Gen.Variant.Barys.17993_37373c71fd – Adaware

Dynamic Analysis

Payload

No specific payload has been found.

Process activity

The Trojan creates the following process(es):

cscript.exe:1920
cscript.exe:228
ping.exe:464
%original file name%.exe:1288
netsh.exe:1912
Application DataqhArTkEEiB.exe:1648

The Trojan injects its code into the following process(es):

server.exe:1760
RunDll32.exe:1660
Application DatahgMnQmyNYm.exe:1616
mshta.exe:1016

Mutexes

The following mutexes were created/opened:No objects were found.

File activity

The process %original file name%.exe:1288 makes changes in the file system.

The Trojan creates and/or writes to the following file(s):

%Documents and Settings%\%current user%\Local Settings\Application DataqhArTkEEiB.exe (24 bytes)
%Documents and Settings%\%current user%\Local Settings\Application DatahgMnQmyNYm.exe (12289 bytes)

The process RunDll32.exe:1660 makes changes in the file system.

The Trojan creates and/or writes to the following file(s):

%System%\wbem\Logs\wbemprox.log (150 bytes)

The process Application DatahgMnQmyNYm.exe:1616 makes changes in the file system.

The Trojan creates and/or writes to the following file(s):

%Documents and Settings%\%current user%\Local Settings\Temp\HYD2.tmp.1466501343\HTA\images\mediacaster\logo.png (6 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\utt1.tmp (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\HYD2.tmp.1466501343\HTA\images\main_icon.png (4 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\HYD2.tmp.1466501343\HTA\images\yandex_horz.png (8 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\HYD2.tmp.1466501343\index.hta.log (26 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\HYD2.tmp.1466501343\HTA\i18n\ru.json (9 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\HYD2.tmp.1466501343\HTA\i18n\fr.json (6 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\HYD2.tmp.1466501343\HTA\scripts\initialize.js (978 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\HYD2.tmp.1466501343\HTA\scripts\common.js (1681 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\HYD2.tmp.1466501343\HTA\styles\common.css (101 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\HYD2.tmp.1466501343\HTA\i18n\de.json (6 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\HYD2.tmp.1466501343\HTA\images\mediacaster\chrome.png (12 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\HYD2.tmp.1466501343\HTA\i18n\pt.json (6 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\HYD2.tmp.1466501343\HTA\scripts\install.js (18 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\HYD2.tmp.1466501343\HTA\install.1466501343.zip (279261 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\MPIIDWDE\desktop.ini (67 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\HYD2.tmp.1466501343\HTA\images\logo_Yandex_RU_UA_vertical.png (6 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\NWPUCJQP\desktop.ini (67 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\HYD2.tmp.1466501343\HTA\images\main_utorrent.ico (107 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\HYD2.tmp.1466501343\HTA\uninstall.hta (575 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\HYD2.tmp.1466501343\HTA\shell_scripts\check_if_cscript_is_working.js (18 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\HYD2.tmp.1466501343\HTA\index.hta (522 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\HYD2.tmp.1466501343\HTA\images\main_bittorrent.ico (103 bytes)
%Documents and Settings%\%current user%\Cookies\Current_User@localhost[1].txt (169 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\HYD2.tmp.1466501343\HTA\images\loading.gif (5 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\HYD2.tmp.1466501343\HTA\3rdparty\OCComSDK.dll (218 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\desktop.ini (67 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\HYD2.tmp.1466501343\HTA\images\yandex_horz_ru.png (7 bytes)
%Documents and Settings%\%current user%\Local Settings\History\History.IE5\desktop.ini (159 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\HYD2.tmp.1466501343\HTA\images\search_protect.png (3 bytes)
%Documents and Settings%\%current user%\Application Data\uTorrent\settings.dat.new (71 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\HYD2.tmp.1466501343\HTA\shell_scripts\shell_install_offer.js (7 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\HYD2.tmp.1466501343\HTA\images\bt_icon_48px.png (3 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\HYD2.tmp.1466501343\HTA\scripts\es5-shim.js (11 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\T4PKM6DA\desktop.ini (67 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\HYD2.tmp.1466501343\HTA\styles\installer.css (296 bytes)
%Documents and Settings%\%current user%\Cookies\Current_User@localhost[2].txt (169 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\HYD2.tmp.1466501343\HTA\i18n\it.json (6 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\HYD2.tmp.1466501343\HTA\i18n\br.json (6 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\HYD2.tmp.1466501343\HTA\images\mediacaster\internetexplorer.png (13 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\A41ESWOO\desktop.ini (67 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\HYD2.tmp.1466501343\HTA\3rdparty\OCSetupHlp.dll (5442 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\HYD2.tmp.1466501343\HTA\images\yandex_browser_setup.bmp (204 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\HYD2.tmp.1466501343\HTA\images\mediacaster\screenshot.png (40 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\HYD2.tmp.1466501343\HTA\scripts\uninstall.js (1 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\HYD2.tmp.1466501343\HTA\i18n\es.json (5 bytes)
%Documents and Settings%\%current user%\Cookies\index.dat (788 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\HYD2.tmp.1466501343\HTA\images\mediacaster\firefox.png (14 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\HYD2.tmp.1466501343\HTA\shell_scripts\shell_ping_after_close.js (312 bytes)
%Documents and Settings%\%current user%\Application Data\Microsoft\Crypto\RSA\S-1-5-21-1844237615-1960408961-1801674531-1003\1f91d2d17ea675d4c2c3192e241743f9_75ed9567-aa58-4c8e-a8ea-3cad7c47ab03 (105 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\HYD2.tmp.1466501343\HTA\i18n\en.json (5 bytes)

The Trojan deletes the following file(s):

%Documents and Settings%\%current user%\Cookies\Current_User@localhost[1].txt (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\HYD2.tmp (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\utt1.tmp (0 bytes)

The process Application DataqhArTkEEiB.exe:1648 makes changes in the file system.

The Trojan creates and/or writes to the following file(s):

%Documents and Settings%\%current user%\Local Settings\Temp\server.exe (24 bytes)

The process mshta.exe:1016 makes changes in the file system.

The Trojan creates and/or writes to the following file(s):

%Documents and Settings%\%current user%\Local Settings\Temp\HYD2.tmp.1466501343\index.hta.log (33 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\NWPUCJQP\featuredcontent[1].htm (21 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\T4PKM6DA\json[1] (314 bytes)

Registry activity

The process cscript.exe:1920 makes changes in the system registry.

The Trojan creates and/or sets the following values in system registry:

[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "96 EF 7E 04 82 BA 1C 41 7A C8 A3 07 00 3E 59 42"

The process cscript.exe:228 makes changes in the system registry.

The Trojan creates and/or sets the following values in system registry:

[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "94 47 63 F1 70 B7 DE A6 69 EE B4 66 A9 A0 90 4C"

The process ping.exe:464 makes changes in the system registry.

The Trojan creates and/or sets the following values in system registry:

[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "E6 78 84 75 1F D8 0A F8 E4 C4 6F D1 C1 E8 92 99"

The process server.exe:1760 makes changes in the system registry.

The Trojan creates and/or sets the following values in system registry:

[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "75 38 13 E2 CB 4E A5 74 2F CF 22 30 AB 0F 16 8B"

[HKCU]
"di" = "!"

[HKCU\Software\212683d986fb740ad6a40184df48e604]
"[kl]" = ""

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"AppData" = "%Documents and Settings%\%current user%\Application Data"
"Cache" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files"

[HKCU\Environment]
"SEE_MASK_NOZONECHECKS" = "1"

To automatically run itself each time Windows is booted, the Trojan adds the following link to its file to the system registry autorun key:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Run]
"212683d986fb740ad6a40184df48e604" = "%Documents and Settings%\%current user%\Local Settings\Temp\server.exe .."

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"212683d986fb740ad6a40184df48e604" = "%Documents and Settings%\%current user%\Local Settings\Temp\server.exe .."

The process %original file name%.exe:1288 makes changes in the system registry.

The Trojan creates and/or sets the following values in system registry:

[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "3A 7A 8B DE 2D 78 0C 99 E9 90 29 6E 46 74 0C BB"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{c155cd73-744b-11e2-8294-806d6172696f}]
"BaseClass" = "Drive"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Cookies" = "%Documents and Settings%\%current user%\Cookies"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Common Documents" = "%Documents and Settings%\All Users\Documents"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Local AppData" = "%Documents and Settings%\%current user%\Local Settings\Application Data"
"Desktop" = "%Documents and Settings%\%current user%\Desktop"

[HKCU\Software\Microsoft\Windows\ShellNoRoam\MUICache\%Documents and Settings%\%current user%\Local Settings]
"Application DatahgMnQmyNYm.exe" = "Ãƒâ€šÃ‚ÂµTorrent"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{c155cd72-744b-11e2-8294-806d6172696f}]
"BaseClass" = "Drive"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{c155cd75-744b-11e2-8294-806d6172696f}]
"BaseClass" = "Drive"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"AppData" = "%Documents and Settings%\%current user%\Application Data"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Common Desktop" = "%Documents and Settings%\All Users\Desktop"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{b98117e8-75ca-11e2-81b2-000c293708fb}]
"BaseClass" = "Drive"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Cache" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files"

[HKCU\Software\Microsoft\Windows\ShellNoRoam\MUICache\%Documents and Settings%\%current user%\Local Settings]
"Application DataqhArTkEEiB.exe" = "Application DataqhArTkEEiB"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Personal" = "%Documents and Settings%\%current user%\My Documents"

The Trojan modifies IE settings for security zones to map all local web-nodes with no dots which do not refer to any zone to the Intranet Zone:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"UNCAsIntranet" = "1"

The Trojan modifies IE settings for security zones to map all urls to the Intranet Zone:

"IntranetName" = "1"

The Trojan modifies IE settings for security zones to map all web-nodes that bypassing the proxy to the Intranet Zone:

"ProxyBypass" = "1"

The process netsh.exe:1912 makes changes in the system registry.

The Trojan creates and/or sets the following values in system registry:

[HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Tracing\Microsoft\eappprxy\traceIdentifier]
"Guid" = "5f31090b-d990-4e91-b16d-46121d0255aa"

[HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Tracing\Microsoft\qagent]
"Active" = "1"

[HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Tracing\Microsoft\QUtil\traceIdentifier]
"Guid" = "8aefce96-4618-42ff-a057-3536aa78233e"

[HKLM\SOFTWARE\Microsoft\Tracing\FWCFG]
"MaxFileSize" = "1048576"

[HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Tracing\Microsoft\NAP\Netsh]
"ControlFlags" = "1"

[HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Tracing\Microsoft\qagent]
"ControlFlags" = "1"

[HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Tracing\Microsoft\NAP\Netsh]
"Active" = "1"

[HKLM\SOFTWARE\Microsoft\Tracing\FWCFG]
"ConsoleTracingMask" = "4294901760"

[HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Tracing\Microsoft\NAP\Netsh\Napmontr]
"BitNames" = " NAP_TRACE_BASE NAP_TRACE_NETSH"

[HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Tracing\Microsoft\eappprxy]
"Active" = "1"

[HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Tracing\Microsoft\eappcfg\traceIdentifier]
"BitNames" = " Error Unusual Info Debug"

[HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Tracing\Microsoft\eappcfg]
"Active" = "1"

[HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Tracing\Microsoft\eappprxy\traceIdentifier]
"BitNames" = " Error Unusual Info Debug"

[HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Tracing\Microsoft\eappcfg]
"ControlFlags" = "1"

[HKLM\SOFTWARE\Microsoft\Tracing\FWCFG]
"EnableFileTracing" = "0"

[HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Tracing\Microsoft\eappcfg]
"LogSessionName" = "stdout"

[HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Tracing\Microsoft\NAP\Netsh\Napmontr]
"Guid" = "710adbf0-ce88-40b4-a50d-231ada6593f0"

[HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Tracing\Microsoft\QUtil]
"Active" = "1"

[HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Tracing\Microsoft\eappprxy]
"LogSessionName" = "stdout"
"ControlFlags" = "1"

[HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Tracing\Microsoft\qagent\traceIdentifier]
"Guid" = "b0278a28-76f1-4e15-b1df-14b209a12613"

[HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Tracing\Microsoft\eappcfg\traceIdentifier]
"Guid" = "5f31090b-d990-4e91-b16d-46121d0255aa"

[HKLM\SOFTWARE\Microsoft\Tracing\FWCFG]
"EnableConsoleTracing" = "0"

[HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Tracing\Microsoft\QUtil\traceIdentifier]
"BitNames" = " Error Unusual Info Debug"

[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "4D 7D 83 58 36 F3 AE D0 AD AA 34 86 2E ED 03 FD"

[HKLM\SOFTWARE\Microsoft\Tracing\FWCFG]
"FileDirectory" = "%windir%\tracing"

[HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Tracing\Microsoft\QUtil]
"LogSessionName" = "stdout"

[HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Tracing\Microsoft\qagent]
"LogSessionName" = "stdout"

[HKLM\SOFTWARE\Microsoft\Tracing\FWCFG]
"FileTracingMask" = "4294901760"

[HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Tracing\Microsoft\NAP\Netsh]
"LogSessionName" = "stdout"

[HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Tracing\Microsoft\qagent\traceIdentifier]
"BitNames" = " Error Unusual Info Debug"

[HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Tracing\Microsoft\QUtil]
"ControlFlags" = "1"

Adds a rule to the firewall Windows which allows any network activity:

[HKLM\System\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List\%Documents and Settings%\%current user%\Local Settings\Temp]
"server.exe" = "%Documents and Settings%\%current user%\Local Settings\Temp\server.exe:*:Enabled:server.exe"

The process RunDll32.exe:1660 makes changes in the system registry.

The Trojan creates and/or sets the following values in system registry:

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths]
"Directory" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path4]
"CacheLimit" = "65452"
"CachePath" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\Cache4"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Connections]
"SavedLegacySettings" = "3C 00 00 00 1C 00 00 00 01 00 00 00 00 00 00 00"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"AppData" = "%Documents and Settings%\%current user%\Application Data"

[HKCR\TypeLib\{A8A8FC8F-45DF-4720-B6D9-F8CE7E1483A2}\1.0\0\win32]
"(Default)" = "C:\DOCUME~1\"%CurrentUserName%"\LOCALS~1\Temp\HYD2.tmp.1466501343\HTA\3rdparty\OCSetupHlp.dll"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Cookies" = "%Documents and Settings%\%current user%\Cookies"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path2]
"CachePath" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\Cache2"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Common AppData" = "%Documents and Settings%\All Users\Application Data"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Cache" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files"

[HKLM\System\CurrentControlSet\Hardware Profiles\0001\Software\Microsoft\windows\CurrentVersion\Internet Settings]
"ProxyEnable" = "0"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path1]
"CacheLimit" = "65452"

[HKCR\TypeLib\{A8A8FC8F-45DF-4720-B6D9-F8CE7E1483A2}\1.0\HELPDIR]
"(Default)" = "C:\DOCUME~1\"%CurrentUserName%"\LOCALS~1\Temp\HYD2.tmp.1466501343\HTA\3rdparty"

[HKCR\TypeLib\{A8A8FC8F-45DF-4720-B6D9-F8CE7E1483A2}\1.0]
"(Default)" = "OCValidateLib"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path2]
"CacheLimit" = "65452"

[HKCR\TypeLib\{A8A8FC8F-45DF-4720-B6D9-F8CE7E1483A2}\1.0\FLAGS]
"(Default)" = "0"

[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "11 25 4B C8 F2 AE C6 C7 16 2F 9C 2B 57 71 7A 13"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path1]
"CachePath" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\Cache1"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path3]
"CacheLimit" = "65452"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings]
"MigrateProxy" = "1"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"History" = "%Documents and Settings%\%current user%\Local Settings\History"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path3]
"CachePath" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\Cache3"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths]
"Paths" = "4"

Proxy settings are disabled:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings]
"ProxyEnable" = "0"

The Trojan deletes the following value(s) in system registry:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings]
"AutoConfigURL"
"ProxyServer"
"ProxyOverride"

The process Application DatahgMnQmyNYm.exe:1616 makes changes in the system registry.

The Trojan creates and/or sets the following values in system registry:

[HKCR\Interface\{FA7B2795-C0C8-4A58-8672-3F8D80CC0270}]
"(Default)" = "_IComSDKEvents"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{c155cd72-744b-11e2-8294-806d6172696f}]
"BaseClass" = "Drive"

[HKCR\OCComSDK.ComSDK.1\CLSID]
"(Default)" = "{B9D64D3B-BE75-4FA2-B94A-C4AE772A0146}"

[HKCR\CLSID\{47A1DF02-BCE4-40C3-AE47-E3EA09A65E4A}\InProcServer32]
"ThreadingModel" = "Both"

[HKCU\Software\Classes\FalconBetaAccount]
"remote_access_client_id" = "2744477124"

[HKCR\Interface\{FA7B2795-C0C8-4A58-8672-3F8D80CC0270}\ProxyStubClsid32]
"(Default)" = "{00020420-0000-0000-C000-000000000046}"

[HKCU\Software\BitTorrent\uTorrent]
"OfferProvider" = ""

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths]
"Directory" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path4]
"CacheLimit" = "65452"
"CachePath" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\Cache4"

[HKCR\Interface\{47A1DF02-BCE4-40C3-AE47-E3EA09A65E4A}\TypeLib]
"(Default)" = "{1112F282-7099-4624-A439-DB29D6551552}"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"AppData" = "%Documents and Settings%\%current user%\Application Data"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{b98117e8-75ca-11e2-81b2-000c293708fb}]
"BaseClass" = "Drive"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Common Documents" = "%Documents and Settings%\All Users\Documents"

[HKCR\OCComSDK.ComSDK]
"(Default)" = "ComSDK Class"

[HKCR\OCComSDK.ComSDK.1]
"(Default)" = "ComSDK Class"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{c155cd73-744b-11e2-8294-806d6172696f}]
"BaseClass" = "Drive"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Cookies" = "%Documents and Settings%\%current user%\Cookies"

[HKCR\Interface\{47A1DF02-BCE4-40C3-AE47-E3EA09A65E4A}\ProxyStubClsid]
"(Default)" = "{00020424-0000-0000-C000-000000000046}"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path2]
"CachePath" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\Cache2"

[HKCR\TypeLib\{1112F282-7099-4624-A439-DB29D6551552}\1.0\FLAGS]
"(Default)" = "0"

[HKCR\TypeLib\{1112F282-7099-4624-A439-DB29D6551552}\1.0]
"(Default)" = "OCComSDK 1.0 Type Library"

[HKCR\CLSID\{B9D64D3B-BE75-4FA2-B94A-C4AE772A0146}\InprocServer32]
"ThreadingModel" = "Apartment"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{c155cd75-744b-11e2-8294-806d6172696f}]
"BaseClass" = "Drive"

[HKCR\CLSID\{B9D64D3B-BE75-4FA2-B94A-C4AE772A0146}\ProgID]
"(Default)" = "OCComSDK.ComSDK.1"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Common Desktop" = "%Documents and Settings%\All Users\Desktop"

[HKCU\Software\BitTorrent\uTorrent]
"OfferViaCAU" = "0"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Cache" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files"

[HKCR\OCComSDK.ComSDK\CLSID]
"(Default)" = "{B9D64D3B-BE75-4FA2-B94A-C4AE772A0146}"

[HKCR\CLSID\{B9D64D3B-BE75-4FA2-B94A-C4AE772A0146}]
"(Default)" = "ComSDK Class"

[HKCR\Interface\{47A1DF02-BCE4-40C3-AE47-E3EA09A65E4A}]
"(Default)" = "IComSDK"

[HKCR\OCComSDK.ComSDK\CurVer]
"(Default)" = "OCComSDK.ComSDK.1"

[HKCR\AppID\{257AE6D8-A9F3-4113-9AA8-5EED67D44267}]
"(Default)" = "OCComSDK"

[HKCR\Interface\{47A1DF02-BCE4-40C3-AE47-E3EA09A65E4A}\ProxyStubClsid32]
"(Default)" = "{00020424-0000-0000-C000-000000000046}"

[HKCR\CLSID\{47A1DF02-BCE4-40C3-AE47-E3EA09A65E4A}]
"(Default)" = "PSFactoryBuffer"

[HKCR\Interface\{47A1DF02-BCE4-40C3-AE47-E3EA09A65E4A}\TypeLib]
"Version" = "1.0"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path1]
"CacheLimit" = "65452"

[HKCR\TypeLib\{1112F282-7099-4624-A439-DB29D6551552}\1.0\HELPDIR]
"(Default)" = "C:\DOCUME~1\"%CurrentUserName%"\LOCALS~1\Temp\HYD2.tmp.1466501343\HTA\3rdparty"

[HKCR\CLSID\{B9D64D3B-BE75-4FA2-B94A-C4AE772A0146}\Version]
"(Default)" = "1.0"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Desktop" = "%Documents and Settings%\%current user%\Desktop"
"Personal" = "%Documents and Settings%\%current user%\My Documents"

[HKCR\Interface\{FA7B2795-C0C8-4A58-8672-3F8D80CC0270}\TypeLib]
"Version" = "1.0"

[HKCR\CLSID\{B9D64D3B-BE75-4FA2-B94A-C4AE772A0146}\VersionIndependentProgID]
"(Default)" = "OCComSDK.ComSDK"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path2]
"CacheLimit" = "65452"

[HKCR\CLSID\{B9D64D3B-BE75-4FA2-B94A-C4AE772A0146}]
"AppID" = "{257AE6D8-A9F3-4113-9AA8-5EED67D44267}"

[HKCR\CLSID\{B9D64D3B-BE75-4FA2-B94A-C4AE772A0146}\TypeLib]
"(Default)" = "{1112F282-7099-4624-A439-DB29D6551552}"

[HKCR\Interface\{47A1DF02-BCE4-40C3-AE47-E3EA09A65E4A}\NumMethods]
"(Default)" = "50"

[HKCU\Software\Microsoft\Windows\ShellNoRoam\MUICache\%System%]
"mshta.exe" = "Microsoft (R) HTML Application host"

[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "FD 54 1F AA 22 08 05 D1 E4 36 94 E8 34 39 87 D5"

[HKCR\Interface\{FA7B2795-C0C8-4A58-8672-3F8D80CC0270}\TypeLib]
"(Default)" = "{1112F282-7099-4624-A439-DB29D6551552}"

[HKCR\CLSID\{B9D64D3B-BE75-4FA2-B94A-C4AE772A0146}\MiscStatus\1]
"(Default)" = "131473"

[HKCR\CLSID\{B9D64D3B-BE75-4FA2-B94A-C4AE772A0146}\ToolboxBitmap32]
"(Default)" = "C:\DOCUME~1\"%CurrentUserName%"\LOCALS~1\Temp\HYD2.tmp.1466501343\HTA\3rdparty\OCComSDK.dll, 102"

[HKCR\CLSID\{B9D64D3B-BE75-4FA2-B94A-C4AE772A0146}\InprocServer32]
"(Default)" = "C:\DOCUME~1\"%CurrentUserName%"\LOCALS~1\Temp\HYD2.tmp.1466501343\HTA\3rdparty\OCComSDK.dll"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path1]
"CachePath" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\Cache1"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path3]
"CacheLimit" = "65452"

[HKCR\AppID\OCComSDK.DLL]
"AppID" = "{257AE6D8-A9F3-4113-9AA8-5EED67D44267}"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"History" = "%Documents and Settings%\%current user%\Local Settings\History"

[HKCR\CLSID\{B9D64D3B-BE75-4FA2-B94A-C4AE772A0146}\MiscStatus]
"(Default)" = "0"

[HKCR\CLSID\{47A1DF02-BCE4-40C3-AE47-E3EA09A65E4A}\InProcServer32]
"(Default)" = "C:\DOCUME~1\"%CurrentUserName%"\LOCALS~1\Temp\HYD2.tmp.1466501343\HTA\3rdparty\OCComSDK.dll"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path3]
"CachePath" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\Cache3"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths]
"Paths" = "4"

[HKCR\Interface\{FA7B2795-C0C8-4A58-8672-3F8D80CC0270}\ProxyStubClsid]
"(Default)" = "{00020420-0000-0000-C000-000000000046}"

[HKCU\Software\BitTorrent\uTorrent]
"OfferName" = ""

[HKCR\TypeLib\{1112F282-7099-4624-A439-DB29D6551552}\1.0\0\win32]
"(Default)" = "C:\DOCUME~1\"%CurrentUserName%"\LOCALS~1\Temp\HYD2.tmp.1466501343\HTA\3rdparty\OCComSDK.dll"

[HKCU\Software\BitTorrent\uTorrent]
"OfferAccepted" = "0"

The process Application DataqhArTkEEiB.exe:1648 makes changes in the system registry.

