4KMRI1\btapp[4].js (44 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\3Y5KZMDN\icon[6].ico (200 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\YL7ROG0G\btappCA2DIY6N.js (702 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\3Y5KZMDN\collect[1].gif (35 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\WBDJL3LL\gui[4].js (644 bytes)
    C:\Users\"%CurrentUserName%"\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\49514950C94E8026A2B06312597DFF49_F4692EBD578D04048E176E82BB8369BB (1360 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\3Y5KZMDN\btappCAUV541P.js (25 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\3Y5KZMDN\btappCADPZUWT.js (44 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\3Y5KZMDN\btappCAQEA4DS.js (25 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\RM4KMRI1\btappCAIJ2BFK.js (44 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\WBDJL3LL\gui[3].js (585 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\RM4KMRI1\btappCAUF2REB.js (44 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\YL7ROG0G\bundle-logo-large.4a053bd30f5bb3329130cf4fc49d0d73[1].png (987 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\YL7ROG0G\btapp[1].js (109 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\3Y5KZMDN\btappCAV05NPV.js (25 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\RM4KMRI1\devices-02[1].png (2403 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Roaming\Microsoft\Windows\Cookies\IEI7BOL6.txt (633 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\WBDJL3LL\btappCAB041E2.js (528 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\3Y5KZMDN\btapp[11].js (551 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\YL7ROG0G\btapp[6].js (44 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\3Y5KZMDN\btapp[8].js (44 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\YL7ROG0G\blank[1].htm (109 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\YL7ROG0G\gui[2].js (617 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\WBDJL3LL\ribbon[1].png (2207 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\3Y5KZMDN\btappCAWY7ST5.js (44 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\WBDJL3LL\btapp[11].js (44 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\YL7ROG0G\btappCA24VUAH.js (702 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\RM4KMRI1\collect[1].gif (35 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\3Y5KZMDN\btappCAWA29F5.js (684 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\3Y5KZMDN\btappCAT9WB3C.js (406 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\WBDJL3LL\icon-close[1].png (235 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Temp\utt6038.tmp.new (2 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Temp\utt60D5.tmp (693 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\WBDJL3LL\gui[7].js (645 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\WBDJL3LL\btappCAC7JF1R.js (993 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Roaming\Microsoft\Windows\Cookies\B8TRNDGE.txt (339 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\3Y5KZMDN\btapp[1].js (64 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\WBDJL3LL\e[1].htm (63 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\3Y5KZMDN\fileserve[1].js (505 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\YL7ROG0G\btappCAU0AT4E.js (558 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\3Y5KZMDN\btappCAGEBRJD.js (640 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\RM4KMRI1\gui[6].js (598 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\3Y5KZMDN\4nXTCoozQ8OBGW8wolSQ_zd_somewhere_else_final[1].jpg (14411 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\RM4KMRI1\btappCAUDQNXH.js (44 bytes)
    C:\Users\"%CurrentUserName%"\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\7D266D9E1E69FA1EEFB9699B009B34C8_0A9BFDD75B598C2110CBF610C078E6E6 (1212 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Roaming\Microsoft\Windows\Cookies\LCR0UH4E.txt (633 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\RM4KMRI1\btappCAWD74G7.js (44 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\YL7ROG0G\btappCAHS2FO6.js (556 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Internet Explorer\DOMStore\DRT4YCWO\bundles.bittorrent[1].xml (3071 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\YL7ROG0G\btappCADGI316.js (1 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Roaming\uTorrent\apps\featuredContent.btapp.new (19 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Roaming\uTorrent\updates\3.4.1_31105.exe (10815 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\3Y5KZMDN\btappCA7TBH0K.js (44 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\RM4KMRI1\badge_itunes-lrg[1].png (5 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\WBDJL3LL\css[1].css (25 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\YL7ROG0G\btapp[5].js (44 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\3Y5KZMDN\btapp[3].js (44 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\RM4KMRI1\e[1].htm (63 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\YL7ROG0G\fileserve[1].css (73 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\WBDJL3LL\guiCAGRIGUN.js (602 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Roaming\uTorrent\apps\D944B3378FAB35793B7951FA53E41B2AB9CC462B\vid_thumb.jpg (23 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\3Y5KZMDN\gui[5].js (597 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\WBDJL3LL\btappCACNHOSQ.js (44 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\3Y5KZMDN\gui[1].js (582 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\YL7ROG0G\btappCAUTA572.js (786 bytes)