The Trojan creates and/or sets the following values in system registry:

[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "1F 82 44 B2 FA 7F 43 89 A3 AF CA 24 15 3C 1E 30"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{c155cd73-744b-11e2-8294-806d6172696f}]
"BaseClass" = "Drive"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Cookies" = "%Documents and Settings%\%current user%\Cookies"
"Desktop" = "%Documents and Settings%\%current user%\Desktop"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Common Documents" = "%Documents and Settings%\All Users\Documents"

[HKCU]
"di" = "!"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{c155cd72-744b-11e2-8294-806d6172696f}]
"BaseClass" = "Drive"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{c155cd75-744b-11e2-8294-806d6172696f}]
"BaseClass" = "Drive"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"AppData" = "%Documents and Settings%\%current user%\Application Data"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Common Desktop" = "%Documents and Settings%\All Users\Desktop"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{b98117e8-75ca-11e2-81b2-000c293708fb}]
"BaseClass" = "Drive"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Cache" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files"

"Personal" = "%Documents and Settings%\%current user%\My Documents"

[HKCU\Software\Microsoft\Windows\ShellNoRoam\MUICache\%Documents and Settings%\%current user%\Local Settings\Temp]
"server.exe" = "server"

The Trojan modifies IE settings for security zones to map all local web-nodes with no dots which do not refer to any zone to the Intranet Zone:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"UNCAsIntranet" = "1"

The Trojan modifies IE settings for security zones to map all urls to the Intranet Zone:

"IntranetName" = "1"

The Trojan modifies IE settings for security zones to map all web-nodes that bypassing the proxy to the Intranet Zone:

"ProxyBypass" = "1"

The process mshta.exe:1016 makes changes in the system registry.

The Trojan creates and/or sets the following values in system registry:

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths]
"Directory" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path4]
"CacheLimit" = "65452"
"CachePath" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\Cache4"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Connections]
"SavedLegacySettings" = "3C 00 00 00 1B 00 00 00 01 00 00 00 00 00 00 00"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"AppData" = "%Documents and Settings%\%current user%\Application Data"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{c155cd73-744b-11e2-8294-806d6172696f}]
"BaseClass" = "Drive"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Cookies" = "%Documents and Settings%\%current user%\Cookies"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path2]
"CachePath" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\Cache2"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Common AppData" = "%Documents and Settings%\All Users\Application Data"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{c155cd75-744b-11e2-8294-806d6172696f}]
"BaseClass" = "Drive"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Cache" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files"

[HKCU\Software\Microsoft\Windows\ShellNoRoam\MUICache\%System%]
"cscript.exe" = "Microsoft (R) Console Based Script Host"

[HKLM\System\CurrentControlSet\Hardware Profiles\0001\Software\Microsoft\windows\CurrentVersion\Internet Settings]
"ProxyEnable" = "0"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path1]
"CacheLimit" = "65452"

[HKCU\Software\Microsoft\Windows\ShellNoRoam\MUICache\%System%]
"ping.exe" = "TCP/IP Ping Command"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path2]
"CacheLimit" = "65452"

[HKLM\SOFTWARE\Microsoft\DirectDraw\MostRecentApplication]
"ID" = "1208111505"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Local AppData" = "%Documents and Settings%\%current user%\Local Settings\Application Data"

[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "EC F5 00 11 21 8D 23 38 D1 4E A3 75 84 69 71 59"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path1]
"CachePath" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\Cache1"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path3]
"CacheLimit" = "65452"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings]
"MigrateProxy" = "1"

[HKLM\SOFTWARE\Microsoft\DirectDraw\MostRecentApplication]
"Name" = "mshta.exe"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{c155cd72-744b-11e2-8294-806d6172696f}]
"BaseClass" = "Drive"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{b98117e8-75ca-11e2-81b2-000c293708fb}]
"BaseClass" = "Drive"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path3]
"CachePath" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\Cache3"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths]
"Paths" = "4"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"History" = "%Documents and Settings%\%current user%\Local Settings\History"

The Trojan modifies IE settings for security zones to map all local web-nodes with no dots which do not refer to any zone to the Intranet Zone:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"UNCAsIntranet" = "1"

The Trojan modifies IE settings for security zones to map all web-nodes that bypassing the proxy to the Intranet Zone:

"ProxyBypass" = "1"

Proxy settings are disabled:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings]
"ProxyEnable" = "0"

The Trojan modifies IE settings for security zones to map all urls to the Intranet Zone:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"IntranetName" = "1"

The Trojan deletes the following value(s) in system registry:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings]
"AutoConfigURL"
"ProxyServer"
"ProxyOverride"

Dropped PE files

MD5	File path
65066a6e15e60a707e587005e4dda398	c:\Documents and Settings\"%CurrentUserName%"\Local Settings\Application DatahgMnQmyNYm.exe
d750b0d0068026beec238efa82ee686c	c:\Documents and Settings\"%CurrentUserName%"\Local Settings\Application DataqhArTkEEiB.exe
7a51490de5906042b3f440ae9600fd76	c:\Documents and Settings\"%CurrentUserName%"\Local Settings\Temp\HYD2.tmp.1466501343\HTA\3rdparty\OCComSDK.dll
428a5d062b8665ff64b8024a487a4604	c:\Documents and Settings\"%CurrentUserName%"\Local Settings\Temp\HYD2.tmp.1466501343\HTA\3rdparty\OCSetupHlp.dll
d750b0d0068026beec238efa82ee686c	c:\Documents and Settings\"%CurrentUserName%"\Local Settings\Temp\server.exe

HOSTS file anomalies

No changes have been detected.

Rootkit activity

No anomalies have been detected.

Propagation

Removals

Remove it with Ad-Aware

Click (here) to download and install Ad-Aware Free Antivirus.
Update the definition files.
Run a full scan of your computer.

Manual removal*

Terminate malicious process(es) (How to End a Process With the Task Manager):
cscript.exe:1920
cscript.exe:228
ping.exe:464
%original file name%.exe:1288
netsh.exe:1912
Application DataqhArTkEEiB.exe:1648
Delete the original Trojan file.
Delete or disinfect the following files created/modified by the Trojan:
%Documents and Settings%\%current user%\Local Settings\Application DataqhArTkEEiB.exe (24 bytes)
%Documents and Settings%\%current user%\Local Settings\Application DatahgMnQmyNYm.exe (12289 bytes)
%System%\wbem\Logs\wbemprox.log (150 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\HYD2.tmp.1466501343\HTA\images\mediacaster\logo.png (6 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\utt1.tmp (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\HYD2.tmp.1466501343\HTA\images\main_icon.png (4 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\HYD2.tmp.1466501343\HTA\images\yandex_horz.png (8 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\HYD2.tmp.1466501343\index.hta.log (26 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\HYD2.tmp.1466501343\HTA\i18n\ru.json (9 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\HYD2.tmp.1466501343\HTA\i18n\fr.json (6 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\HYD2.tmp.1466501343\HTA\scripts\initialize.js (978 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\HYD2.tmp.1466501343\HTA\scripts\common.js (1681 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\HYD2.tmp.1466501343\HTA\styles\common.css (101 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\HYD2.tmp.1466501343\HTA\i18n\de.json (6 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\HYD2.tmp.1466501343\HTA\images\mediacaster\chrome.png (12 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\HYD2.tmp.1466501343\HTA\i18n\pt.json (6 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\HYD2.tmp.1466501343\HTA\scripts\install.js (18 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\HYD2.tmp.1466501343\HTA\install.1466501343.zip (279261 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\MPIIDWDE\desktop.ini (67 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\HYD2.tmp.1466501343\HTA\images\logo_Yandex_RU_UA_vertical.png (6 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\NWPUCJQP\desktop.ini (67 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\HYD2.tmp.1466501343\HTA\images\main_utorrent.ico (107 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\HYD2.tmp.1466501343\HTA\uninstall.hta (575 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\HYD2.tmp.1466501343\HTA\shell_scripts\check_if_cscript_is_working.js (18 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\HYD2.tmp.1466501343\HTA\index.hta (522 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\HYD2.tmp.1466501343\HTA\images\main_bittorrent.ico (103 bytes)
%Documents and Settings%\%current user%\Cookies\Current_User@localhost[1].txt (169 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\HYD2.tmp.1466501343\HTA\images\loading.gif (5 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\HYD2.tmp.1466501343\HTA\3rdparty\OCComSDK.dll (218 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\desktop.ini (67 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\HYD2.tmp.1466501343\HTA\images\yandex_horz_ru.png (7 bytes)
%Documents and Settings%\%current user%\Local Settings\History\History.IE5\desktop.ini (159 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\HYD2.tmp.1466501343\HTA\images\search_protect.png (3 bytes)
%Documents and Settings%\%current user%\Application Data\uTorrent\settings.dat.new (71 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\HYD2.tmp.1466501343\HTA\shell_scripts\shell_install_offer.js (7 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\HYD2.tmp.1466501343\HTA\images\bt_icon_48px.png (3 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\HYD2.tmp.1466501343\HTA\scripts\es5-shim.js (11 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\T4PKM6DA\desktop.ini (67 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\HYD2.tmp.1466501343\HTA\styles\installer.css (296 bytes)
%Documents and Settings%\%current user%\Cookies\Current_User@localhost[2].txt (169 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\HYD2.tmp.1466501343\HTA\i18n\it.json (6 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\HYD2.tmp.1466501343\HTA\i18n\br.json (6 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\HYD2.tmp.1466501343\HTA\images\mediacaster\internetexplorer.png (13 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\A41ESWOO\desktop.ini (67 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\HYD2.tmp.1466501343\HTA\3rdparty\OCSetupHlp.dll (5442 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\HYD2.tmp.1466501343\HTA\images\yandex_browser_setup.bmp (204 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\HYD2.tmp.1466501343\HTA\images\mediacaster\screenshot.png (40 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\HYD2.tmp.1466501343\HTA\scripts\uninstall.js (1 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\HYD2.tmp.1466501343\HTA\i18n\es.json (5 bytes)
%Documents and Settings%\%current user%\Cookies\index.dat (788 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\HYD2.tmp.1466501343\HTA\images\mediacaster\firefox.png (14 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\HYD2.tmp.1466501343\HTA\shell_scripts\shell_ping_after_close.js (312 bytes)
%Documents and Settings%\%current user%\Application Data\Microsoft\Crypto\RSA\S-1-5-21-1844237615-1960408961-1801674531-1003\1f91d2d17ea675d4c2c3192e241743f9_75ed9567-aa58-4c8e-a8ea-3cad7c47ab03 (105 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\HYD2.tmp.1466501343\HTA\i18n\en.json (5 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\server.exe (24 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\NWPUCJQP\featuredcontent[1].htm (21 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\T4PKM6DA\json[1] (314 bytes)
Delete the following value(s) in the autorun key (How to Work with System Registry):
[HKCU\Software\Microsoft\Windows\CurrentVersion\Run]
"212683d986fb740ad6a40184df48e604" = "%Documents and Settings%\%current user%\Local Settings\Temp\server.exe .."

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"212683d986fb740ad6a40184df48e604" = "%Documents and Settings%\%current user%\Local Settings\Temp\server.exe .."
Clean the Temporary Internet Files folder, which may contain infected files (How to clean Temporary Internet Files folder).
Reboot the computer.

*Manual removal may cause unexpected system behaviour and should be performed at your own risk.

Static Analysis

VersionInfo

Company Name:
Product Name:
Product Version: 0.0.0.0
Legal Copyright:
Legal Trademarks:
Original Filename: setup.exe
Internal Name: setup.exe
File Version: 0.0.0.0
File Description:
Comments:
Language: English (United States)

Company Name: Product Name: Product Version: 0.0.0.0Legal Copyright: Legal Trademarks: Original Filename: setup.exeInternal Name: setup.exeFile Version: 0.0.0.0File Description: Comments: Language: English (United States)

PE Sections

Name	Virtual Address	Virtual Size	Raw Size	Entropy	Section MD5
.text	8192	2091796	2093056	5.5286	9504742dd71ffc304c0001e22ce68d3c
.rsrc	2105344	72840	73728	5.27723	ad673e7f88cb3894e131a13bc182cb57
.reloc	2179072	12	4096	0.009099	a509e0fef30e897ac8b423b88f9fde87

Dropped from:

Downloaded by:

Similar by SSDeep:

Similar by Lavasoft Polymorphic Checker:

Network Activity

URLs

URL	IP
hxxp://com-utorrent-prod-bench-290894750.us-east-1.elb.amazonaws.com/e?i=50
hxxp://download-new.utorrent.com/endpoint/hydra-ut/os/win/track/stable/browser/ie/os-region/US/os-lang/en/os-ver/5.1/enc-ver/109814512/
hxxp://ip-api.com/json?callback=jQuery19108624844717960477_1466501352787&_=1466501352788
hxxp://update.utorrent.com/featuredcontent.php?w=5.1	67.215.246.203
hxxp://api.recommendedsw.com/?bn=3&bv=6.00.2900.5512&clientv=106&cltzone=180&csk=08335376817247437519-10128794027328176332&language=en,en&method=get_offers&mstime=0.359&num_offers=1&os=WIN5.1SP3&product_key=235a0d68ca7391a10ed1b103964f00f6&sohtml=1&sswnt=&tm=2016-06-21 09:29:15.646&v=1.0&signature=dfbb885eae60126a1e000b236c6be988	162.209.122.21
hxxp://download-lb.utorrent.com/endpoint/hydra-ut/os/win/track/stable/browser/ie/os-region/US/os-lang/en/os-ver/5.1/enc-ver/109814512/	67.215.238.66
hxxp://i-50.b-000.xyz.bench.utorrent.com/e?i=50	23.21.92.252
router.utorrent.com	82.221.103.244
router.bittorrent.com	67.215.246.10

IDS verdicts (Suricata alerts: Emerging Threats ET ruleset)

Traffic

POST /e?i=50 HTTP/1.1

Host: i-50.b-000.xyz.bench.utorrent.com

User-Agent: Hydra HttpRequest

Connection: close

Content-Length: 224

{"eventName":"hydra1","action":"begin","type":"i","cau":"0","pv":"","cc":"0","bkt1":"0","v":"109814512","cl":"uTorrent","osv":"5.1","l":"en","pid":"1616","h":"XcAvwh1uUOAl6gUi","sid":"XcAvwh1uUOAl6gUi1466501343","order":"0"}

HTTP/1.1 200 OK

Content-Type: text/html

Date: Tue, 21 Jun 2016 09:29:01 GMT

Server: nginx

X-Powered-By: PHP/5.4.30

Content-Length: 21

Connection: Close

{"response_code":200}..

GET /?bn=3&bv=6.00.2900.5512&clientv=106&cltzone=180&csk=08335376817247437519-10128794027328176332&language=en,en&method=get_offers&mstime=0.359&num_offers=1&os=WIN5.1SP3&product_key=235a0d68ca7391a10ed1b103964f00f6&sohtml=1&sswnt=&tm=2016-06-21 09:29:15.646&v=1.0&signature=dfbb885eae60126a1e000b236c6be988 HTTP/1.1

Accept: */*

Cache-Control: no-cache

Pragma: no-cache

Accept-Encoding: gzip

Host: api.recommendedsw.com

Connection: Keep-Alive

HTTP/1.1 200 OK

Date: Tue, 21 Jun 2016 09:29:13 GMT

Server: Apache

X-Robots-Tag: noindex

Last-Modified: Tue, 21 Jun 2016 09:29:13 GMT

Cache-Control: no-store, no-cache, must-revalidate

Cache-Control: post-check=0, pre-check=0

Pragma: no-cache

Connection: close

Transfer-Encoding: chunked

Content-Type: text/xml

b19..<?xml version="1.0"?>.<get_offers>. <installer_md5s>. <md5>0</md5>. </installer_md5s>. <session_key>c8e9690fdbe35f3f0149e823b7005965</session_key><product_name><![CDATA[BitTorrent]]></product_name>. <data encoding="gzip"><![CDATA[H4sIAAAAAAAAA51abU/jOBD 3l/hReKQKq7c5xOw6hZOi5YFBEVotVohN5m2EYmdcxxC73T//cbOm9/SFvjUJjNje16eecbldAXyWQrKipTKhLOCpJStSrqCswNgB QVRIGPzw7 ODgfkebv9Huxer7jFQiIr kC0vPTTz9nF9P59GfzlCw25DYHNqMs3vz6dX564qnY1i4gShMGc3iTvbHmYadvCtnqD5IK aWUkjPbhH5Bxp0JV9A2M83zNIm0I24A4uIeikYeDxKZ57w6SlMSc5JIdJgE0S2w04SzYhRBLu09T1cC kMbErbqFUPLaRo6dfOqs GL2qZmnC0Tkc1SXsA9ZAmLQTh7EkA2vCRF2XyoKJNEchIpHSLXSUFEo/m5W3fQ7qDbp3HM2X3Jpkt0auO7fhdjsqYFWQAwktRHgnhCfuB2IspGWpiURcJWKi5UmdB7FbUdcjgJhSm4pL3BeSJTcDL9glcs5TRWq40nk960Ibzby3VS1IHpbddPt7rRUgwmBm7Mywhvs4asbeQr0Fi5g8Yb5 BjgrFmvCLLMk03WAS1H1Qk7lKgmA1YpdEL4YwcNOYPVKbkgkdYEf3a3hL2Dr4DK68kZHe0LMBAGPWVtN7vjNnStqUvglcFCKceb78ZDtdZvKjlOpuDekHzoTx6D3LsZWafg7krzsWG0BVNWHjBfWCqK16V22Yq/E7uIeJZBvhWo34PtbZOMEVvc4nfvCw1jNiC4U3dCZ7l8obLuUgg7q0pXFjTV8BklWQDCFfqPRkfk4qXaayhIU1eQCWnRB NVVZ/9vbvmHf3UJSZ07bqZ4adTsTDAxYpBLpiGBZR5tLc/Rj/Hm8eHy4v1CcTC3ylcOHUC7v7Gi6dRn6wMV8D46/ca881 PPl0kgtX2uvRmtmFlPPCZUSmBKrYT4rC9m0nEMM22gBK0xruYa2H2iTQZi31tm7gPfsPWRn78HPogWYfn/bVt7dPJxqbET0abe34EBFzkQi0VPpXzRJsccbnZ9EzSuC caFdgOPolII5YArw YBFhEVYIVvABCF1xIE /dJQI9drDfCPWCLHF5M9B2zx3sJO25r9q4PTJsEg5SCIgw07ChddHFsyB97SFE6WBwJ/8uxH9PQQTByAchxF3Ycb2KTYjG6Re9 xwxh47r1jtbcxS6SFcWrLZtWb/EMxGeW94L6IaTT7cGe49zVfw

<<< skipped >>>

GET /featuredcontent.php?w=5.1 HTTP/1.1

Accept-Encoding: gzip, deflate

Accept-Language: en-us

Referer: file://C:\DOCUME~1\"%CurrentUserName%"\LOCALS~1\Temp\HYD2.tmp.1466501343\HTA\index.hta

Accept: application/json, text/javascript, */*; q=0.01

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Host: update.utorrent.com

Connection: Keep-Alive

HTTP/1.1 200 OK

Server: nginx/1.4.7

Date: Tue, 21 Jun 2016 09:29:12 GMT

Content-Type: text/html

Content-Length: 21

Connection: close

X-Powered-By: PHP/5.4.30

Expires: Thu, 21 Jul 1980 00:00:00 GMT

Cache-Control: private

Last-Modified: Tue, 21 Jun 2016 09:29:12 GMT

{"content_offers":[]}..

GET /json?callback=jQuery19108624844717960477_1466501352787&_=1466501352788 HTTP/1.1

Accept: */*

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Host: ip-api.com

Connection: Keep-Alive

HTTP/1.1 200 OK

Access-Control-Allow-Origin: *

Content-Type: text/javascript; charset=utf-8

Date: Tue, 21 Jun 2016 09:29:12 GMT

Content-Length: 314

jQuery19108624844717960477_1466501352787({"as":"AS31561 Pitline Ltd","city":"Kharkiv","country":"Ukraine","countryCode":"UA","isp":"Pitline","lat":49.9808,"lon":36.2527,"org":"Pitline","query":"194.242.96.218","region":"63","regionName":"Kharkivs'ka Oblast'","status":"success","timezone":"Europe/Kiev","zip":""});HTTP/1.1 200 OK..Access-Control-Allow-Origin: *..Content-Type: text/javascript; charset=utf-8..Date: Tue, 21 Jun 2016 09:29:12 GMT..Content-Length: 314..jQuery19108624844717960477_1466501352787({"as":"AS31561 Pitline Ltd","city":"Kharkiv","country":"Ukraine","countryCode":"UA","isp":"Pitline","lat":49.9808,"lon":36.2527,"org":"Pitline","query":"194.242.96.218","region":"63","regionName":"Kharkivs'ka Oblast'","status":"success","timezone":"Europe/Kiev","zip":""});..

POST /e?i=50 HTTP/1.1

Host: i-50.b-000.xyz.bench.utorrent.com

User-Agent: Hydra HttpRequest

Connection: close

Content-Length: 250

{"eventName":"hydra1","action":"packDownloadResult","type":"i","result":"1","cau":"0","pv":"","cc":"0","bkt1":"0","v":"109814512","cl":"uTorrent","osv":"5.1","l":"en","pid":"1616","h":"XcAvwh1uUOAl6gUi","sid":"XcAvwh1uUOAl6gUi1466501343","order":"2"}

HTTP/1.1 200 OK

Content-Type: text/html

Date: Tue, 21 Jun 2016 09:29:09 GMT

Server: nginx

X-Powered-By: PHP/5.4.30

Content-Length: 21

Connection: Close

{"response_code":200}..

GET /endpoint/hydra-ut/os/win/track/stable/browser/ie/os-region/US/os-lang/en/os-ver/5.1/enc-ver/109814512/ HTTP/1.1

Host: download-lb.utorrent.com

User-Agent: Hydra HttpRequest

Connection: close

Content-Length: 0

HTTP/1.1 200 OK

Server: nginx/1.6.1

Date: Tue, 21 Jun 2016 09:29:01 GMT

Content-Type: application/octet-stream

Content-Length: 2397689

Connection: close

X-bt-sig: 6280eb8890af3f03bce5acbc7887c10c05697ddeee48ef03c41cbf3d4b52b0fadf6fa51d9387dc46e6ee2b55de245bd5829ee53d4aab8724f6e6530f7123858adfbf1a401eee9122e32776588b30687e7254665ace20eb2415cb2b60c5f6276edabebecc5c2ce0d6a30690508383fad15eeccc470a73548a8f34d78b246c8f2593434e5220329fe7541c4525c258a3444979f9b2b6a40fda4f5af7c96b51b93e3226859fb380c86f0ffd5646b0910289250aa34ff4830dad8e3e46f9821d29047aa0f15d38e1008628ca2e1f525a77c5eb63d4425e084f9cc7f26086083a8ea7e8cd3475ce0d8f60a5186ab7608a01ec48127c379f8b17b61156c209fe352c69

Last-Modified: Sat, 18 Jun 2016 05:45:18 0000

Accept-Ranges: none

Content-Disposition: attachment; filename="hta.zip"

X-bt-size: 2397689

Cache-Control: private

X-rl-mx: true

Rule-UUID: d7d79ca9-1978-4573-a82b-a0adc05e3e13

Content-MD5: a941fc2419a987ff4de7c86cbf782c8f

Expires: Tue, 01 Jan 1980 00:00:00 0000

X-bt-hash: c5b7fd00cac128923973150476f3f3549d55ae17

PK.........{.H.d..............index.hta<html>..<head>. <title>Loading...</title>. <meta charset="utf-8">. <meta http-equiv="X-UA-Compatible" content="IE=9">. <meta http-equiv="MSThemeCompatible" content="yes">.. <script src="scripts/initialize.js"></script>.. <link rel="stylesheet" href="styles/common.css"/>.. ..</head>..<body class="installer_body">.</body>..<script src="scripts/common.js"></script>..<script src="scripts/install.js"></script>..</html>.PK.........{.Hw[Yy?...?.......uninstall.hta<html>..<head>. <title>Loading...</title>. <meta charset="utf-8">. <meta http-equiv="X-UA-Compatible" content="IE=9">. <meta http-equiv="MSThemeCompatible" content="yes">.. <script src="scripts/initialize.js"></script>.. <link rel="stylesheet" href="styles/common.css"/>... ..</head>..<body class="installer_body">.</body>..<script src="scripts/common.js"></script>...<script src="scripts/uninstall.js"></script>..</html>.PK.........{.H.....V...V......3rdparty/OCComSDK.dllMZ......................@.................

<<< skipped >>>

POST /e?i=50 HTTP/1.1

Host: i-50.b-000.xyz.bench.utorrent.com

User-Agent: Hydra HttpRequest

Connection: close

Content-Length: 238

{"eventName":"hydra1","action":"packDownloadStarted","type":"i","cau":"0","pv":"","cc":"0","bkt1":"0","v":"109814512","cl":"uTorrent","osv":"5.1","l":"en","pid":"1616","h":"XcAvwh1uUOAl6gUi","sid":"XcAvwh1uUOAl6gUi1466501343","order":"1"}

HTTP/1.1 200 OK

Content-Type: text/html

Date: Tue, 21 Jun 2016 09:29:01 GMT

Server: nginx

X-Powered-By: PHP/5.4.30

Content-Length: 21

Connection: Close

{"response_code":200}..

POST /e?i=50 HTTP/1.1

Host: i-50.b-000.xyz.bench.utorrent.com

User-Agent: Hydra HttpRequest

Connection: close

Content-Length: 248

{"eventName":"hydra1","action":"INFO","type":"i","res":"1276x846","cts":"1466501352","pv":"","cau":"0","cc":"0","v":"109814512","cl":"uTorrent","osv":"5.1","l":"en","pid":"1616","h":"XcAvwh1uUOAl6gUi","sid":"XcAvwh1uUOAl6gUi1466501343","order":"3"}

HTTP/1.1 200 OK

Content-Type: text/html

Date: Tue, 21 Jun 2016 09:29:09 GMT

Server: nginx

X-Powered-By: PHP/5.4.30

Content-Length: 21

Connection: Close

{"response_code":200}..

Map

The Trojan connects to the servers at the folowing location(s):

Strings from Dumps

Application DatahgMnQmyNYm.exe_1616:

`.rsrc

t.Wj _ |$

WSShx

SSSSh

SSSSShd

D$ SSh

D$8SShp

u.Wh|

D$hSSh

D$@SShT%g

SSh4Fg

SSh|&g

SShT%g

udPVh

tCPh

PSSSSSSh

FH<.tp>

j.Xf;

uÃ¹A

UDP0u

HTTPu

9HTTPu#f

>HTTPu

D$0PSSh

Zu.Vj

tFj.Zf;

D$|SSh

tCPh,9h

<. udpu>

<. tcpux>

keyA

keyB

Bj%X3

j%Xf9CHu[

WHtTHt.Hu}

Fx FtPh

OlSSh@Ei

>httpum

D$,SSSSh

SSSSSSSh

uhSSh

?httpu

PSSh(#l

PSShx#l

D$()D$0SSh

SSSSSh

j.Yf9L$du

ESSSSSSSSh"

SSSSSSSSh

FHSSh

t.UV3

F\ FTP

SSSSSSh

FDSShv

FDSShr

j.Yf;

_tcPVj@

(%0Sn

.PjRW

Error downloading file. Msg: %s.

Error downloading file. Msg: Empty download.

Error downloading file. Msg: Could not save downloaded file.

autoexecutestart

mismexecute

kernel32.dll

hXXp://events.bittorrent.com/startConversion

hXXp://cdn.ap.bittorrent.com/control/tags/bt.json

hXXp://cdn.ap.bittorrent.com/control/tags/ut.json

hXXp://cdn.ap.bittorrent.com/control/tags/staging_bt.json

hXXp://cdn.ap.bittorrent.com/control/tags/staging_ut.json

hXXp://apps.bittorrent.com/conduit/eula/ByChoosingToInstall.html

%u %d %S

CollectToolbarPreferences: _ACTIVE_BROWSER: %S

provider:%S,search:%d,homepage:%d

mism execute succeeded

CollectToolbarPreferences: mism execute succeeded

CollectToolbarPreferences: mism execute FAILED

toolbar%d

hXXp://update.utorrent.com/uninstall?type=%s-%U&h=%s&v=%d

content_offer_url

attempted_to_receive_server_search_url

"elevated":%d, "message":"%S", "error_code":%d

hXXp://VVV.utorrent.com

IsYandexInstalled %s

GetConduitInstalledState: Found key: HKEY_LOCAL_MACHINE %S

GetConduitInstalledState: HKEY_LOCAL_MACHINE %S = %d

GetConduitInstalledState: Found key: HKEY_CLASSES_ROOT %S

GetConduitInstalledState: installed=%d visible=%d enabled=%d

IsConduitInstalled: %d

GetToolbarDict: %s, id: %s

GetToolbarDict: count=%d

GetToolbarDict: Found %s in '%s' key

GetToolbarDict: DID NOT find %s in '%s' key

ask-surf-firefox

ask-surf-chrome

ask-firefox

ask-chrome

IsConduitToolbarOffer %s

checkboxes: %s

TBDownloadCallback err: %s size: %I64d

TBDownloadCallback write FAILED: %S

TBDownloadCallback write OK: %S

Using default offer? [%S]

passed_hash_check? %s

base_parameter: [%S]

chrome_param

TBDownloadCallback: flag: %s

toolbar commandline: %s

TBDownloadCallback: RAN %S %S RETURN: %d

offer_urls

WhichConduitSettingsAreActive: %s

ShowYandexOffer: %d

ShowYandexSearchOffer: %d

ShowConduitBing: %d

ShowConduitGoogle: %d

image_url

&bin=%stoolbar

TBRequestThread Parsed OK?: %s

TBRequestThread FAILED. err: %S

content_offer_autoexec

offer_retrieved: %s

empty_offer: %s

default_offer: %s

showToolbar: %s

onOfferDownload: Using default offer. g_is_default_offer: %s

onOfferDownload: %s

eula_url

hXXp://%%s/offers/%s

hXXp://update.utorrent.com/installoffer.php

RetrieveOffer browser %S

db=%U

cl=%s

tsub=%d

RetrieveOffer %s

The source code, design, and structure of the Software are trade secrets. You will not disassemble, decompile, or reverse engineer itor otherwise attempt to discover the source code of the Software, in whole or in part, except to the extent expressly permitted by law, or distribute it. You will not use the Software for illegal purposes. You will comply with all export laws. The Software is licensed, not sold.

The Software accelerates downloads by enabling your computer to grab pieces of files from other BitTorrent users simultaneously. Your use of the Software to download files will, in turn, enable other users to download pieces of those files from you, thereby maximizing download speeds for all users. In the Software, only files that you are explicitly downloading or sharing or have downloaded or shared through BitTorrent will be made available to others. You consent to other users' use of your network connection to download portions of such files from you. At any time, you may uninstall the Software through the Add/Remove Programs control panel utility. In addition, for the BitTorrent or

BitTorrent, Inc. disclaims any responsibility for harm resulting from the Software or any software or content downloaded using the Software, whether or not BitTorrent, Inc. approved such software or content. BitTorrent, Inc. approval does not guarantee that software or content from an approved partner will function, sound, or appear as offered or hoped, or be complete, accurate, or free from bugs, errors, viruses, or other harmful content. BitTorrent, Inc. expressly disclaims all warranties and conditions, express or implied, including any implied warranties and conditions of merchantability, fitness for a particular purpose, and noninfringement, and any warranties and conditions arising out of course of dealing or usage of trade regarding the Software or any software or content you download using the Software. No advice or information, whether oral or written, obtained from BitTorrent, Inc. or elsewhere will create any warranty or condition not expressly stated in this agreement. Some jurisdictions do not allow certain limitations on implied warranties, so the above limitation may not apply to you to its full extent.

BitTorrent, Inc.'s total liability to you from all causes of action and under all theories of liability will be limited to $50.00. In no event and under no theory of liability will BitTorrent, Inc. be liable to you for any special, incidental, exemplary, or consequential damages arising out of or in connection with this agreement or the software whether or not BitTorrent, Inc. has been advised of the possibility of such damages. The foregoing limitations will survive even if any limited remedy specified is found to have failed of its essential purpose. Some jurisdictions do not allow the limitation or exclusion of liability for incidental or consequential damages, so the above limitation or exclusion may not apply to you to its full extent.

In an attempt to provide increased value to our visitors, we may choose various third party web sites or services to link to, and/or frame within, the Sites or Services. We may also include offers from third parties as part of the installation process for our software, which in some instances may include but is not limited to offers made through SweetLabs, Inc. (OpenCandy), whose End User License Agreement is hXXp://VVV.opencandy.com/eulas/b/sneula.html. We also participate in co-branding and other relationships to offer e-commerce and other services and features to our users. However, even if the third party is affiliated with us, we have no control over these sites or services, each of which has separate privacy and data collection practices independent of us. We have no responsibility or liability for these independent policies or actions, and are not responsible for the privacy practices or the content of any such web sites or services. These linked sites or services are only for your convenience and you therefore access them at your own risk.

These BitTorrent, Inc. terms will be governed by and construed in accordance with the laws of California, USA, without regard to conflicts of law rules. The United Nations Convention on Contracts for the International Sale of Goods will not apply. The failure by either party to enforce any provision will not constitute a waiver. Any waiver, modification, or amendment of the BitTorrent, Inc. terms will be effective only if signed. If any provision is held to be unenforceable, it will be enforced to the maximum extent possible and will not diminish other provisions. BitTorrent, Inc. may make changes to these terms from time to time. When these changes are made, BitTorrent, Inc. will make a new copy of the terms available at VVV.bittorrent.com/legal/eula. You understand and agree that if you use the Software after the date on which the terms have changed, BitTorrent, Inc. will treat your use as acceptance of the updated terms. You agree that BitTorrent, Inc. may provide you with notices, including those regarding changes to the terms, by postings on VVV.bittorrent.com/legal/eula. This and the Privacy Policy at VVV.bittorrent.com/legal/privacy are BitTorrent, Inc.'s complete and exclusive understanding with you regarding your use of the Software as an end user, except that sometimes additional terms or product requirements (including age requirements) may apply. Additional terms will be available with the relevant Software, and those additional terms become part of your agreement with us if you use those Software.

If you have any questions, contact us at legal@bittorrent.com.

onPageInit:DLG_OFFER_NON_GOOGLE: checkbox %d %s [%s]

Result: %s

&bin=%sbmp

hXXp://apps.bittorrent.com/utorrent-onboarding/welcome-upsell.btapp

hXXp://apps.bittorrent.com/utorrent-onboarding/player.btapp

hXXp://utclient.utorrent.com/pro/utorrent/index.html

hXXp://bundles.bittorrent.com/onboarding/utorrent?url=http://bundles.bittorrent.com/

no toolbar url

ShellExecuteExW

shell32.dll

cbhomepage=%d

cbsearch=%d

cbtoolbar=%d

cbrevert=%d

au=%d

installresult=%d

exit=%d

au=%u

tbe=%d

cd=%d

tbofferresult=%d

tb=%s

tbinstallresult=%d

error=%d

msg=%U

url=%U

prog=%u

toroffer=%d

torofferid=%s

&shoffer=%d

cancellastpage=%U

ServerOfferRetrieved=%d

sec_offs=%U

OfferError=%U

OfferProvider=%U

OfferType=%U

Offer=%U

Accepted=%d

toroffername=%s

torexecresult=%d

download=%d

execute=%d

error=%U

mismreturn=%d

mismresult=%U

view=%s

SendStaticURLThread

3.4.5.41712

%d.%d

settings.dat

LAUNCHBUNDLEDURL

LAUNCHBUNDLEDURLTYPE

hXXp://download-lb.utorrent.com/

chrome

firefox

uTCBTWebClient

had_version_already = %s

running_from_install_dir = %s

Target version = %d

HasPendingUpdate = %s

IsThisTargetVersion = %s

IsThisTargetVersion_2 = %s

"status":"Manually ran non target version","from_install_dir":"%d"

IsThisVersionBlacklisted = %s

client_manager.IsThisVersionBlacklisted() || client_manager.DidOptOutOfThisVersion() && running_from_install_dir

g_version

res == %d

Cancel Downgrade -- cvm.RemoveRunningVersion

2012-12-04 23:04:37 -0800

BTWebClient

hXXp://apps.bittorrent.com/webui/version.json

hXXp://beta.bundles.bittorrent.com/onboarding/utorrent?url=http://beta.bundles.bittorrent.com/

beta.bundles.bittorrent.com

bundles.bittorrent.com

hXXp://beta.%s

INSTALL_FAIL_USER_CANCEL -- cvm.RemoveRunningVersion

Cannot load DBGHELP.DLL

Cannot load MiniDumpWriteDump from DBGHELP.DLL

Cannot load SymInitialize from DBGHELP.DLL

Cannot load SymFromAddr from DBGHELP.DLL

Cannot load SymGetLineFromAddr from DBGHELP.DLL

FindDesktopFolderView IShellWindows CoCreateInstance fail

FindDesktopFolderView IShellWindows FindWindowSW fail

ShellExecuteUnelevated XP cannot execute

ShellExecuteUnelevated IDispatch get_Application fail

abShellExecuteUnelevated IShellDispatch2 ShellExecute fail

()$^.* ?[]|\-{},:=!

index.hta

installState.txt

uninstall.hta

^\[EXECUTE:[

newInstallExecuteFail

noUrl

packDownloadNoUrl

htaExecFail

existingExeNotAccessible

cannotExecuteExisting

\System32\mshta.exe

\SysWOW64\mshta.exe

update.utorrent.com

hXXp://

.bench.utorrent.com/e?i=50

hXXp://i-

"var_msg":"

(. ?)://([^/:] )(?::([0-9] ))?([^?]*)(?:\?(.*))?

Not a recognizable URL: "

https

HttpRequest redirect to HTTPS. Not supported

User-Agent: Hydra HttpRequest

HTTP/1.1

] ([0-9] )[

HttpRequest status line not recognizable "

dwmapi.dll

advapi32.dll

user32.dll

SetThreadExecutionState

Failed to read from file: %s

"%s":[ %d ]

wininet.dll

Can't get computer name - %d %d

InternetOpenUrlA

HttpQueryInfoA

%s(%d)/%s

Accept-Language: %s

DNS lookup can't resolve host '%s'

HTTP/1.1

hXXp://%s%s%s

%s(%d)

Host: %s%s

User-Agent: %s

Accept-Encoding:%s

Referer: %s

Authorization: Basic %s

If-Modified-Since: %s

If-None-Match: %s

X-Requested-With: XMLHttpRequest

%U=%U

Content-Length: %d

Content-Type: application/x-www-form-urlencoded

HTTP/1.

https:

max-age=%d

DownloadURL(%s) called.

$@Can't validate '%s' because no digits were encountered

Can't validate '%s' - error %d %s

NA-%d

%d.%d.%d.%d.%d.%s

hXXps://

application/vnd.rn-realmedia-vbr

image/vnd.microsoft.icon

%3s, d %3s M d:d:d GMT

d10:.fileguard40:%H

d10:.fileguard40:

]: %s: %d

%d/%d blocks. %d/%d bytes.