    C:\Users\"%CurrentUserName%"\Downloads\Somewhere Else\02 - Zeds Dead x Memorecks - Love Me.mp3 (1078 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\RM4KMRI1\gui[7].js (645 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\YL7ROG0G\btappCANXT65X.js (44 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\WBDJL3LL\public.b32f033b6c29a80cf06b5ef8d8265b05.gz[1].js (95219 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\3Y5KZMDN\gui[2].js (617 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Roaming\uTorrent\apps\D944B3378FAB35793B7951FA53E41B2AB9CC462B\btapp (201 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\WBDJL3LL\btappCATBT11Q.js (44 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\3Y5KZMDN\btapp[4].js (44 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\WBDJL3LL\79b5f927c68a0bc7f648e016404705ab4f86772403bfbd9c089194fbebe30203[1].htm (6497 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\3Y5KZMDN\laptop-free[1].png (1 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\3Y5KZMDN\btappCAB198YI.js (925 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\3Y5KZMDN\btappCAWQ9GOB.js (44 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\RM4KMRI1\devices-01[1].png (865 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Roaming\uTorrent\dlimagecache\165F6EF40A81DD175FFAEA69E77ABFD30B27E71C (119 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\WBDJL3LL\gui[2].js (639 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\WBDJL3LL\gui[10].js (645 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Roaming\uTorrent\dlimagecache\06916B614AFE15475B00E95D2B77B0E8E5F34CE3 (8492 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\WBDJL3LL\btappCAL8JXE2.js (25 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\History\desktop.ini (224 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\WBDJL3LL\main[1].js (314 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Roaming\uTorrent\app.1404290028.tmp (1568 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\RM4KMRI1\btappCAB0KCU7.js (527 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\WBDJL3LL\btappCAP7YO57.js (628 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\3Y5KZMDN\btappCA0Y0KCM.js (44 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\WBDJL3LL\btappCAMGHUEY.js (44 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\WBDJL3LL\btappCAZJAUXF.js (44 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\3Y5KZMDN\btappCAN2SLR7.js (25 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Roaming\uTorrent\apps\D944B3378FAB35793B7951FA53E41B2AB9CC462B\main.css (6 bytes)
    C:\Users\"%CurrentUserName%"\Desktop\µTorrent.lnk (811 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Roaming\Microsoft\Windows\Cookies\WHLZDAY7.txt (88 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Roaming\uTorrent\maindoc.ico (63 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Temp\offconfig.temp (1 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\YL7ROG0G\impression[1].png (109 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Temp\uttDD87.tmp.new (82 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Temp\utt5F94.tmp.new (2 bytes)
    C:\Users\"%CurrentUserName%"\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\77EC63BDA74BD0D0E0426DC8F8008506 (656 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\WBDJL3LL\impression[1].png (109 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Temp\uttD646.tmp.new (63 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Temp\TarBE03.tmp (2712 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Temp\uttD03C.tmp (603 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Temp\ADKAppsOfferManager.dll (204 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Roaming\uTorrent\uTorrent.exe (50 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Roaming\uTorrent\toolbar_offer.benc (3 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Roaming\uTorrent\toolbar.benc.new (63 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\RM4KMRI1\impression[1].png (109 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Temp\CabBE02.tmp (54 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Roaming\Microsoft\Windows\Start Menu\µTorrent.lnk (791 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\µTorrent.lnk (791 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Temp\uttBB91.tmp.new (2 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Roaming\Microsoft\Windows\Cookies\IP85O6D3.txt (87 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\3Y5KZMDN\offers[1].json (1250 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Temp\idlimage.temp (9705 bytes)
    C:\Users\"%CurrentUserName%"\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\57C8EDB95DF3F0AD4EE2DC2B8CFD4157 (672 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Temp\utt5372.tmp.exe (1046 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\3Y5KZMDN\dll_mypcbackup[1].jpg (8797 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Roaming\Microsoft\Crypto\RSA\S-1-5-21-2858020935-2156992550-3658131804-1003\1f91d2d17ea675d4c2c3192e241743f9_c0322acd-5e5d-42f0-b163-c591ee6ff5b9 (105 bytes)
    C:\Users\"%CurrentUserName%"\Desktop\Sync Folder.lnk (1 bytes)
    C:\Users\"%CurrentUserName%"\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\42B9A473B4DAF01285A36B4D3C7B1662_178C086B699FD6C56B804AF3EF759CB5 (1624 bytes)
    %Program Files% (x86)\MyPC Backup\Database\mpcb_settings.db-journal (31598 bytes)
    C:\Users\"%CurrentUserName%"\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\42B9A473B4DAF01285A36B4D3C7B1662_178C086B699FD6C56B804AF3EF759CB5 (471 bytes)
    C:\Users\"%CurrentUserName%"\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\66AE3BFDF94A732B262342AD2154B86E_7DD744F73D87EE469E5BC583C31249E2 (1624 bytes)
    C:\Users\"%CurrentUserName%"\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\66AE3BFDF94A732B262342AD2154B86E_7DD744F73D87EE469E5BC583C31249E2 (471 bytes)
    %Program Files% (x86)\MyPC Backup\log\WAIT_HANDLES.log (540 bytes)

  4. Delete the following value(s) in the autorun key (How to Work with System Registry):

    [HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\RunOnce]
    "APN-Stub_BTR-V7" = "C:\ProgramData\APN\APN-Stub\BTR-V7\ApnSetup.exe /install=BTR-V7 /trgb=IE /sa=1 /hpr=1 /runonce"

    [HKCU\Software\Microsoft\Windows\CurrentVersion\Run]
    "uTorrent" = "C:\Users\"%CurrentUserName%"\AppData\Roaming\uTorrent\uTorrent.exe /MINIMIZED"

  5. Clean the Temporary Internet Files folder, which may contain infected files (How to clean Temporary Internet Files folder).
  6. Reboot the computer.

*Manual removal may cause unexpected system behaviour and should be performed at your own risk.