Can't decode encoded encryption key in magnet URL %s

magnet:?xt=urn:btih:%H&dn=%U

&key=%s

&tr=%U

&ws=%U

&as=%U

rand_port_on_start

logger.log_upnp_to_file

net.bind_ip

net.outgoing_ip

net.outgoing_port

net.outgoing_max_port

net.low_cpu

net.calc_overhead

net.calc_rss_overhead

net.calc_tracker_overhead

net.max_halfopen

net.diffserv_codepoint

net.limit_excludeslocal

net.upnp_tcp_only

net.disable_incoming_ipv6

net.ratelimit_utp

net.friendly_name

net.update_secure

isp.bep22

isp.primary_dns

isp.secondary_dns

isp.fqdn

isp.peer_policy_enable

isp.peer_policy_url

isp.peer_policy_date

isp.peer_policy_expy

isp.peer_policy_override

ipfilter.enable

dht.collect_feed

dht.rate

gui.log_date

boss_key

boss_key_salt

use_boss_key_pw

boss_key_pw

rss.update_interval

rss.smart_repack_filter

rss.feed_as_default_label

bt.save_resume_rate

bt.magnetlink_check_existing_files

gui.sg_mode

gui.delete_to_trash

gui.default_del_action

gui.speed_in_title

gui.limits_in_statusbar

gui.graphic_progress

gui.piecebar_progress

gui.show_status_icon_in_dl_list

gui.tall_category_list

gui.wide_toolbar

gui.show_gate_explaination

gui.show_gate_delete

gui.show_gate_notify

gui.find_pane

gui.toolbar_labels

gui.category_list_spaces

streaming.preview_player

streaming.playback_player

streaming.peer_timeout

streaming.buffer_size

streaming.generate_previews

streaming.popout_left

streaming.popout_top

streaming.popout_right

streaming.popout_bottom

btapps.auto_update_btapps

btapps.auto_update_btinstalls

btapps.install_unsigned_apps

btapps.reveal_app

btapps.skin_url

btapps.enable_activex

gui.pro_installed

gui.onboarding

gui.show_devices

gui.show_plus_upsell

gui.show_plus_av_upsell

gui.show_plus_conv_upsell

gui.plus_upsell_foreground

gui.show_plus_upsell_nodes

stats.first_time_user

stats.installed_from_bundle

stats.video1.time_watched

stats.video2.time_watched

stats.video3.time_watched

stats.video1.finished

stats.video2.finished

stats.video3.finished

stats.welcome_page_useful

gui.enable_ratings

gui.enable_comments

magnet.download_wait

gui.combine_listview_status_done

gui.update_rate

selfcert

plus.transcode_queue_parallel

plus.transcode_delete_transcripts

resume.enable_resume_dir

resume.dir_only

distributed_share.enable

distributed_share.tracker

udp://dishes-dev.trnt.us:8080

distributed_share.server_host

dishes.utorrent.com

distributed_share.pinned

distributed_share.server_port

distributed_share.auth_key

distributed_share.skip_authentication

distributed_share.initial_update

?distributed_share.churn_delay

diskio.sparse_files

distributed_share.churn_threshold

btapps.show_apps

silent_auto_update_exe

next_market_share_report

max_speed_down_tcp

max_speed_up_tcp

streaming.safety_factor

streaming.failover_rate_factor

streaming.failover_set_percentage

tray.show

tray.single_click

bind_port

gui.report_problems

gui.persistent_labels

gui.compat_diropen

gui.alternate_color

gui.transparent_graph_legend

sys.prevent_standby

sys.enable_wine_hacks

use_udp_trackers

upnp.external_tcp_port

upnp.external_udp_port

upnp.external_ip

finish_cmd

state_cmd

license_key

s_url

offers.content_offer_url

offers.offer_history

offers.content_offer_autoexec

asdlurl

gui.last_tree_node

webui.ssdp_uuid

offers.lifetime_impressions_ft

offers.lifetime_impressions_lrec

offers.lifetime_ad_req_errors

campaigncode.txt

.fileguard

Validating value '%s' for setting %d type %d

Invalid Username/Password

Can't set SO_REUSEADDR option on socket %d - %d %s

Can't bind connecting socket %d to IP %A - %d %s

%s:%s

Proxy-Authorization: Basic %s

CONNECT %s:%d HTTP/1.0

CONNECT %A HTTP/1.0

WSAEnumNetworkEvents error (%d)

Bound listening socket %d to IP %A

Can't listen on socket %d IP %A

*** TCP, uTP buffer stats ***

Error code: HTTP %d

utp.log

looking up dishes: %s %i

[%s] %s

%d:%d

%s('invalid request')

Can't parse authorization header %s

Can't find device pairing for ID %S

HTTP/1.1 301 Moved Permanently

Location: %s

HTTP/1.1 u %s

WWW-Authenticate: Basic realm="%s"

HTTP/1.1 %d %s

Connection: %s

Content-Type: %s

%s%s%s%s%s%s%s%s%s%s%s%s

%sContent-Length: %u

%sConnection: close

Can't accept invalid address '%s'

Can't accept invalid dot notation mask '%s'

Can't accept IP '%s' with invalid mask '%s'

Iphlpapi.dll

GetExtendedTcpTable

4.2.2.1

.payload

.options

update_url

update_url_btinstall

badging_url

file:///%S\apps\%S\index.html

registerPurchase_keyMissing

download_url

PlusKeyInjected

{"event": "%s", "properties": {

"distinct_id":"%s",

"h":"%s",

"v":"%d",

"c":"%S",

"token":"%s",

"svp":"%d",

"view":"%s",

"cc":%d,

"bucket":"%S",

"%s":"%S"

hXXp://yogi.apps.bittorrent.com/track/?data=%s&ip=1

X-ClientID: %s

bitdefender.btinstall

Sending autoupdate stats [%s]

ip=%s

dlurl=%U

?.bench.utorrent.com

"%s":%s,

"%s":%s

"%s":"%s",

"%s":"%s"

"%s":%d,

"%s":%d

"%s":%u,

"%s":%u

"%s":%Lu,

"%s":%Lu

[u:u][%s]

&license=%U

http%s://%U:%U@%s:%d/attach?name=%U&clientid=%U&version=%d&p=%d&ip=%I%s

proxy = hXXp://localhost:%d/proxy/0/; expires = %s GMT

hXXp://localhost

-%c%c%s-

127.0.0.1

%s:%d

0.0.0.0

"peer_id":"%s", "addr":"%A"

"markpt":"%s"

"trigger":%u

,"%u":%u

%d.%d.%d

%s/%d%d%d(%d)

%d%d%d

%d%d%d%s

%s/%s

Pairing request rejected - unsupported

ntdll.dll

rpcrt4.dll

Can't create UUID - %d

udp://

cmdline

%S: is 100%% completed

verified signature with embedded certificate for identity:%s

verified signature for trusted identity: %s

update-url

gate-info-url

certificate

url-list

Windows-

website

name.utf-8

path.utf-8

WARNING: avoiding connecting to web seed because it's blocked by policy '%s'

tracker: failure reason="%s"

port

for torrent file: %s

got tracker error response: %s

got HTTP tracker response for: %s

tracker response: %s

tracker warning: %s

got udp tracker error response: %s

got UDP tracker response for: %s

****** REQ(%s): for torrent file '%S' connecting to tracker: %S

tracker not tracking: %s

&ip=%U

%S%cinfo_hash=%.20U&peer_id=%.20U&port=%d&uploaded=%Ld&downloaded=%Ld&left=%Ld&corrupt=%Ld&key=%.8X%s&numwant=%d&compact=1&no_peer_id=1%s

tracker request: %s

for tracker %s

tracker: failure reason="%S"

valid scrape from %S

%.*S/scrape%S%cinfo_hash=%.20U

Initiating UDP scrape for torrent file: %s

Tracker URL: %s

Initiating TCP scrape for torrent file: %s

gate_url

%s?h=%s

%s?info_hash=%h&h=%s&gate_type=%s

****** update url: %s

****** gate url: %s

Could not download metadata for torrent %H (%S): %S

http:

%S: is %.2f%% completed

Adding '%S' as storage path for '%S'

.torrent

** Saving '%S' as root folder for '%S'

meta_vlc_supported

app_url

feed_url

web_seeding_enabled

gate_info_url

tfurl

webseeds

PPRIO_HTTP

Can't accept '%s' as argument

router.utorrent.com

router.bittorrent.com

hr.hdtv

hr.pdtv

webrip

ac3.5.1

Updated RSS feed %d from url %S

dd.dd.dd

dddd.dd.dd

Channel count %d for feed with url %S

Initiating RSS download of url %s

POST /e?i=%s HTTP/1.0

{"eventName":"ut_prof_ip","b":%Ld,"r":%d,"sequenceID":%d,"clientID":"%s","uniqueID":"%s","st":[

hXXp://i-45.b-%d.bench.utorrent.com/e?i=%s

%S:%s

Server: %s

Content-Disposition: attachment; filename="%s"; size=%Lu

Date: %s

ETag: "%s"

Last-Modified: %s

HTTP/1.1 %s

%s%s%s%s%s%sConnection: close

%s%s%s

HTTP/1.1 %d Error

Certification Services Division1!0

premium-server@thawte.com0

*.utorrent.com0

/hXXp://crl.thawte.com/ThawteServerPremiumCA.crl0

hXXp://ocsp.thawte.com0

.RH(Y

)hXXp://svr-ov-crl.thawte.com/ThawteOV.crl0

Certification Services Division1806

GoDaddy.com, Inc.1301

*hXXp://certificates.godaddy.com/repository100.

'Go Daddy Secure Certification Authority1

079692870

*.bittorrent.com1!0

*.bittorrent.com0

"hXXp://crl.godaddy.com/gds1-14.crl0S

hXXp://certificates.godaddy.com/repository/0

hXXp://ocsp.godaddy.com/0J

>hXXp://certificates.godaddy.com/repository/gd_intermediate.crt0

*.bittorrent.com

bittorrent.com0

*.utorrent.li1!0

*.utorrent.li0

"hXXp://crl.godaddy.com/gds1-82.crl0S

*.utorrent.li

utorrent.li0

Security.dll

Secur32.dll

1.2.840.113549.1.1.5

1.3.6.1.5.5.7.3.1

1.3.6.1.4.1.311.10.3.3

2.16.840.1.113730.4.1

1.3.6.1.5.5.7.3.2

10.0.0.0

192.168.0.0

169.254.0.0

172.16.0.0

127.0.0.0

%u.%u.%u.%u.in-addr.arpa

%x.%x.%x.%x.%x.%x.%x.%x.%x.%x.%x.%x.%x.%x.%x.%x.%x.%x.%x.%x.%x.%x.%x.%x.%x.%x.%x.%x.%x.%x.%x.%x.ip6.arpa

DEBUG: Marking %a as %s

DEBUG: IP %a is already cached. Returning %s

DEBUG: Initiating tracker prefs resolve %s

DEBUG: Hostname %s is already cached. Returning %a

DEBUG: Hostname %s cache error %d

DEBUG: Initiating resolve %s

DEBUG: Reverse %s lookup %a (FQDN: %d)

DEBUG: Reverse lookup done: %s

_bittorrent-tracker._tcp.%s

DEBUG: Processing TXT: %s

DEBUG: Resolving %s service %u

DnsApi.dll

utorrent.com

Windows

OS info: name %s release %s version %s machine %s

255.255.255.255

,"os":"%d.%d.%d.%d.%d.%s"

UTP_GET_UDP_MTU

UTP_GET_UDP_OVERHEAD

ÂµTorrent Search

js%d();

HTTP/1.0 200 OK

features/device_pairing/supported_types

Can't install web UI archive version (%d)

Can't install default UI version (%d)

version.txt

{ "name": "%s", "version": %s }

%s(%s)

GET /favicon.ico

Can't accept non-IPv4 address as IP match for %s

Can't match using invalid subnet mask %s

Found valid subnet mask %s %x

Ignoring filter IP containing invalid CIDR notation %s

IP matches IPv4 restriction %s%s%s

Can't match using IPv4 filter %s%s%s mip %x mask %x

Can't accept non-IPv6 restriction address %s

IP matches IPv6 restriction %s%s

Can't match using IPv6 filter %s%s

Can't support device pairing request lacking a PIN

Can't support invalid PIN '%s'

Can't support invalid PIN value %Ld

Can't support device pairing type '%s'

hXXp://apps.bittorrent.com/torque/pairing/style.%s%scss

%s wants access to %s

If you click yes, this site will have access to your data

%s wants access to %s

If you click yes, this site will have access to your data

HTTP/1.1 200 OK

HTTP: IP %a: GET %.200s

HTTP: IP %a: Blocked: GET %.100s

"headers": { "Content-Type": %s

, "Set-Cookie": %s

"html":%s

"error": %s

,[%S,%J,%J,%I,%I,%I,%B,%I,%I,%I,%I,%J

,[%s,%s,%s,%I,%I,%S,%S,%I,%I,%I,%I,%I,%I,%I,%I,%I,%I,%I,%I,%I,%I,%I]

autoexec

autoexec_hide_ui

Can't accept value '%s' for torrent property '%s'

Can't accept overflow value '%s' for torrent property '%s'

Can't accept negative value '%s' for torrent property '%s'

Can't accept value '%s' for unknown torrent property '%s'

{"hash": %s

,"trackers": %S

,"autoexec": %I

,"autoexec_hide_ui": %I

password

,"code": %I, "message": %s

Can't recognize torrent hash '%s'

Can't accept file number '%s'

Can't use file number '%s' - invalid for selected torrent

{"name":%S, "hash":%H, "sid":%s, "complete":%B, "completed_on":%J, "primary_label":%S, "files": [

{"name":%S, "fileno":%J, "length":%J, "complete":%B, "type":%s, "fullpath":%S,

{"name":%S, "fileno":%J, "length":%J, "complete":%B, "type":%s,

"codecs": [%s,%s]

{"name":%S, "fileno":%J, "media":%s, "length":%J, "complete":%B, "type":%s,

,"error": %S

add-url

get-url

add-unknown-url

Ignoring setting %d name %s value %s

{ "name": %s

app_update_url

,[%s,%I,%S,{"access":%s}]

, {"path": %s, "available": "%J"}

webui

, %s : [

, "name" : %s, "version" :

,{"guid":%s, "created":%J, "updated":%J, "peer_ip":%a, "sock_ip":%a, "reported_ip":%s, "user_agent":%s, "persistent":true, "custom":%s }

,{"guid":%s, "created":%J, "updated":%J, "peer_ip":%a, "sock_ip":%a, "reported_ip":%s, "user_agent":%s, "persistent":%B, "custom":%s }

Can't log out session - invalid GUID %s specified

Can't log out requester's session %s

%s out current session %s

[%S,%s,%s]

,"token": %s

Can't accept configuration change from other than administrative login

webui.uconnect_question_opted_out

webui.uconnect_username

webui.uconnect_password

webui.uconnect_enable

, "movetorrent":{"target":%S, "status":%d}

[%H,%I,%S,%J,%I,%J,%J,%I,%I,%I,%I,%S,%I,%I,%I,%I,%I,%I,%J,%s,%s,%S,%s,%J,%J,%s,%S,%I,%s]

[%S, %I]

[%I,%B,%B,%B,%B,%I,%S,%I,[

[%S,%S,%s,%I,%I,%J,%I,%I,%I,%I,%B,%B]

[%I,%I,%S,%S,%S,%S,%I,%I,%S,%I,%I,%I,%I,%S,%B,%B]

getmsg

%s({"encbody":"

,"GUID":"%s"

,"x-bt-seq":"%s"

.html

token.html

HTTP/1.1 304 Not Modified

Please wait while the ÂµTorrent WebUI is installed... You will be automatically redirected.

index.html

The ÂµTorrent WebUI does not seem to be installed. Click here to try to install it, or see the guide for more details.

index.html?error=1

There was a problem installing ÂµTorrent WebUI, please see the ÂµTorrent log for more details.

download_webui

HTTP/1.1 404 Not Found

%s({response:%s, guid:"%s"})

%s({ "sessionid": "%s", "message": "%s", "code": %d })

%s({ "message": "%s", "code": %d })

Can't create session for device ID %s

Can't accept remote pairing key

Can't accept device pairing key '%s'

Can't process pair connection authentication request without pairing key

/gui/guest.html

Unable to listen for HTTP traffic on port %d

Unable to listen for HTTP traffic on v6 port %d

%s({ "pairing_key": "%s", "pairing_type": %d, "code": %d })

UDP setsockopt(SO_RCVBUF, %d) failed: %d

UDP setsockopt(SO_SNDBUF, %d) failed: %d

DEBUG: ICMP%s is not available on this platform

%sversion-%s

hXXp://utorrent.com/webui/webui-%s-%s.zip

Web UI archive entity tag '%s'

Could not match any version from json %s

Attempting to download file %s to %S

Attempting to download web UI archive from %s to %S

Moving %S to %S

Moving %S back to %S

Attempting to read archived file %s

webui.enable

webui.enable_guest

webui.enable_listen

webui.token_auth

webui.token_auth_filter

webui.username

webui.password

webui.hashword

webui.uconnect_hashword

webui.uconnect_username_anonymous

webui.uconnect_hashword_anonymous

webui.uconnect_computername

webui.allow_pairing

webui.salt

webui.guest

webui.restrict

webui.port

webui.cookie

webui.pair_hashes

webui.download_folders

webui.raptor_host

raptor.utorrent.com

webui.raptor_port

webui.raptor_secure

webui.talon_host

remote.utorrent.com

webui.talon_port

webui.talon_secure

webui.uconnect_toolbar_ever

webui.uconnect_enable_ever

webui.uconnect_connected_ever

webui.uconnect_actions_count

webui.uconnect_actions_list_count

webui.uconnect_cred_status

webui.update_message

webui.proxy_auth

webui.update_url

hXXp://pr.apps.bittorrent.com/client-webui/3.4/client-webui.json

%p %s d %s

MTU [PROBE] floor:%d ceiling:%d current:%d

MTU [PROBE-TIMEOUT] floor:%d ceiling:%d current:%d

Packet timeout. Resend. seq_nr:%u. timeout:%u max_window:%u cur_window_packets:%d

MTU [DONE] floor:%d ceiling:%d current:%d

MTU [RESET] floor:%d ceiling:%d current:%d

Packet %u lost. Resending

actual_delay:%u our_delay:%d their_delay:%u off_target:%d max_window:%u delay_base:%u delay_sum:%d target_delay:%d acked_bytes:%u cur_window:%u scaled_gain:%f rtt:%u rate:%u wnduser:%u rto:%u timeout:%d get_microseconds:%I64u cur_window_packets:%u packet_size:%u their_delay_base:%u their_actual_delay:%u average_delay:%d clock_drift:%d clock_drift_raw:%d delay_penalty:%d current_delay_sum:%I64ucurrent_delay_samples:%d average_delay_base:%d last_maxed_out_window:%I64u opt_sndbuf:%d current_ms:%I64u

MTU [DUPACK] floor:%d ceiling:%d current:%d

MTU [ACK] floor:%d ceiling:%d current:%d

UTP_Connect conn_seed:%u packet_size:%u (B) target_delay:%u (ms) delay_history:%u delay_base_history:%u (minutes)

MTU [ICMP] floor:%d ceiling:%d current:%d

msg_type

8:msg_typei%ue

5:piecei%ue

5:added%d:

7:added.f%d:

6:added6%d:

8:added6.f%d:

7:dropped%d:

8:dropped6%d:

d1:eiÃž

12:complete_agoiÃž

11:upload_onlyiÃž

11:lt_donthaveiÃž

12:ut_holepunchiÃž

11:ut_metadataiÃž

6:ut_pexiÃž

10:ut_commentiÃž

13:metadata_sizeiÃž

1:piÃž4:reqqiÃž%s1:v%d:%s2:ypiÃž

%s: incomplete scrape response.

%s: scrape response had %d torrents, request had %d

unsupported action

UDP Tracker disabled

UTrackAnnounce(%s) called.

UTrackScrape(%s) called.

UDP Trackers disabled.

Invalid tracker URL.

[%u] log closed

**** Register(0x%p, %S) returning %p

Checking label: %S against %S

Match: %S

Unregister(%S) returning NULL!!!

proxy.proxy

proxy.type

proxy.port

proxy.auth

proxy.resolve

proxy.username

proxy.password

%s Remote disconnected: reset by proxy

http_pending_limit

min_http_connections

%H:%Lx:%x

Content-Disposition: attachment; filename="%s"

Content-Disposition: %s

%s%s%s%sServer: BitTorrentProxy/1.0

%s([""

%s; filename="%s"

?queue.dont_count_slow_dl

queue.dont_count_slow_ul

queue.slow_dl_threshold

queue.slow_ul_threshold

queue.use_seed_peer_ratio

queue.prio_no_seeds

queue.switchtime

queue.switchtime_prio

queue.started_bonus

bt.tcp_rate_control

gui.graph_tcp_rate_control

gui.graph_overhead

gui.graph_legend

bt.ratelimit_tcp_only

bt.prioritize_partial_pieces

bt.transp_disposition

net.utp_target_delay

net.utp_packet_size_interval

net.utp_receive_target_delay

net.utp_initial_packet_size

net.utp_dynamic_packet_size

net.discoverable

bt.enable_pulse

bt.pulse_weight

bt.extra_ul_rand

bt.extra_ul_max

bt.prio_piece_thres

bt.few_pieces_thres

bt.http_pending_limit

bt.dl_queue_factor

bt.ul_queue_factor

bt.scrape_stopped

bt.compact_allocation

bt.progressive_piece_picker

bt.progressive_piece_span_mb

bt.enable_tracker

bt.use_dns_tracker_prefs

bt.read_only_on_complete

bt.multiscrape

bt.send_have_to_seed

bt.set_sockbuf

bt.rcv_max_sockbuf

bt.snd_max_sockbuf

bt.connect_speed

bt.prio_first_last_piece

bt.randomize_peer_id

bt.determine_encoded_rate_for_streamables

streaming.min_buffer_piece

bt.sequential_download

bt.sequential_files

bt.allow_same_ip

bt.use_similar_torrent_data

bt.no_connect_to_services

bt.no_connect_to_services_list

bt.ban_threshold

bt.use_ban_ratio

bt.ban_ratio

bt.use_rangeblock

bt.graceful_shutdown

bt.shutdown_tracker_timeout

bt.shutdown_upnp_timeout

peer.lazy_bitfield

peer.lazy_bitfield_mode

peer.lazy_bitfield_factor

peer.lazy_bitfield_nohave

peer.resolve_country

peer.disconnect_inactive

peer.disconnect_inactive_interval

choker.interval_auto

choker.interval

choker.interval_optim

choker.slots_auto

diskio.flush_files

zz.countries.nerd.dk

%I.%s

DEBUG: Skipping torrent peer resolve: %t 0xX %d

"url"

keyhash

Saving serialized device pairing set with %lu pairings at %S

Can't create pairing from hierarchy at %u from %S

Can't load non-dictionary hierarchy at %u into pairing set from %S

Can't load non-list hierarchy into pairing set from %S

%s serialized device pairing set (%lu devices) from %S

** Generated %d character session cookie: GUID=%s

reported_ip

global_key

Searching for device pair session with id %s

Can't accept id %s as a GUID

BenchHttp redirect to HTTPS. Not supported

User-Agent: ut_core BenchHttp

BenchHttp status line not recognizable "

** FileStorage::SetFolderRoot(%S) failed with _folder '%S'

** FileStorage::SetFolderRoot(%S) failed: _folder is NULL or empty.

** FileStorage::SetFolderRoot(%S): setting for folder '%S'

Warning: Delete to trash failed for %S. Error: %d. Deleting permanently.

"to_trash":%d, "error_code":%d

diskio.no_zero

diskio.use_partfile

diskio.smart_hash

diskio.smart_sparse_hash

diskio.coalesce_writes

diskio.coalesce_write_size

diskio.rsize_factor

diskio.max_write_queue

diskio.cache_reduce_minutes

diskio.cache_stripe

diskio.quick_hash

diskio.mark_of_the_web

diskio.minimize_kernel_caching

diskio.all_writes_sync

cache.override

cache.override_size

cache.reduce

cache.write

cache.writeout

cache.writeout_age_max

cache.writeout_headspace

cache.writeimm

cache.read

cache.read_turnoff

cache.read_prune

cache.read_thrash

nJT_IMPORT

Error: COMPACT_NOT_FOUND. P=%d,T=%d

%s:%H:%d:%s

%s: %s

239.255.255.250

Created SSDP UUID %s

The external port cannot be wild-carded

The port mapping entry specified conflicts with a mapping assigned previously to another client

Internal and External port values must be the same

The NAT implementation only supports permanent lease times on port mappings

ExternalPort must be a wildcard and cannot be a specific port

UPnP: Discovered host: %s

UPnP: Checking cached host %s

UPnP: Cached host %s (%I) is not part of our subnet %I/%I.

UPnP: Queueing cached host %s

UPnP: Unable to bind to UPnP port: %d

UPnP: Joined multicast group

M-SEARCH * HTTP/1.1

HOST: 239.255.255.250:1900

NOTIFY * HTTP/1.1

LOCATION: hXXp://%A

SERVER: %s/%s UPnP/1.1 %s/%s

NTS: %s

USN: uuid:%s

FRIENDLYNAME:%S

HH:%s

%s(%s)(%s)

CACHE-CONTROL: max-age = %d

LOCATION:hXXp://%A

USN:uuid:%s

recvfrom ERROR: %d

UPnP: Found location from upnp notify: %s

urlbase

controlurl

eventsuburl

scpdurl

NewExternalPort

NewInternalPort

hXXp://%s:%d/%s

UPnP: The device "%s" is not a UPnP router (%s)

AddPortMapping

DeletePortMapping

GetGenericPortMappingEntry

%d%s%d%I1%s (%s)0

%d%s

%d

%s>

GET %s HTTP/1.1

Host: %s:%d

POST %s HTTP/1.1

HOST: %s:%d

CONTENT-LENGTH: %d

SOAPACTION: "%s#%s"

%s port %d -> %I:%d

%s port %d

UPnP: %s is already mapped. Not re-mapping.

UPnP: Removed %s

UPnP: ERROR removing %s: (%d) %s

UPnP: Mapped %s

UPnP: %s mapped successfully.

UPnP: Host '%s' added to cache.

UPnP: ERROR mapping %s. Deleting mapping and trying again: (%d) %s

UPnP: ERROR mapping %s: (%d) %s

UPnP: Device error "%s": (%d) %S

UPnP: Could not map UPnP Port on this pass, retrying.

UPnP: Could not detect external IP on this pass, retrying.

UPnP: Unable to map port %I:%d with UPnP.

Unsupported Version

Not Authorized/Refused (e.g. box supports mapping, but user has turned feature off)

Unsupported opcode

NAT-PMP: error: %s

NAT-PMP: %s %s port %d -> %I:%d

NAT-PMP: Unable to map port with NAT-PMP.

"period":%d,

"n_samples":%d

,"active_seeds":"%s"

,"active_downloads":"%s"

,"up_tcp":"%s"

,"down_tcp":"%s"

,"up_utp":"%s"

,"down_utp":"%s"

,"up_tcp_max":%u

,"up_utp_max":%u

,"down_tcp_max":%u

,"down_utp_max":%u

UPnP(XP): Removed TCP port %d

UPnP(XP): Removed UDP port %d

UPnP(XP): %s port %d -> %I:%d is already mapped. Not re-mapping.

UPnP(XP): %s port %d -> %I:%d mapped successfully.

-----BEGIN CERTIFICATE-----

com.bittorrent

%s trusted

5:owner%d:%s4:text%d:%s9:timestampi%Lde4:likeiÃž

AVI header too large in %S

Can't find AVI header chunk in %S

8:msg_typeiÃž

3:numiÃž

6:filter%d:

%T: [%s (%:.1d)] picked no blocks

239.192.152.143

BT-SEARCH * HTTP/1.1

Host: 239.192.152.143:6771

Port: %u

Infohash: %s

port:

keys

hXXp://update.utorrent.com/streamstats.php?t=%Ld&bb=%Ld&b=%Ld&s=%Ld&ft=%d&fb=%Ld&v=%dx%d&fe=%U&u=%d&nu=%d&nuc=%d&iu=%d&ps=%d&cc=%d&fs=%d&pt=%d&cpt=%d&nr=%d&cnr=%d&pl="%s"&tid=%x&fid=%x&timeout=%d&buffer=%d%s&svp=%d

CbDP.jR6YD6wAj2ByQWxQxQZ7.9J9xkn2.Uqb3zVm16vQyizprhBw9hi80psatZ8k54vwZfiIeEHZVsDnyqeWSSIpWso.wh5GD4OFgdhVI3

iqJ7nFZ4bGCRjE1F.FXEwL085Zb0kLM2TdHDaVVCdq0cKxvnH/0FLskJTKlDtt6sDl89dc//aEULTVFGtcbA/tDzc.bnFE.DWthQOu2n2JwKjgKfgCR2lZFWXdnWmoOh

Ewl2hcjiutMd3Fu2lgFnUXWSc67TVyy2vwYCKoS9MLsrdJVT9RgWTCuEqWJrfB6uE3LsE9GkOlaZabS7M29sj5TnzUqOLJMjiwEzArfiLr9WbMRANlF68N5AVLcPWvNx6Zjl3m5Scp0BzJBz9TkgfhzKJZ.WtP3Mv/67I/0wmRZ

F//////////oG/QeY5emZJ4ncABWDmSqIa2JWYAPynq0Wk.fZiJco9HIWXvZZG4tU.L6RFDEaCRC2iARV9V53TFuJLjRL72HUI5jNPYNdx6z4n2wQOtxMiB/rosz0QtxUuuQ/jQYP.bhfya4NnB7.P9A6PHxEPJWV//////////

3NUKQ2Re4P5BEK0TLg2dX3gETNNNECPoe92h4OVMaDn3Xo/0QdjgG/EvM.hiVV1BdIGklSI14HA38Mpe5k04juR5/EXMU0r1WtsLhNXwKBlf2zEfoOh0zVmDvqInpU695f29Iy7sNW3U5RIogcs740oUp2Kdv5wuITwnIx84cnO.e467/IV1lPnvMCr0pd1dgS0a.RV5eBJr03Q65Xy61R

dUyyhxav9tgnyIg65wHxkzkb7VIPh4o0lkwfOKiPp4rVJrzLRYVBtb76gKlaO7ef5LYGEw3G.4E0jbMxcYBetDy2YdpiP/3GWJInoBbvYHIRO9uBuxgsFKTKWu7RnR7yTau/IrFTdQ4LY/q.AvoCzMxV0PKvD9Odso/LFIItn8PbTov3VMn/ZEH2SqhtpBUkWtmcIkEflhX/YY/fkBKfBbe27/zUaKUUZEUYZ2H2nlCL60.JIPeZJSzsu/xHDVcx

2iQzj1CagQc/5ctbuJYLWlhtAsPHc7xWVyCPAKFRLWKADpASkqe9djWPFWTNTdeJtL8nAhImCn3Sr/IAdQ1FrGw0WvQUstPx3FO9KNcXOwisOQ1VlL.gheAHYfbYyBaxXL.NcJx9TUwgWDT0hRzFzqSrdGGTN3FgSTA1v4QnHtEygNj3eZ.u0MThqWUaDiP87nqha7XnT66bkTCkQ8.7T8L4KZjIImrNrUftedTTBi.WCi.zlrBxDuOM0da0JbUkQlXqvp0yvJAPpC11nxmmZOAbQOywZGmu9nhZNuwTlxjfIro0FOdthaDTuZRL9VL7MRPUDo/DQEyW.d4H.UIlzp

///////////93zgY8MZ2DCJ6Oek0t1pHAG9E28fdp7G22xwcEnER8b5A27cED0JTxvKPiyqwGnimAmfjybyKDq/XDMrjKS95v8MrTc9UViRqJ4BffZVjQml/NBRq1hVjxZXh.rg9dwMkdoGHV4iVvaaePb7iv5izmW1ykA5ZlmMOsaWs75NJccaMFwZz9CzVWsLT8zoZhPOSOlDM88LIkvxLAGTmbfPjPmmrJagyc0JnT6m8oXWXV3AGNaOkDiuxuvvtB1WEXWER9uEYx0UYZxN5NV1lJ5B9tYlBzfLO5nWvbKbywfLgvHNI9XYO.WKG5NAEMeggn2sjCnSD151wCwXL8QlV7BfaxFk515ZRxmgAwd5NNGOCVREN3uMcuUJ7g/MkZDi9CzSUZ9JWIYLXdSxZqYOQqkvhyI/w1jcA26JOTW9pFiXgP58VAnWNUo0Ck.4NLtfXNMnt2OZ0kjb6uWZYJw1qvQinGzjR/E3z48vBWj4WgJhIol//////////

F//////////oG/QeY5emZJ4ncABWDmSqIa2JWYAPynq0Wk.fZiJco9HIWXvZZG4tU.L6RFDEaCRC2iARV9V53TFuJLjRL72HUI5jNPYNdx6z4n2wQOtxMiB/rosz0QtxUuuQ/jQYP.bhfya4NnB7.P9A6PHxEHRFS80VBYXOxy5cDf8DXnLqvff5Z.e/IJFNuDbNIFSewsM76BpLY25KhkUrIa7S9QMRMSCDKvAl9W4yNHi2CeO8Nmoa5v6BZREE.EUTomO3eO3coU3ekm7ee.rnLtmRqnIoTuho/QLM1SOEPL9VEgLQkKLqYOOcFe541LoZbgAgiGjhJCN3GHGUZEeLI6htnowPEpxXGHOs.yAYkfnLrq637spbm.5fk7anwlrhepR2JFN7eoKu4ebOPtEuz8c6jBkQ/4l.WRPYWXas7O2Spx8QcHI7oiO5tiW3BlX5rTwOLriTmc8mBhPHk88ua.WTEMhCKFRM/pW/H2EIuBH8AaX204QSZmIfuVcruXncX2zkbiccSCd66hquZmQb6WqjXKBsYM3wSegr4pesxl2smJUZlakZlmK7xxAfYXyMKTEQy1TcRAMJw2Gmw8ZEw66KLldxHzXAN3EujUlk1lTTY5mI1pG1f4drR1QgPEqwfYDZzt1Xl.tt92cm8zDz3N9D0OncV//////////

///////////93zgY8MZ2DCJ6Oek0t1pHAG9E28fdp7G22xwcEnER8b5A27cED0JTxvKPiyqwGnimAmfjybyKDq/XDMrjKS95v8MrTc9UViRqJ4BffZVjQml/NBRq1hVjxZXh.rg9dwMkdoGHV4iVvaaePb7iv5izmW1ykA5ZlmMOsaWs75NJccaMFwZz9CzVWsLT8zoZhPOSOlDM88LIkvxLAGTmbfPjPmmrJagyc0JnT6m8oXWXV3AGNaOkDiuxuvvtB1WEXWER9uEYx0UYZxN5NV1lJ5B9tYlBzfLO5nWvbKbywfLgvHNI9XYO.WKG5NAEMeggn2sjCnSD151wCwXL8QlV7BfaxFk515ZRxmgAwd5NNGOCVREN3uMcuUJ7g/MkZDi9CzSUZ9JWIYLXdSxZqYOQqkvhyI/w1jcA26JOTW9pFiXgP58VAnWNUo0Ck.4NLtfXNMnt2OZ0kjb6uWZYJw1qvQinGzjR/E3z48vBWj4WgI480HfoF1AdX.RNY76Q4BswMoQPmoSOQlJYF1gKQ3Is5GlQ9OFfoYhKJEZRkyBR1DwE.IwE/1GVligcA7nPHqvhm5sPifPFe933eYCxeOPHM.Vj7s4fSCxYrw.u6zrs8N187D06aIVLi5gfaxJgc8sFtS66/xVSaAR0ZqtqDSaq0eIIDiFwjD9yS2R1rDooO2P6tibr7dOzkZUz.F.K1gsUKmxbspWlGJ01hh1gK.sG9zWn5vSdi8PQYHZQFjlhpviKxKJERBhErBiRstyKH.RC9Kip855HAzUlGc.uz04tZDA/MOFA0SPBakpmCkeLqN8T0/I2ryvkTFxsrLvmBqQO38Arg40na0iSdbddoN..n.Zp8wbwVZRCYBuF7KMt/rXQnKlK1x8hGLIgp8zjVhz8uTWKp5xI3u0tuAUN5Uxoc.Ce1g7LYxV5sdRrKAezYX./yEiPpB6Z4zLSsbR9x2xobZ8uV.ZNRZm4Q0G.ZsO/I63k4hyjMmjqTDRcbFaURSn09F//////////

3//////////yaFsg8XQC8qnCPYYu3S7D4f0au8YcVCT08BlgOx4viYKKe8UOuq1DtlbHcppJf36p0h2ctoNnGtJ.4rRMrHmaNaXRLsObv.nlHCGkccD.rh2/zSjlG6j.tkE6lxMecVfQwV915yIn/cIIXcKUpaMpt207oueME/1PZQI3OSLTEQQHO/gFqapr.3PLqZtAEjbXnYyrOWXLAxdjKf1t2Mbcrd33LEIhoO1F5qR0ZA625yCf1UHYuspZlZddSi60w60vidWwBi1wAFjSLTy6zCKidUAylsbLWN63cLINpgbMhb5T8c69Zw1H0LSevQYgh4BQqp5mq4K7epg5KXgzySkcJi.uK4MDll2ehgSLTT1WnzivSFXQRXvCUhzQwCsmaprnwCbE1A9M6TpkFI9XhIxclnB/e6sOe8PDXs0dC.o6faKXyh61Tx80oxuHTNUc5TR7S9YC2wsKRY2E9Fe7Jbgp53srlyuFqGZak2qI2f8GW16d8y4gU7vjU8SPeGlRfR9fd39nXgzE8y6fHeDBOL2zebW.dAAjHCwDkxmji4texvBexy51..ogOeV5b7Jcl0NPcoba.WaCEY8pkXXb5Rv.qVOIbmpkBNhxWRtNOXS4WSq0QH9zMmMgcJjEgOZO/TmOR/jzoGfi2FJVGroJG2X98sm/gqqdnm9i7KtB9W9aRUoNKUTZswDxtu/vG6hPvJ3kNRE2z1C06ki6fJxP0ds34NboUmXbg96De.s.lFcnJjHCvikixKknlRVnH7vimbIpCWKL4hrwz2RxZq0JUCqhzPWye1nakIxF0owXNHSXq3z8BNpcvq/lRLNd0lHfWCWhMeG36G2noUMUV9Vxx7wFCZgNf.Dio8lWyTHRV/M5h5IzG7iYj1LAhCZsr.lqZXs1JCNj8FW3VWfvSLxlARuoW6eTMBjyNQTlLGgZsA7x/mwndCiQCJrLpQLidiBlAMCZX/wDTkF0He13wFPZz8OEuIlorR2tHqrkQK.HvjlX5PTAEIRnB.vUGuTtosgJBVZDY.nD1pkJ6wEyWojesTqm1q7wU/Yln7xILszfDhf2HcEgjZd5hazMWq8xHqA/79U2EF5ilZdMKju/sullo4YjaY8Yu4f0Dy1nFhLwWQ8/37D7FyP6pgC6jBoyY6BuE5tVgTIt.Ym8VeUMWp0.rRtJe6Appriw9ufcqg4/W/HFWjtp4Eu7IhQZP5b.YPe2LTmMJp7CK8HeKT.Qj86LtjVg6nrH2zVkTDS/hpQyCUpw9eDP16zEk7dv902KEBI1niruYQ02xLxZWhoHaDflm2RaULMEH7LdVfgfumKE9sLfJVo1zMw82vRd5WoO3TcEtJt///////////

TEMP_PASSWD.conf

TEMP_PASSWD

.btsearch

.btinstall

.btapp

.btskin

Setting value of setting %s key %d to %s

Cookie: %s

%s/%s/%s

%s%s/%s

psapi.dll

%s %s

"name": "%s"%c %s%c %s

%s %dx%d

"video_codec": "%s", "video_bitrate": %d, "fps": %d, "video_x": %d, "video_y": %d

%s %dkbps

"audio_codec": "%s", "bitrate": %d, "sample_rate": %d

Failed btapp function %S, reason '%s'

rss_feed_url

streaming_url

\u00x

4:port

12:implied_porti1e

DHT: %s

Received: %u requests (%u B), %u replies (%u B), %u no quota (%u B), %u invalid (%u B)

Sent: %u requests (%u), %u replies (%u)

Num buckets: %d. My DHT ID: %s

Bucket -: %.8X nodes: [%-8s] replacements: [%-8s], span: %d, unpinged: [%-8s]%s

%dm %ds

Total peers: %d (in replacement cache %d)

Deepest bucket: %d [target: %d]

%d: %s/%s: %d peers

Total peers: %d

Total torrents: %d

5:nodes%d:

1:vliÃžiÃžiÃžiÃžiÃže

1:t%d:

1:v4:%c%c%c%c

1:n%d:%.*s

d1:eli%ue%u:%se

1:k%d:

3:sig%d:

%d:%s

5:token%d:

1:v%d:

4:voteiÃž

implied_port

Ft ad unit will next refresh in %d seconds

Lrec ad unit will next refresh in %d seconds

AdUnitManager::CanInitViaSettings? EnableAds? %d lrec %d ft %d

ftEnabled = %d

lrecEnabled = %d

ftRefreshRatePattern = [%s]

lrecRefreshRatePattern = [%s]

adRefreshRatePattern = [%s]

ftAdId = %d

lrecAdId = %d

contactRate = %d

send_conversion = %d

cfu EnableAds? %d cfu lrec %d cfu banner %d; user lrec %d user banner %d

offers.adcookie

offers.ad_user_key

offers.server_ad_site

offers.server_ad_logging

offers.cfu_left_rail_offer_enabled

offers.cfu_sponsored_torrent_offer_enabled

offers.stat_sent_time

offers.lifetime_clicks_ft

offers.lifetime_clicks_lrec

offers.lifetime_ad_autoexec_errors

offers.lifetime_ad_image_errors

offers.lifetime_ad_missing_errors

offers.ad_traffic_tag

offers.site_id

offers.adcontrol

offers.firebuglite

offers.send_conversion

offers.enabled

offers.ftEnabled

offers.lrecEnabled

offers.lrecXButton

offers.lrecXUpgradeUrl

offers.piSettings

offers.survey

offers.adRefreshRatePattern

offers.ftRefreshRatePattern

offers.lrecRefreshRatePattern

offers.lrecAdTypes

offers.ftAdTypes

offers.contactRate

offers.adUrl

hXXp://cdn.bitmedianetwork.com/network/index.html

offers.ftAdId

offers.lrecAdId

offers.geoip_country

offers.clientReceivedAdRulesFromServer

offers.graphicscard_check_timestamp

offers.refreshOnBundles

offer.log

offer2.log

------------- log opened %s

--lrec is disabled: user %d cfu %d

--ft is disabled: user %d cfu %d

adurl

--ParseAdControls skipping dict not matching client version %d.%d.%d

--ParseAdControls skipping dict not matching min feature level %d

--ParseAdControls skipping dict not matching max feature level %d

--ParseAdControls skipping dict not matching client campaign code %d

--ParseAdControls url

lrecXUpgradeUrl

--ParseAdRules name %s

--ParseAdRules skipping dict not matching client version %d.%d

--ParseAdRules skipping dict not matching client id %s

--ParseAdRules skipping dict not matching client country %s

--ParseAdRules skipping dict not matching client language %s

--ParseAdRules skipping dict not matching client campaign code %d

--ParseAdRules %s %d

--ParseAdRules %s [%s]

https?:\/\/.*bitmedianetwork\.com.*

https?:\/\/.*bittorrent\.com.*

?456789:;

!"#$%&'()* ,-./0123

&&&&6666????

""""****

2222::::

$$$$\\\\

00006666

####====

0123456789

Opening help file: %S %S

hXXp://download.utorrent.com/help/utorrent-help-3451.zip

utorrent.chm

hXXp://VVV.utorrent.com?client=%s%s

hXXp://forum.utorrent.com?client=%s%s

hXXp://content.bittorrent.com?client=%s%s

hXXp://bit.ly/18x3YHD?client=%s%s

hXXp://VVV.utorrent.com/faq?client=%s%s

bittorrent.com

.btkey

onWmClose: %s

onWmClose: msg %d

hXXp://update.bittorrent.com/time.php

hXXp://VVV.facebook.com/utorrent

hXXp://twitter.com/utorrent

DoDestroy %s

"action":"%s.%d.%d.d.%d.d"

hXXp://bundles.bittorrent.com/feed.rss

hXXp://beta.bundles.bittorrent.com/feed.rss

[autorestart] Attempting to upgrade: (%S) -> (%S)

http%s://%s:%d%s

VVV.bittorrent.com

Can't connect to %s Remote - username or password incorrect/invalid

udp://tracker.openbittorrent.com:80/announce

udp://tracker.publicbt.com:80/announce

udp://tracker.ccc.de:80/announce

WM_ENDSESSION mode %d lparam %x

english.txt

MsgBoxData

TaskDialogIndirect

comctl32.dll

uxtheme.dll

ll.download3.utorrent.com

llsw.download3.utorrent.com

error %d

UxTheme.dll

inspsearch.com

%s/favicon.ico

file=%U

%S#hXXp://localhost:%d

Shell32.dll

Mininova|hXXp://VVV.mininova.org/search/?cat=0&search=

?update.utorrent.li

http%s://%s/checkupdate.php

hXXp://%s/updatestats.php

hXXp://%s/installstats.php

hXXp://%s/update_event.php

%s Updater

"g_version":%d, "action":"autoupdate window click", "choice":"%s", "no_sau":%d

u.url

u.siz

u.sha

u.sig

u.ver

l.url

l.siz

l.sha

l.sig

l.ver

u.msg

tb_badge_url

specialOfferAcceptUrl

cid=%s&cc=%d&l=%d

sv.id

sv.mode

sv.title

sv.url

sv.dur

sv.min

sv.max

sv.spcnt

IgnoreCheckNewVerCallback: error=%S,err=%d, reply=%s

Received search: %S

New search URL added (first check): %S

After removing duplicate previously seen searches: %S

served_search_list set to %S

After removing duplicate user searches: %S

search_list set to %S

CheckNewVerCallback: error=%S,err=%d, reply=%s

Got autoupdate response [%s]

searchUrls

trayOfferImageUrl

trayOfferTargetUrl

Got blacklist with %u items.

bv[%i]: %i (build %S)

MS_Windows

%u,%u,%u,%u,%u

tk=%U

sids=%s

&lv=%d_%d_%U

rgc=%d

pt=%s

ap=%s

incodecs=%s

outcodecs=%s

doainstalled=%U

ie=%S

secp=%U

secn=%U

cehh=%S

Sending autoupdate request [%s]

%s.%d.%d.d.%d.d

nidhi_web_monitor_daily

"tags":[ %s ]

Sending autoupdate exit ping [%s]

%s?h=%s&v=%d&ol=%U&ul=%U&tk=%U&c=%U

hXXp://apps.bittorrent.com

Failed to connect to host at: %s

.opcandy

.opinstall

cached_key

keyFail

string key empty

not a btos key

invalid map key

CrashMsgBoxThread

bundled_url

Portuguese (Brazil)!ptBR

Portuguese (Portugal)!pt

hXXp://utorrent.com/download/langpacks/dl.php?build=41712&ref=client&client=utorrent&sys_l=%s&sel_l=%d&tk=%s

offers.featured_content_url

gui.last_preference_tab-1.8

gui.last_overview_tab-1.8

gui.last_bundle_visit

gui.last_badging_check

gui.bundle_rss_etag

gui.bundle_rss_last_modified

gui.cat_all_expanded

gui.cat_labels_expanded

gui.cat_rss_expanded

gui.cat_devices_expanded

gui.last_tree_node_installer

gui.granular_priority

gui.overhead_in_statusbar

gui.show_av_icon

gui.show_rss_favicons

gui.ulrate_menu

gui.dlrate_menu

gui.manual_ratemenu

gui.show_player_node

gui.use_fuzzy_dates

gui.show_notorrents_node

gui.find_pane_user_clicked

gui.playback_tab_hidden_by_user

gui.auto_restart

webui.remote_enable

gui.dblclick_seed

gui.dblclick_dl

gui.color_progress_bars

gui.launch_plus_app

btapps.startup_app_url

btapps.startup_app_arg

vpn.dark_mode

offers.left_rail_offer_enabled

offers.sponsored_torrent_offer_enabled

offers.backup_left_rail_offer_enabled

offers.backup_sponsored_torrent_offer_enabled

offers.backup_restored

offers.featured_content_badge_enabled

offers.featured_content_notifications_enabled

offers.featured_content_rss_enabled

offers.featured_content_rss_url

offers.featured_content_rss_update_interval

offers.featured_content_rss_randomize

offers.streamingtrial

offers.streamingtrial_start_time

offers.upgrade_panel

offers.upgrade_toolbar

offers.display_tooltips

offers.404_url

offers.days_to_show

ERROR VerifyVersion failed with: %S

{"path":"%s","version":"%d","blacklisted":"%d","crash_count":"%d","opt_out":"%d","running":"%s"}

Saving new version to %S

SaveExeFail

Saving new lang file to %S

Checking for update on %s

"dmver":%d, "cau":%d

"status":"%S"

LaunchTargetVersion removed non-existent target: %S

"status":"Removed missing target:%d"

Launching version: %d with command line: %S

Target path: %S

JSON dump: %s

LaunchVersion: ShellExecute returned %d.

"status":"ShellExecute returned:%d"

CopyVersionToInstallDir new_path = %S

CopyVersionToInstall failed on WaitForSingleObject: %d

"status":%d

Relocate Version didn't find updates\ in path: %S

Failed to CopyVersionToInstallDir %S

Launching %S with command line: %S

RelocateVersion: ShellExecute returned %d.

"status":"ShellExecute returned %d"

"launched_target":%d,"updated":%d,"relocated":%d,

Failed to create directory: %S

,"res":"%s"

"res":"ReportCAUSuccess"

"res":"%s"

%s, "action":"%s", "g_version":%d, "no_sau":%d

[OnSAUPingDone] Handle: 0x%x

[OnSAUPingDone] Error: %d

%s%s"action":"%s","nosau":%d,"dl":%Lu,"fv":%d,"ev":%d,"cau":%d

[SendSAUMetrics] %s: %s

[SendSAUMetrics] Handle: 0x%x

error:%d msg:%S

download.utorrent.com

download.bittorrent.com

nvappfilter.dll

nvlsp.dll

MxAVlsp.dll

ifw_xfilter.dll

Niphk.dll

SARAH.dll

imon.dll

MImp.dll

MIPro.dll

radhslib.dll

Naomi Web Filter

adguard.dll

HMIPCore.dll

dnsq.dll

jesterrun0.dll

protect.dll

laf1.dll

Win32/Hoax.Renos.NAV

laf2.dll

laf3.dll

laf4.dll

laf5.dll

t0.dll

Trojan-Downloader.Agent.Pto

t1.dll

ftp34.dll

'%s' (%s)

'%s' (%s) (known malware!)

HttpOpenRequestA

HttpSendRequestA

\DBGHELP.DLL

DBGHELP.DLL

\%d-%s.%.4x.dmp

can't load wininet.dll

/crash.php?cl=%s&ver=%dU&h=%s&p=%dU&pr=%dU&s=%dU&svp=%d&ov=%d&plus=%d

&dl=%s

HttpOpenRequest failed

HttpSendRequest failed

HttpQueryInfo failed

Error %d :

OV_COL_SOURCE_URL

player.btinstall

%Y-%m-%d

%s%cplus=%d&client=%s&x-source=%s&bkt1=%d

update_%s

%s?starttime=%Ld

%s&starttime=%Ld

%s&badge=%d

file=%s

badcert

plus=%d&cid=%s&code=%d

hXXps://VVV.surveymonkey.com/s/C2VFYPC

hXXp://cdn.ap.bittorrent.com/control/feature/tags/ut.json

hXXp://cdn.ap.bittorrent.com/control/feature/tags/bt.json

hXXp://cdn.ap.bittorrent.com/control/feature/tags/staging_ut.json

hXXp://cdn.ap.bittorrent.com/control/feature/tags/staging_bt.json

feedbackSurveyUrl

virus.bd_state

hXXps://activate.utorrent.com

activation response (%d): body = %s, err = %S

activation response: signature = %s

POST /get_license HTTP/1.1

{ "license_key": "%s", "fingerprint": "%s", "can_update_license": true }

activation request: %s

?license_key=

RSS_COL_SOURCE_URL

hXXp://VVV.utorrent.com/help/guides/rss

winmm.dll

hXXp://remote.utorrent.com/send?btih=

%s%H&dn=%U&message=%U&sid=%s&cid=%U

%s%H&dn=%U&message=%U

hXXp://tinyurl.com/api-create.php?url=%U

100mb.test

150mb.test

100kb.test

500kb.test

1mb.test

2mb.test

7mb.test

15mb.test

30mb.test

75mb.test

hXXp://ll.VVV.bittorrent.com/llspeedtest/

hXXp://update.utorrent.com/speedstats.php?result=

%s%d:%d:%d:%d:%s

ndt.iupui.par01.measurement-lab.org

ndt.iupui.ath01.measurement-lab.org

ndt.iupui.ams01.measurement-lab.org

ndt.iupui.ams02.measurement-lab.org

ndt.iupui.lhr01.measurement-lab.org

ndt.iupui.lax01.measurement-lab.org

ndt.iupui.nuq01.measurement-lab.org

ndt.iupui.mia01.measurement-lab.org

ndt.iupui.atl01.measurement-lab.org

ndt.iupui.ord01.measurement-lab.org

ndt.iupui.lga01.measurement-lab.org

ndt.iupui.lga02.measurement-lab.org

ndt.iupui.dfw01.measurement-lab.org

ndt.iupui.sea01.measurement-lab.org

hXXp://utorrent.com/testport?plain=1

&port=%d

hXXp://ll.VVV.bittorrent.com/llspeedtest/speedtestobjects.txt

hXXp://update.utorrent.com/speedserverlist.php

hXXp://VVV.utorrent.com/testport.php?port=%d

tcp_upload_limit

tcp_download_limit

tcp_upload_rate

tcp_download_rate

graph_import

hXXps://VVV.facebook.com/connect/login_success.html

hXXp://VVV.facebook.com/connect/login_success.html

hXXps://VVV.facebook.com/login.php

hXXp://VVV.facebook.com/login.php

hXXps://VVV.facebook.com/connect/uiserver.php

hXXp://VVV.facebook.com/connect/uiserver.php

hXXps://VVV.facebook.com/dialog/permissions.request

hXXp://VVV.facebook.com/dialog/permissions.request

hXXps://VVV.facebook.com/checkpoint/

hXXp://VVV.facebook.com/checkpoint/

&scope=%S

client_id=%S&redirect_uri=%s&response_type=token&display=popup%s

hXXps://VVV.facebook.com/dialog/oauth

hXXp://VVV.facebook.com/dialog/oauth

&to=%S

app_id=%S&display=popup&message=%s&redirect_uri=%s%s

hXXps://VVV.facebook.com/dialog/apprequests

libvlc_video_set_key_input

libvlccore.dll

libvlc.dll

--http-reconnect

^ ;;;; \

JF.~.WKBF

JF.~.WKKKBF

.WKK[9

66~66~66

DKK[9t.XNKKKY

^5^55^5^{//3

-03@1@30-

,5$8

version.dll

i-41.b-41712.bench.utorrent.com

{"h":"%s","cl":"%s","v":%d,"l":"%s","w":"%s","cts":%I64u,"tsi":%I64u,"eventName":"crash","action":"%s.%d.%d.d.%d.]","plus":%d,"bad_dlls":"%s"%s}

PE_COL_PORT

%s%S,

.mpeg

.alac

.mp4v

.divx

.flac

.rmvb

.webm

.dvr-ms

hXXp://VVV.apple.com/itunes

certifiedlabel

client.os.name:Windows

client.browser.name:%s

client.kernel.version:%s

client.version:3.3.13

client.utorrent.version:%d

read: got error: %d

Download Bytes: %lu, time: %f

Download: %s

Upload: got error: %d

Upload Bytes: %lu, time: %f

Upload: elasped time: %f

Upload: %s

123456 654321

&audio=%d&brand=%S

&daystoexpire=%d

&threshold=%d

hXXp://help.utorrent.com/customer/portal/articles/257678

invalid object key (must be a string)

object key and value must be separated by a colon (':')

after key and value, inside map, I expect ',' or '}'

function not supported

operation canceled

address_family_not_supported

operation_in_progress

operation_not_supported

protocol_not_supported

operation_would_block

address family not supported

broken pipe

inappropriate io control operation

not supported

operation in progress

operation not permitted

operation not supported

operation would block

protocol not supported

0123456789-

%b %d %H : %M : %S %Y

%m / %d / %y

%I : %M : %S %p

%d / %m / %y

Visual C CRT: Not enough memory to complete call to strerror.

Operation not permitted

Inappropriate I/O control operation

Broken pipe

operator

GetProcessWindowStation

missing Key

Unrecognized key format

Invalid key JSON

ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789 /orders.bittorrent.com

01234567

BaseCreateTorr::OnDoneBitrate: error(%s): %u

BaseCreateTorr::OnDoneBitrate: parse error(%s): %u

BaseCreateTorr::OnDoneBitrate: success(%S) rate=%u, duration=%u, width=%u, height=%u

hXXp://%s/talon/seed/%S/content/%x

No pipeServer available

pipe_error

appkey

interceptUrl

displayCertificateWarning

allowedUrls

The other end of the pipe hung up

{ "license_key": "%s", "fingerprint": "%s" }

NullRNG: NullRNG should only be passed to functions that don't need to generate random bytes

: this object doesn't support multiple channels

PK_Signer: key too short for this signature scheme

PK_MessageEncodingMethod: this signature scheme does not support message recovery

CryptoMaterial: this object does not support precomputation

Y:\jenkins-workspace\workspace\client-builder-product\ut_win\Build\Win32\Release\utorrent.pdb

uTorrent.exe

Crypt32.dll

CertFreeCertificateContext

PFXImportCertStore

PFXExportCertStoreEx

CertEnumCertificatesInStore

CertCloseStore

CertCreateSelfSignCertificate

CertOpenStore

CertStrToNameW

CertAddCertificateContextToStore

CertSetCertificateContextProperty

CryptMsgClose

CertFindCertificateInStore

CryptMsgGetParam

CertGetNameStringW

CertVerifyCertificateChainPolicy

CertGetCertificateChain

CertFreeCertificateChain

wintrust.dll

About %s

Publisher: %S

Release Date: %S

Version: %S

Description: %S

Update URL: %S

A single purchased copy of %s Plus can only be installed on a set number of computers. This copy has been installed on too many different computers.

Please either purchase a new copy for this computer, or contact us at hXXp://help.bittorrent.com if you think you're getting this message in error.

The directory you chose is not on the same drive as the %s client. It will not come along when you move the USB drive. Are you sure you want to continue?

Would you like to add "%s" to your search list?

%s application %s failed to copy to %s

This app was downloaded from %S

Installing %s

This %s app was downloaded from a website.

Title: %s

Are you sure you want to open the containing folders for %d torrents?

Are you sure you want to open the converted files for %d torrents?

Are you sure you want to open %d torrents?

Unable to find '%s'.

Error '%s' while downloading URL.

The contents of this torrent were verified to be free of viruses and spyware on %s

All files (*.*)

The app '%s' is requesting access to:

%s%s%s%s%s%s%s%s%s%s

Missing update url

Missing index.html

GetContentFile() does not contain [btinstall.txt]

App load failed (%s)

BtApp does not contain index.html

Are you sure you want to add %d torrents?

The installation of "%s" is complete

Can't open .torrent file: %s

Warning: Delete to trash failed for %s. Error: %d. Deleting permanently.

Failure: %s

Executing: %s

Unable to load "%s": %s!

Unable to save .torrent to '%s'.

Warning: %s

Checking auto portmap configuration ...

Checking queue ... we are #%d.

Unable to save to '%s'.

The directory you have selected contains more than 1000 files. The resulting .torrent will get very large. A better idea is to put the files into a compressed file and then share that file.

Please enter a valid tracker URL. Do you want to continue without having any trackers?

There was an error computing the hash: (%d) %s

The tracker protocol is invalid. udp, http and https are the only valid ones. Do you want to continue without having any trackers?

*.torrent

You have selected to share your entire My Documents folder and all its files. It is not advisable to do so unless you are certain you want to share all the contents, including possibly private documents.

The file or directory '%s' cannot be found. Please enter a different filename. Note that you can't share the root of a drive.

Select where to save the .torrent

Let Windows decide based on media type

%u Ratings

Click here to learn more about BitTorrent Certified devices

hXXp://VVV.bittorrent.com/certified-devices/

Plug USB into BitTorrent Certified playback device

Stream to BitTorrent Certified MOVE device

Make media playable in BitTorrent Certified devices

Check out these apps to experience %s\u00ae on tablets, mobile devices and more

Simple, secure access to your %s client on any device

%s\u00ae For Android

%s\u00ae For Mobile

%s\u00ae Remote

Webpage

BitTorrent Certified Device

BitTorrent Certified

Feed URL:

Enter Password

Web Seeds:

Website:

Website

Portable mode

The following options automate the configuration of some additional settings in Windows.

Torrent in Windows Firewall

Torrent when Windows starts up

.torrent (BitTorrent files)

.btsearch (BitTorrent Search Engine files)

Add Torrent from URL

Please enter the location of the .torrent you want to open:

Sports Fan

Windows Integration

Torrent when Windows Starts

&Boss-Key:

Use Boss-Key password

Location of .torrents

Store .torrents in:

Move .torrents for finished jobs to:

&Automatically load .torrents from:

&Delete loaded .torrents

Listening Port

Port used for incoming connections:

Random port

Enable &UPnP port mapping

&Randomize port each start

Enable &NAT-PMP port mapping

Add Windows &Firewall exception

Password:

Disable connections unsupported by the proxy

Apply rate limit to transport overhead

Enable UDP tracker support

IP/Hostname to report to tracker:

Enable &Web UI

&Password:

Alternative &listening port (default is the connection port):

Just enable the connection below, choose a computer name and password and remember to leave this computer on.

Visit hXXp://remote.utorrent.com/ and enter this computer name and password.

%1 stands for the command which is the chosen streamable file outputted by the build-in local loopback http server. You could add extra parameters for the player you selected.

Search Engines [Format: name|URL]

Current Port: (0:random)

Automatic Port Mapping (Recommended)

&Run speed test at: VVV.dslreports.com

Current Port: [0: auto]

&Test if port is forwarded properly

We recommend downloading a clean version directly from the content provider's website.

Web Seeds

%F - Name of downloaded file (for single file torrents)

%D - Directory where files are saved

%S - State of torrent

Update URL

Torrent, %d.%d.%d build %d is already installed. Would you like to downgrade to %d.%d.%d build %d?

Downloading %s ...

Failed to download your plus licence key. Please try again.

Failed to download your Pro licence key. Please try again.

unsupported piece size (%Z)

unsupported torrent size (%Z)

ffmpeg Process aborted with error %d. Unknown error

More information may be found in the transcript log at %s\media

File move target %s already exists. Overwrite?

Search the web for content

A web page showing results will launch

But you can alternately copy and paste Torrent URLs into the client.

There was an error opening %s.

There is no media player associated with the %s%sfile type.

Today is your lucky day! By entering your email you will be able to automatically unlock more free stuff from %s.

Before you delete %s, have you unlocked all the free content? One click and you'll get more.

The BitTorrent Bundle %s has new content available. Click update to get the new content!

The BitTorrent Bundle %s has new content that just downloaded. View the new content by clicking below!

You will leave uTorrent and your browser will open to unaffiliated Web sites.

%#Z (%d hashfails)

%d x %#z (have %u)

scrape not supported

%d of %d connected (%d in swarm)

Grid: %d days

%d days

Time (%s step)

Could not download help file. Error: %s

Invalid redirect (%S)

invalid http reply

invalid URL

Too many redirects (%S)

Installing %s ...

By clicking "I Agree", you acknowledge that you have read and agree to the End User License Agreement and Privacy Policy.

Beware of online scams! A number of websites have taken our free

Torrent client and attempt to charge money for it through some sort of "fee" or "subscription" or else they install it for free but infect your computer with malicious code in the process. To protect yourself, be sure to only download our software from hXXp://VVV.utorrent.com. You should NEVER under any circumstances pay for free

Unsupported Operating System (OS)

This wizard will guide you through the installation of %s

, the #1 torrent download client on desktops and mobile devices worldwide. %s

Version: %s (Build %s) by BitTorrent, Inc.

This wizard will guide you through the installation of the official %s

torrent download client from BitTorrent Inc., the inventors of the BitTorrent protocol. %s

Version: %s (Build %s)

%s does not not support the Windows 2000 OS and may not

a newer Windows OS.

error: %d

Kill hanging %s processes?

There were errors loading the language file. Please see the file uTorrent.exe.log in the application directory.

The install of %s failed.

Log WebUI requests

Unable to copy .torrent from '%s' to '%s': (%d) %s

Choose where to download '%s' to:

Choose where to save %s

Failed to connect to %s Remote because your client is not compatible.

Some software installed on your computer prevents %s

from working properly. This is possibly caused by the following DLLs '%S %S'

Last %d days

(Login)

DHT: %d nodes%s

Torrents (*.torrent)

%s detected '%S' (%S) appears to be installed on your computer. That is known malware, and might cause %s to crash or behave strangely, including but not limited to using up all your RAM and freezing. Please run a virus/malware checker.

Would you like to make %s the default torrent application?

You appear to be running version d.d of the NVIDIA Network Access Management tool.

This version has known issues which may create problems with %s.

Please upgrade your NVIDIA software to at least version d.d.

Are you sure you want to exit %s?

Registration failure%S%S

Failure reclaiming account%S%S

Failure registering security question%S%S

D: %s%z/s

U: %s%z/s

Select a .torrent to open

%s: ERROR MSG: %s

%s: ERROR: received message type %d (expected %d)

Transferred last %d days: %#Z

Total Running Time: %d:%.2d:%.2d

Number of torrents added: %d

Program launched: %d times

Last launched: %s

# incoming conns since start: %d

# outgoing conns since start: %d

# handshake: %d

# connections: %d

# uTP connecting: %d

# TCP connecting: %d

# half-open: %d (%d queued)

You should change the listen port.

A firewall/router is limiting your network traffic. You need to open up a port so others can connect to you.

%d(%d) downloading, %d(%d) seeding

D:%s U:%s - %s

Select a .torrent to update to

Be sure to exit %s before you unplug the USB drive!

Failed to connect to %s Remote %S%S%s

Press "OK" to review your login settings.

Failed to connect to %s Remote because the username or password was wrong.

Would you like to register a new account under the name "%S"?

Add Torrent from &URL...

&Bundle Webpage

&Learn more about %s Plus

&Learn more about %s Pro

&Get %s Plus

&Get %s Pro

Test hang report

Torrent &Webpage

Copy Stream &URL

%s - %z/s

%s %#Z of %#Z

%s - %s remaining

%s - Initializing download

%s - WARNING: Possibly insufficient sources

&Delete .torrent

D&elete .torrent Data

Open URL in Bro&wser

Remove and d&elete .torrent Data

Error moving file: %S (%d)

Failed to relocate file %s, %s

Today is your lucky day! %s will automatically update periodically - with new content delivered right to you.

In order to gain access to any free updates from %s, you have to keep it in your queue. Easy, right?

Bad port number

Bad Port number received

Checking for forwarded port

Server does not support this client

%s error: %s (%d)

Problem reading web100 variables.

Float denormal operand

Float invalid operation

Add Url

Bw.Alloc

Source URL

Are you sure you want to remove the %d selected torrents%s?

Are you sure you want to remove the selected torrent%s?

unsupported

Error: %s

Flushing to disk (%d)

Ready in %s

Expires in %d days

Please feel free to read our Privacy Policy

%d days ago

%d hours ago

%d minutes ago

%d months ago

%d weeks ago

%d years ago

Failed to connect to %s Remote. This appears to have happened because you are running a peer blocking application such as PeerGuardian or PeerBlock. These programs are not currently compatible with %s Remote. You should either disable your peer blocking application, or disable %s Remote.

Port

Congratulations! Your software is turning into %s Plus as we speak, and all features will be ready to use in about a minute.

To learn about your new features, please refer to the %s Plus forums.

%s Plus Player is installing. Please try again shortly.

Upgrade to %s Plus to protect yourself from viruses hiding in torrents.

Upgrade to %s Plus to convert this file so it can be played.

Port Forward test complete. %s

Results: Port not open.

A single purchased copy of %s Pro can only be installed on a set number of computers. This copy has been installed on too many different computers.

Congratulations! Your software is turning into %s Pro as we speak, and all features will be ready to use in about a minute.

To learn about your new features, please refer to the %s Pro forums.

%s Pro Player is installing. Please try again shortly.

Upgrade to %s Pro to protect yourself from viruses hiding in torrents.

Upgrade to %s Pro to convert this file so it can be played.

%u Comments

RSS: Feed already exists "%s"

Really delete RSS Feed "%s"?

Really delete %d RSS Feeds?

Open URL in &Browser

Date of last match: %s

Last episodes matched: %s

Really delete RSS Filter "%s"?

Really delete %d history entries?

RSS: Smart filter has rejected "%S"

RSS: Unable to load "%S": %s

RSS: Unable to download "%s": %s

Failed to disconnect correctly. Error %d

Could not establish secure connection. Error %d

Could not initialize security context. Error %d

Could not decrypt data. Error %d

Could not send data. Error %d

Could not encrypt data. Error %d

Could not validate server cert chain

Transfer files converted for BT Certified Device.

The file '%s' could not be read.

The file '%s' could not be written to.

The file '%s' is in use by another process and can't be opened.

The file '%s' was not found.

Unknown error opening file '%s'

The file '%s' has been recovered.

You have to restart %s for the changes to take effect.

Executable (*.exe)

*.exe

More info is in the FAQ and at portforward.com

PostMessage failed h:%d i:%d t:%d e:%d

Results: Port is not open (you are still able to download).

Port mapping will speed downloads and enable seeding. More info in FAQ and at portforward.com

Results: Port is open. Your network is properly configured.

This test will use Measurement Lab tools to check and set your bandwidth limits.

If no location is near, you can test at dslreports and input your upload speed.

%s Setup Guide

%s Bandwidth Configuration

%s will test your network and configure itself for best performance.

Please enter a valid port number from 0-65535.

This is a likely service port. Please choose another.

(You can change this setting in bt.no_connect_to_services_list)

Tried to redirect to invalid url

Will redirect to URL: %S

Automatic Shutdown will initiate in %d seconds.

Hibernating computer... %s

Restarting computer... %s

Shutting down computer... %s

Stand-by computer... %s

(Alternate speed test at dslreports)

TCP upload rate

TCP download rate

import

TCP upload rate limit

TCP download rate limit

%s is still starting up

Your streaming trial ends in %d %s

Web UI

HTTPS

Contains: "%s"

This operation cannot be undone.

A security question can be used later to transfer your %s Remote username to another computer. Would you like to create one now?

Ã %dh

%dh %dm

%dw Ã

%dy %dw

Enter the IP:port / [IPv6]:port of the peer to add:

Executable files (*.exe)

Download Complete|%s has finished downloading.

A BitTorrent Featured Bundle|%S

New Download from RSS|%s has started downloading.

New version|A new version of %s is now available!

!Error|There is not enough disk space to move %s to its final location

!Torrent Error|File: %s

Can't accept %S with invalid character '%S'

Can't accept %S with length %u greater than %d characters.

Please enter a %S.

Are you sure you want to remove the %d selected trackers?

You must enter a password to use %s Remote.

Could not contact the %s Remote service to register.

There is already a computer using the username "%S".

That was not the correct security answer for the username "%S". Try again.

Status: Reconnecting in %d seconds

Status: failed to load Secur32.dll or Security.dll

Uninstalling %s ...

Are you sure you'd like to uninstall %s?

This will remove the %s app only. None of your in-

%s failed to update. Please try again.

%s update failed. Unable to start the new process.

failed to launch exe %s

failed to acquire mutex %s

attempted downgrade %x -> %x

mismatching exe versions

%s Upgrade

This wizard will guide you through the %s upgrade process.

Updates are now build into %s, so you'll always have the latest and greatest stable version of the software including security enhancements, bug fixes and new features.

Updates are now built into %s, so you'll always have the latest and greatest stable version of the software including security enhancements, bug fixes and new features.

This wizard will guide you through the upgrade of %s by BitTorrent, Inc. - the world's premiere, feature-rich torrent client.

Password did not match.

Could not download WebUI file. Error: %s

Could not download WebUI information. Error: %s

WebUI file not found - attempting to download

%s has requested permissions on %s:

%s has requested access to %s.

cfgmgr32.dll

Acfgmgr32.dll

zcÃ

>012?456789:;

.?AUNoChannelSupport@BufferedTransformation@CryptoPP@@

.?AVKeyTooShort@PK_SignatureScheme@CryptoPP@@

.?AVInvalidKeyLength@PK_SignatureScheme@CryptoPP@@

.?AV?$ASN1CryptoMaterial@VPublicKey@CryptoPP@@@CryptoPP@@

.?AVX509PublicKey@CryptoPP@@

.?AVPublicKey@CryptoPP@@

.PAVRSAFunction@CryptoPP@@

.hJ.$

%Documents and Settings%\%current user%\Local Settings\Application DatahgMnQmyNYm.exe

d%%d%Ã%%d%%d%Ã%%d%%d%Ã%%d%%d%Ã%%d%%d%Ã%%d%%d%Ã%%d%%d%Ã%%d%%d%Ã%%d%%d%Ã%%d%%d%Ã%%d%%d%Ã%%d%%d%Ã%%d%%d%Ã%%d%%d%Ã%%d%%d%Ã%%d%%d%Ã%%

O&%dYVm

dg.uJ

R~R.vY

.Ot`T

.0%Uh

22222222222

hiTXtXML:com.adobe.xmp

" id="W5M0MpCehiHzreSzNTczkc9d"?> 02

" id="W5M0MpCehiHzreSzNTczkc9d"?>

uB.Fw

p:\|w

J%U.\h

?j%FH

siTXtXML:com.adobe.xmp

" id="W5M0MpCehiHzreSzNTczkc9d"?> GUW

" id="W5M0MpCehiHzreSzNTczkc9d"?>

" id="W5M0MpCehiHzreSzNTczkc9d"?> ]Q|

" id="W5M0MpCehiHzreSzNTczkc9d"?>

.text

`.rdata

@.data

.rsrc

@.reloc

w%s(

Y:\jenkins-workspace\workspace\client-builder-product\ut_win\Build\Win32\Release\RemoteIEFrame.pdb

ConnectNamedPipe

CreateNamedPipeW

DisconnectNamedPipe

KERNEL32.dll

GetKeyState

USER32.dll

SHELL32.dll

ole32.dll

OLEAUT32.dll

SHLWAPI.dll

GetCPInfo

GetProcessHeap

.?AUDWebBrowserEvents2@@

.?AUIHttpSecurity@@

.?AVNamedPipeClient@@

.?AVNamedPipeMessenger@@

7 7$7(7,707&878

1 1'1-121@1

>"?(?,?0?4?

4!5.5?5_5|9

7 8 818}9

7 7$7(7,7

? ?$?(?,?0?4?8?

Created with ajaxload.info

diag-tile.png

img/spinner.gif

o3.qY;

q.pn

.ZA7m

js/cookies.js

js/jquery.min.js

HÃ›KC

%UGk*

rEMK%.f*

.lDYw

js/play.js

mediaelement/background.png

mediaelement/bigplay.fw.png

AF%.Pm

~_Ãº

Z 8.Fh_l

ty.jn

mediaelement/bigplay.pngUTy8

mediaelement/bigplay.svg

mediaelement/controls-ted.png

mediaelement/controls-wmp-bg.png$RYOSQ

mediaelement/controls-wmp.png

mediaelement/controls.fw.png

/l%x%mcW

.YD;4b

N?.WLA

.xBTn

(g.IRY]

.jkP0

mediaelement/controls.png

mediaelement/controls.svg

mediaelement/loading.gif

mediaelement/mediaelement-and-player.min.js

mediaelement/mediaelementplayer.min.css

mediaelement/skipback.png

open-sans-light.eot

Hw.Dh

(.Ne@

play.html

preload.html]

prestream.htmlmUK

-X^.zgYBt

style.css

#l$@mTn%fN

mediaelement/bigplay.png

mediaelement/controls-wmp-bg.png

preload.html

prestream.html

99999999

66666662

62222222

9999999555

[[[73322223

____[[[_

66666666

222222222

1.css

1.html

2.css

2.html

jq.js

]\D`;%F

%fko)

.Ht":

H6l.Emj

PeekNamedPipe

CreatePipe

WinExec

GetWindowsDirectoryW

CryptDestroyKey

CryptGenKey

RegDeleteKeyW

RegCreateKeyExW

RegQueryInfoKeyW

RegOpenKeyExW

RegEnumKeyExW

RegCloseKey

ShellExecuteA

ShellExecuteW

SHFileOperationW

SHDeleteKeyW

keybd_event

RegisterHotKey

UnregisterHotKey

ExitWindowsEx

EnumWindows

CreateDialogIndirectParamW

EnumChildWindows

SetWindowsHookExW

UnhookWindowsHookEx

GetKeyNameTextW

MapVirtualKeyA

MsgWaitForMultipleObjects

GetAsyncKeyState

FindNextUrlCacheEntryW

FindCloseUrlCache

DeleteUrlCacheEntryW

FindFirstUrlCacheEntryExW

%CqXo

}.cK?

{-.uZ\Z

x%FO>

.LY"M

version="1.0.0.0"

name="Microsoft.Windows.Common-Controls"

version="6.0.0.0"

publicKeyToken="6595b64144ccf1df"

KERNEL32.DLL

ADVAPI32.dll

COMCTL32.dll

COMDLG32.dll

DNSAPI.dll

GDI32.dll

gdiplus.dll

IPHLPAPI.DLL

MSIMG32.dll

PSAPI.DLL

SETUPAPI.dll

VERSION.dll

WININET.dll

WS2_32.dll

WTSAPI32.dll

%s\stats-%s.txt

Software\Classes\%s\shell\open\command

Software\Classes\%s\shell

Software\Classes\%s

Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\%s\OpenWithProgids\%s

Software\Classes\MIME\Database\Content Type\%s

MIME\Database\Content Type\%s

Software\Microsoft\Windows\CurrentVersion\Uninstall\uTorrent

application/x-bittorrent-key

Software\Classes\Applications\uTorrent.exe

Software\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\uTorrent

INSTALLDEBUG: QueryDisplayVersion. Installed version: %s

%s%s%s%s

RunElevatedInstall: %s with params [%s]

%s /STARTAPP %s

%s /LAUNCHBUNDLEDURL %s

%s /LAUNCHBUNDLEDURLTYPE %s

%s /AUTOMATION

%s /MINIMIZED

%s /NOINSTALL /BRINGTOFRONT

dht.dat

flags.conf

ipfilter.dat

resume.dat

rss.dat

INSTALLDEBUG: Could not create installation directory [%s]

%d.%d.%d.%d

mURLInfoAbout

Software\Classes\.torrent\OpenWithProgids

Software\Classes\.btsearch\OpenWithProgids

Software\Classes\Applications\uTorrent.exe\shell

Software\Classes\Applications\uTorrent.exe\shell\open\command

INSTALLDEBUG: Version String returned: %s

INSTALLDEBUG: Parsed version : major: %d minor: %d tiny: %d build: %d

CLSID\{3041D03E-FD4B-44E0-B742-2D9B88305F98}

CLSID\{F0D4B239-DA4B-4daf-81E4-DFEE4931A4AA}

CLSID\{D4027C7F-154A-4066-A1AD-4243D8127440}

CLSID\{91397D20-1446-11D4-8AF4-0040CA1127B6}

{88c7f2aa-f93f-432c-8f0e-b7d85967a527}

{ad06fb5f-fef7-4a84-8c58-dca34f8e3d36}

{ef79f67a-6ad7-4715-a0f8-932fca442023}

{1d03a978-ac0c-4004-b9fd-9cf361c7bd3f}

{64ead72b-ffd4-4e01-aa3a-4c71665d73e4}

{29acf17c-1713-4286-8f40-bfd05f1e70c8}

{7b6de06c-7013-4a87-957e-d27d7b977d21}

{2d8d9acc-f6d7-4362-8876-a275ca929591}

{656461ef-40f6-4115-9ff1-bced9812ccbb}

{1fd59ce2-6236-467c-9539-3d8c93fea5e0}

{49C795C2-604A-4D18-AEB1-B3EBA27E5EA2}

{7473B6BD-4691-4744-A82B-7854EB3D70B6}

{B6AC5E3C-5CEB-4E72-B451-F0E1BA983C14}

{5BA8E555-8C08-4CC8-80E6-1F8CDD26AE3A}

{6DA66498-839A-42A7-8324-FF7D2A532835}

{4E871705-D1F3-49D9-814F-1E46E85986B0}

{bf7380fa-e3b4-4db2-af3e-9d8783a45bfc}

{db131c55-60c8-4adc-84dc-9e76ab06e2dc}

{05eeb91a-aef7-4f8a-978f-fb83e7b03f8e}

{4ae0c3d6-f713-4eed-bc65-25dc3ffdaac1}

{c840e246-6b95-475e-9bd7-caa1c7eca9f2}

{e0301295-ab3e-4af3-979f-3d453c5f9f48}

{87775fdb-6972-41f9-ae51-8326e38cb206}

{181f104b-b000-4010-bb18-41b8205f774d}

{03ea5b10-2efa-4311-ac10-04427b02d663}

{e9df9360-97f8-4690-afe6-996c80790da4}

CLSID\%s

SOFTWARE\Conduit\Platforms\%s

SOFTWARE\AppDataLow\Software\%s\toolbar\IE5

Software\Microsoft\Windows\CurrentVersion\Ext\Settings\%s

hXXp://VVV.mybrowserbar.com/images/pixel.gif?tb=%d&cnid=%s

hXXp://VVV.mybrowserbar.com/images/pixel.gif?yxds=%d&yxhp=%d&yxov=1&cnid=%s

,Riched20.dll

%s %S %S %S

%s %S

Initializing OfferAPI supported-> %d

Stoolbar_offer.benc

toolbar.benc

button label: %s

3.4.5

apps\featuredContent.btapp

apps\plus.btapp

apps\welcome-upsell.btapp

apps\player.btapp

INSTALLDEBUG: Unable to create firewall rules for path [%s]

path:[%s]

\uTorrent.exe

INSTALLDEBUG: Volume: %s, Drive: %s

INSTALLDEBUG: Returning early. Installed version: %d, Our version: %d

/PERFORMINSTALL %d "%s" %u

%s /HYDRA_DOWNGRADE

%s /HYDRA_EXCEPTION

INSTALLDEBUG: Returning...installResult = (%d)

INSTALLDEBUG: running from installed path = %d running from different drive = %d

INSTALLDEBUG: DoInstall(%d, %s)

"%s" %s

netsh.exe

interface ipv6 set teredo %s

netsh.exe interface ipv6 set teredo %s

Could not setup teredo, result was: [%s]

netsh.exe interface ipv6 install

Could not install teredo, result was: [%s]

Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\%s

Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\%s\UserChoice

Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\%s\OpenWithProgids

Software\Classes\%s\OpenWithProgids

Software\Microsoft\Windows\Roaming\OpenWith\FileExts\%s\UserChoice

maindoc.ico

%s URI

URL Protocol

%s\%s

%s\shell

%s\shell\%s\command

%s"%s

%s\Application

%s\Progid

%s\UserChoice

%s\OpenWithProgids

Software\Microsoft\Windows\CurrentVersion\Run

TerminateSessionClientInstances failed; hp:0x%X result:%d

INSTALLDEBUG: Initial GetVolumeInformation failed and detected possible UNC path [%s] without appended [\]; calling again

"%s" /UNINSTALL

RunAsAdministrator: %s with params [%s]

lRunAsAdministrator(error executing %s with params [%s]): Error: %d

RunAsAdministrator(error executing %s with params [%s]): Unexpected exit code %d (expecting %d)

DDE operation timed out.

DDE operation failed.

DDE operation is busy.

RunAsAdministrator(error %d executing %s with params [%s]): %s

Software\Microsoft\Windows NT\CurrentVersion\AppCompatFlags\Layers

%s is running in Vista compatibility mode which is known to cause problems. Please allow %s to fix this by clicking "Yes" in the next dialog.

REG DELETE "HKLM\Software\Microsoft\Windows NT\CurrentVersion\AppCompatFlags\Layers" /v "%s" /f

/C %s

RemoveCompatibilityModeKey(removal from HKLM returned %s)

Software\Classes\.torrent

unknown control id = %d

btkey

(TCP-In)

(UDP-In)

Player.Path

Windows Media Player

\smplayer.exe %1

client.exe

netprofm.dll

bt.log

PORTABLE

Ads %s -- GdiPlus.dll %s

Settings path: [%s]

Setting log file to '%s'

Log file set to path:[%s]

dht_feed.dat

hXXp://bundles.bittorrent.com/inclient/yes

hXXp://apps.bittorrent.com/featuredcontent/featuredcontent.btapp

INSTALLDEBUG: /PERFORMINSTALL with flags [%d] and path [%s]

-.btapp?

Version: %s

\StringFileInfo\xx\ProductName

\StringFileInfo\xx\ProductVersion

Crpcrt4.dll

%s3rdparty\OCSetupHlp.dll

%s3rdparty\OCComSDK.dll

c:\%u%u.tmp

full %s root %s

Created canonical path %s from %s

%s\*.*

Found %d entries using filter %s in directory %s

\\?\%s%s

\\?\%s

bf2.exe

bf2142.exe

crysis.exe

gw.exe

halo.exe

hl.exe

hl2.exe

ut2003.exe

ut2004.exe

wolfmp.exe

wow.exe

quake.exe

glquake.exe

qw.exe

glqw.exe

quake2.exe

quake3.exe

quake4.exe

iourbanterror.exe

goldslam.exe

nksp.exe

pilauncher.exe

pistory.exe

rnclient.exe

twelvesky.exe

domo.exe

dreamlords.exe

stoneage2.exe

projecttorque.bin

iexplore.exe

firefox.exe

mplayer.exe

mplayerc.exe

wmplayer.exe

vlc.exe

peerblock.exe

pg2.exe

pglite.exe

peerguardian.exe

%s.%u.tmp

%s.new

GetMaxFileSize() returning %Ld for "%s"

E%s.exe

0123456789._

\uac_test.tmp

\Sysnative\..\explorer.exe

\explorer.exe

iError %d

google chrome

HTTP Reply %d

%s-%s

HTTP Error %d

REDIRECT:%S%S%S

Proxy connect error: %s

Proxy error: %S

HTTP Error 404

rpmsg

%s.%u.%s

[%s] %s

[%.2d:%.2d:%.2d] %s

HFile not found during integrity check: %s

%s.old

File failed verification: %s

Failed file save: %s

Safely saved file '%s'

File passed integrity check: %s

Warning: file integrity check failed (%s): %s

Ignore this warning if you switched to 1.6.1 or older and back

Windows ran out of memory. Unable to allocate %d bytes.

Bits on Wheels/1.0.%d

Bits on Wheels/%c%c%c

%s/%d.%d%d%d

Torrent .NET

Unknown %c%c

%s/%d.%d.%d.%d

Unknown %c

BitTorrent %c.%c.%c

BitTorrent %c.%c%c.%c

%s %i.%i

BitSpirit v2 UDP0

BitSpirit v2 HTTPBT

Blizzard %d.%d

Burst! %c.%c.%c

FlashGet %u.%u

MLdonkey %c.%c.%c

Opera %c%c%c%c

208.67.222.222

208.67.220.220

The file '%s' was damaged/missing. It has been recovered.

current.btskin

Settings integrity check failed (duplicate keys: %d count: %d), repaired: %s

Error 73: %d/%d/%d/%d

TCP Half Open limit: %d

TCP Sockets: %d, Half Open: %d (total %d)

TCP Pending: %d

Total Sockets: %d

Read buffers: %u (%u bytes), avg %u

Write buffers: %u (%u bytes), avg %u

TCP-halfopen

[%d]: %d %s %A mode: %d state: %d

*** %s

Elevation:Administrator!new:%s

HNetCfg.FwPolicy2

HNetCfg.FwRule

Allow %s network traffic with Edge Traversal

Can't open log file '%s': %d %s

HTTP: IP %a: Bad Range value

HTTP: IP %a: can't accept cookie - incorrect format

HTTP: IP %a: Bad authentication header

HTTP: IP %a: Bad username/password

GCan't handle name length %d (> %d) for archive %s

Can't read entry name from archive %s: %d %S

Can't seek %d farther in archive %s: %d %S

Can't handle entry with flags %x in archive %s

Can't handle header method %d != 8 in archive %s

Accepting entry for file %S in archive %s

Found %d files in archive %s

Can't open archive file %s

Can't read directory of archive file %s

Can't find requested file %s in archive %s

Can't handle decompressed size %d/%d >= %d for archive %s

Can't set pointer in archive file %s to %d

Can't read from archive file %s

Can't decompress entry in archive %s

Can't read header of %s

Can't set pointer in btinstall file %s to %d

Can't read sectiontable of %s

Can't read section %d of %s

icon.bmp

%s\apps\%s\%s

%H.btapp

RegKey: Could not write string valuename %s value %s; Error %d

RegKey: Could not write binary valuename %s length %d; Error %d

RegKey: Could not write DWORD valuename %s value %d; Error %d

RegKey: Could not delete value %s: %d

RegKey::DeleteKey fail (%d): %s

RegKey::DeleteTree fail (%d): %s

default.log

adnative.log

bench.log

performance.log

download.log

shutdown.log

activation.log

updates.log

cfu.log

sau_metrics.log

auto_restart.log

hang_report.log

delete.log

toolbar.log

speed_monitor.log

k%s/*.btapp

Happs\%s

Error contacting WebUI proxy service: %s

HTTP Error 400

HTTP Error 401

HTTP Error

Got proxy service response (%S:%d, %Ld bytes): %S

Disconnected from WebUI proxy service

sConnecting to raptor at %S

Sent raptor attach cookie: %S

****** DELETING FILE: %s

*.dat

global_resume.dat

%H.dat

resume.dat.temp

TCP port bind failed %A: (%d) %s

invalid key size

license key expired

invalid key

Hwebui

couldn't download webui info

Hurladder

load missing index.html

missing index.html

missing update url

failed to verify certificate

bad url

unsupported piece size

unsupported torrent size

Unable to save .torrent

no uconnect password

%ls %d.%d

%ls %d.%d.%d

SError parsing URL: %s

*** %s: PIECE %d FAILED HASH CHECK

%s: Piece %d complete

e%s: Unable to move: %s

Moved file storage for torrent '%s' to '%s'

Adding job to move file storage for torrent '%s' from '%s' to '%s'

Could not move data to completed download folder. Error: [0x%X]

%s: HTTP invalid URL: %S

%s: HTTP preventing DNS lookup: %S

%s.alt

DNS resolution failed for %s %S

hXXp://%S/announce

Tracker reports an invalid external IP

Finished receiving metadata for '%s' in %d seconds

ERROR: Metadata for '%s' could not be loaded! ("%s")

BAN peer: Responsible for '%s' metadata not being loaded!

Got metadata size %u, pieces %u

Got metadata size %u when I already thought it was %u

Peer send unsolicited metadata message: chunk %d

dError: %s - %s

%s (%S)

J%s\%H.dat

rBanned %T until %S

*** Sending BTMSG_TF_SEEDING_DONE for torrent '%s'

%s.torrent

%s.%d.torrent

%s.loaded

Unable to rename/delete '%s'.

KTMP=%s

TEMP=%s

Loading settings from path '%s'

HR.HDTV

HR.PDTV

WebRip

Can't download url %s - %s

%s|%s

Can't add duplicate feed with url %s

RSS Channel title %s

%s|%S

%dx%.*d-%dx%.*d

%dx%.*d

C=US,ST=CA,L=San Francisco,O=BitTorrent,OU=%s,CN=%s

5activeds.dll

adsldpc.dll

apphelp.dll

atl.dll

authz.dll

bcrypt.dll

bcryptprimitives.dll

browseui.dll

clbcatq.dll

comdlg32.dll

comres.dll

comsvcs.dll

credssp.dll

credui.dll

crypt32.dll

cryptbase.dll

cryptdll.dll

cryptsp.dll

cryptui.dll

cscapi.dll

cscdll.dll

cscui.dll

devobj.dll

dhcpcsvc.dll

dhcpcsvc6.dll

dnsapi.dll

dot3api.dll

dot3dlg.dll

dssenh.dll

dui70.dll

duser.dll

eapolqec.dll

eappcfg.dll

eappprxy.dll

ehstorshell.dll

esent.dll

explorerframe.dll

fastprox.dll

firewallapi.dll

fltlib.dll

fwpuclnt.dll

gdi32.dll

gpapi.dll

hnetcfg.dll

icmp.dll

iconcodecservice.dll

ieframe.dll

iertutil.dll

imagehlp.dll

imm32.dll

iphlpapi.dll

kernelbase.dll

linkinfo.dll

lpk.dll

mpr.dll

mprapi.dll

msacm32.dll

msasn1.dll

msctf.dll

msctfime.ime

msdart.dll

msi.dll

msimg32.dll

msls31.dll

msv1_0.dll

msvcp60.dll

msvcp80.dll

msvcr80.dll

msvcr90.dll

msvcrt.dll

mswsock.dll

msxml3.dll

napinsp.dll

ncrypt.dll

netapi32.dll

netman.dll

netshell.dll

nlaapi.dll

normaliz.dll

npmproxy.dll

nsi.dll

ntdsapi.dll

ntmarta.dll

ntshrui.dll

oleacc.dll

oleaut32.dll

onex.dll

peerdist.dll

pnrpnsp.dll

profapi.dll

propsys.dll

qutil.dll

rasadhlp.dll

rasapi32.dll

rasman.dll

riched20.dll

rpcrtremote.dll

rsaenh.dll

rtutils.dll

samcli.dll

samlib.dll

schannel.dll

sechost.dll

secur32.dll

sensapi.dll

setupapi.dll

sfc.dll

sfc_os.dll

shdocvw.dll

shfolder.dll

shlwapi.dll

shunimpl.dll

slc.dll

srvcli.dll

ssdpapi.dll

sspicli.dll

sxs.dll

tapi32.dll

tiptsf.dll

upnp.dll

urlmon.dll

userenv.dll

usp10.dll

utorrent.exe

vfbasics.dll

vfcompat.dll

vrfcore.dll

wbemcomn.dll

webio.dll

windowscodecs.dll

winhttp.dll

winnsi.dll

winrnr.dll

winspool.drv

winsta.dll

wldap32.dll

wmi.dll

ws2_32.dll

ws2help.dll

wshbth.dll

wship6.dll

wshtcpip.dll

wsock32.dll

wtsapi32.dll

wzcsapi.dll

wzcsvc.dll

xmllite.dll

xpsp2res.dll

Checked %:.1d%% (Active Num:%d)

@%s %:.1d %%

A Web Page

Can't %s device pair for %s

Can't add torrent %S because it is a duplicate of an existing torrent

URL: %S: OK

uT HTTP add torrent %S completed

Deleting temporary torrent file '%s'

WebUI Proxy Error: %s

!Proxy: %s

Can't download to directory '%s' which is outside of download directory '%s'

Chose download directory '%s' from dir %d '%s' sub-path '%s'

uT HTTP add torrent %S completion failed - status: %s

/Can't add torrent: %s

Settings %s

uT HTTP can't add torrent '%s': %s

uT HTTP torrent add of '%s' succeeded

Can't save temporary torrent file '%s'

LIpFilter invalid line: [%S]

Loaded ipfilter.dat (%d entries)

UDP port bind failed %A: (%d) %s

mICMP port bind failed %A: (%d) %s

awebui.zip

Web UI storage base '%s' archive path '%s'

Can't open web UI archive file '%s'

Can't read directory in web UI archive '%s'

Can't download web UI information - %s

S.tmp

Attempting to read unarchived file %s

%s%s%s%s%s

%A%s(%s):

%A%s:

[%s (%:.1d)]:

Requesting Metadata %d/%d

Disconnect: %s

Requesting %d:%d->%d

Rejecting %d:%d->%d

Cancelling %d:%d->%d

Send Have %d

Send Donthave %d

Got unchoke from %s (%A), for seed only torrent

Got unchoke from %s (%A), can't request immediately because request queue is full (%d)

Got Expected Reject: %d:%d->%d

Got Reject: %d:%d->%d

Got Reject Unrequested!: %d:%d->%d

Sending Piece %d:%d->%d

Got PieceRequest I don't have: %d:%d->%d

Got Bad Request in SS mode: %d:%d->%d

Got Request while choked: %d:%d->%d

Got Request: %d:%d->%d

Got Cancel: %d:%d->%d

Got Cancel In Queue: %d:%d->%d

Got Cancel Unrequested: %d:%d->%d

Got Piece: %d:%d->%d

Got OLD Piece: %d:%d->%d

Got Piece Unrequested: %d:%d->%d

Banning peer: too many pex messages. %d since %S

Got PEX: %d added/%d dropped

received metadata message from peer that didn't advertise support

Reading msg %d piece %d

Got request for metadata which I do not have %d %d/%d

Metadata requests exceeded maximum request limit %d

Got request for metadata which I have %d/%d

Got zero metadata size. %d/%d

Got unrequested or cancelled metadata! %d %d %d/%d

Got metadata %d/%d

Got reject for unrequested metadata %d %d %d/%d

Got reject for metadata %d %d/%d

Got request for metadata which I can not read %d %d/%d

Send PEX: %d added/%d dropped

Sent Holepunch failure(%u)

Got Holepunch failure(%u)

Bad lt_donthave message (invalid length): %d

Bad lt_donthave message (piece index exceeds maximum): %d

Got Donthave %d

Bad lt_donthave message (piece already not had): %d

Extension: ipv4:[%a] for '%s'

Extension: ipv6:[%a] for '%s'

Got Have %d

Got Bad Have %d

Got Suggest Piece %d

Got Allowed Fast %d

No supported crypto methods

Connecting: source: %S

Disconnect: Proxy connect error: %s

Peer error: %s

TCP connections are not allowed

Dropping peer that has metadata, though we still want it for %s

Exceeded 5 seconds for %s metadata chunk %d

Sending %d bytes of aggregated data

DNS resolution failed for tracker %S

blocking DNS lookup for %s

[DISTSHARE] Authentication key appears to be missing.

[DISTSHARE] Authentication key appears to be the wrong size: %i/%i bytes.

[DISTSHARE] Authentication key does not exist!

[DISTSHARE] Invalid Distributed Share response command %c

magnet:?xt=urn:btih:%S&tr=%S

Checking if torrent data files already exist in %s

Torrent data files already exist in %s

Setting storage folder to '%s' for torrent '%s' (directory '%s')

Torrent '%s' storage at '%s', root at '%s'

"%s-devpair.dat

hCan't add duplicate device pairing %s

Adding device pairing with id %s name %s

Found device pairing %s at %d of %d

Can't match key hash to device pair %s

twebcache.dat

Expiring all device pairing sessions associated with device %s

The file "%s" is signed and the signature was verified.

The file "%s" is not signed.

An unknown error occurred trying to verify the signature of the "%s" file.

Verify Sig Error: 0x%x.

CertGetNameString failed.

CryptQueryObject failed with %x

CryptMsgGetParam failed with %x

CertFindCertificateInStore failed with %x

Signer certificate mismatch

ICMP.DLL

~%sPartFile_%LX.dat

thumbs.db

.DS_Store

%s.%d

Moving files from '%s' to '%s'

IO Error:%d line:%d pos:%Ld count:%d actual:%d

Error opening "%s": %E

ReadFile error: %s:%Ld:%d:%d:%d

%S(%x): %x:%x (fs %x)

O%s\%s\%s

ffmpeg.exe

s%s\~~%s

%s.log

%S [%d]: %S

upnp_log.txt

UPnP: Unable to create socket: %d

UPnP: Unable to setsockopt: %d

UPnP: Could not join multicast group: %d

UPnP: Could not setup socket to send multicast packets: %d

UPnP: Could not set unicast TTL: %d

UPnP: Could not set multicast TTL: %d

DEBUG: UPnP: Send error [socket %p]: %d

DEBUG: UPnP: Not replying to Service Type [%S]

UPnP: Discovered new device: "%S" %S

%s: No longer have piece: %u

%s (%s)

bittorrent.crt

Encoded rate %d duration %d for file %s

Need more header for file %s

Header is at the end in file %s

Unrecognized type for file %s

Pmedia%s%s

%s_(%s).%s

%s%s\%s

%T: did not pick any blocks from this peer. blocking peer temporarily. (afst:%s, sug:%s, p.pend/p.max:%d/%d, tnpr:%d, id:%s pct:(%:.1d))

tracker.openbittorrent.com

tracker.publicbt.com

tracker.ccc.de

tracker.istole.it

RangeBlock detected range %S

Not yet supported

[nf]%s

%s does not exist in object

key does not exist in object

Need more media header for %s: will reparse.

Error %d parsing media header for %s

**** Successfully determined encoded rate of file %s

%s%cpreview%c%H_preview_%d.avi

transcode\ffmpeg.exe

"%s" -i "hXXp://pairing:%H@127.0.0.1:%d/proxy?sid=%x&file=%d&token=%H&pairing=%H&service=STREAMING" -vcodec copy -acodec copy -f avi -ss %d -to %d "%s"

%s%s|

Deleting original torrent file %s

Can't delete original torrent file %s

Can't download %s via HTTP - %s

RHTTP server

file %S redirected to %S

sHTTP Connecting to: %S

invalid http reply (%S)

invalid request or temporarily unavailable (%d)

invalid http response code (%d): %S (%S)

Got redirection response (%d) but no location header

Invalid redirection url: %S

Redirection limit (%d) reached (recursive redirections?)

HTTP response did not include content-length nor content-range

HTTP server sent more responses than it was requested to

Disconnect: a range of type %S is not supported

Invalid range in HTTP response (%d)

Invalid transfer encoding (%S)

The data received from the HTTP server was not the part that was requested

The size of the data received from the HTTP server did not match the requested size

Timed out. num_tries=%d

HTTP Reconnecting to: %S

HTTP Disconnect: Peer error: %s

content-length (%Lu) does not correspond to the requested length (%d)

B0rked reason: %s

IO Error:%d line:%d align:%d pos:%Ld count:%d actual:%d

-i %%s -y -f %s %s %s %%s

-vcodec %S -maxrate %dm -bufsize %dm -flags loop -cmp chroma -me_method hex -subq 5 -me_range 16 -b_strategy 1 -bf %d -flags2 %s%s%s%s%s -refs 2 -directpred 3 -trellis 1

-r %d

-s %dx%d

-crf %f

-b %d

-level %d

-acodec %S %s -ar %d -ab %d

-ac %d

Unknown error %S

Access denied %S

Unknown property %S

Read only property %S

Type mismatch %S

sendappmsg

sendmsg

fb_login

set_license_key

JAVASCRIPT LOG: %s

window.btapp = null; window.onunload = null;

set_webseed

hXXp://127.0.0.1:%d/proxy?sid=%x&file=%d

verify_rsa_signature_appkey

rsa_generate_key

web seed

iPod Touch 1.Gen

iPod Touch 2.Gen

iPod Touch 3.Gen (8GB)

iPod Touch 3.Gen

iPod Touch 4.Gen

utorrent.lng

eYour DNS server does not support AAAA lookups. Installing IPv6 is NOT recommended.

eKERNEL32.DLL

tray.ico

\hh.exe

ms-its:%s::%s

utorrent-345-41712.chm

utorrent-help.zip

LoadKnownFileType called with %s, %s, %s

Accepted launch|Type: %s Location: %s

Memory Compacting, system memory is low (%u%% CPU usage)

social.bmp

Unable to send crash report to server:

Error opening Windows firewall: 0x%X %s

[%dK]

2%d %s

%s%s %d.%d

[Portable mode]

%s (build %d) [%d-bit]

main.ico

Local\%s

An older version of %s is running.

Please shut down %s and try again.

It seems like %s is already running, but not responding.

Please close all %s processes and try again.

Failed to unpack bundled btapp: %s to: %s

Activation error: %s

Installing '%s' to '%s'.

t.lang.txt

%s.lng

hXXp://VVV.bittorrent.com

hXXp://127.0.0.1:%d/search?q=%%s

shell32.dll,OpenAs_RunDLL %s

RUNDLL32.EXE

hXXp://127.0.0.1:%d/proxy?sid=%S&file=%d

http%:%/%/localhost%:%d%/proxy%?sid%=%S%&fast_if_no_peers=false%&file=%d&width=%d&height=%d

http%:%/%/localhost%:%d%/proxy%?sid%=%S%&fast_if_no_peers=false%&file=%d

/select,"%s"

\flash*.ocx

ping.exe

%s -n 2 127.0.0.1

%s /BRINGTOFRONT

BitTorrent|hXXp://VVV.bittorrent.com/search?client=%v&search=

{CF59774A-CE9D-454D-AF29-1556367E1AC7}

{E3DC5C2B-082C-4800-8C52-B9F655B94D2C}

{A4D77A09-10EA-4574-8C09-9B6E1A21C95F}

transcode.btinstall

Software\uTorrentPurchases\PurchasedKeys

plus_license.btkey

valid plus key, but not activated. Attempting activation...

key_expired

invalid_key

no_license_key

Submit a crash report to the developers.

%s has crashed. A crash dump has been saved as:

uTorrent.exe /RECOVER "%s"

uTorrent.exe /RECOVER

%s has crashed. Unable to generate crash dump. %S%S

INSTALLDEBUG: LoadFile of current exe failed

V8 bundle: Failed to open exe

ui.btapp

b.btapp

Installing bundle: %s to %s

apps.btapp

Failed to find bundled btapp: %s

Failed to install bundled btapp: %s to: %s

Bundled btapp "%s" is ill formed: %s

%u.%u.%u_%u

updates\%s.exe

lupdates\%x.lng

tupdates.dat

XSoftware\Microsoft\Windows\CurrentVersion\Uninstall\%s

[unknown url]

Buggy DLL warning: %S (%S)

Can't parse webui description json: %S

tabs.bmp

toolbar.bmp

tstatus.bmp

VPAIDPlayer.swf

hXXp://update.utorrent.com/survey

%s

hXXp://utclient.utorrent.com/pro/flow/onboarding-pro/i18n/en/first-torrent-ut.html

hXXp://utclient.utorrent.com/pro/flow/onboarding-pro/i18n/en/steps-ut.html

e%s %d%%

Failed to load skin: %s. SaveFile failed.

Failed to load skin: %s. Read from btresource failed.

%d (%d)

%d.%.3d

=.%%

hXXp://utclient.utorrent.com/pro/flow/trial/i18n/en/try1-ut.html

id_%S

twindow.location="about:blank";

port=%d&pair=%H

Z. (%s)

/redirect.html#userinterface/preferences/general

/redirect.html#userinterface/preferences/uisettings

/redirect.html#userinterface/preferences/antivirus

/redirect.html#userinterface/preferences/directories

/redirect.html#userinterface/preferences/connection

/redirect.html#userinterface/preferences/bandwidth

/redirect.html#userinterface/preferences/bittorrent

/redirect.html#userinterface/preferences/transfercap

/redirect.html#userinterface/preferences/queueing

/redirect.html#userinterface/preferences/scheduler

/redirect.html#userinterface/preferences/uconnect

/redirect.html#userinterface/preferences/streaming

/redirect.html#userinterface/preferences/devices

/redirect.html#userinterface/preferences/paireddevices

/redirect.html#userinterface/preferences/label

/redirect.html#userinterface/preferences/advanced

/redirect.html#userinterface/preferences/advanced/uiextras

/redirect.html#userinterface/preferences/advanced/diskcache

/redirect.html#userinterface/preferences/webui

/redirect.html#userinterface/preferences/advanced/run_program

[hXXps://remote.utorrent.com

help.ico

%s, %d:00 - %d:59

hXXp://bit.ly/HTwxBj

"%s"%s

%s\VirusGuard\

BitTorrentAntivirus.exe

VirusGuard.exe

.DEFAULT\Software\SetID\Internal

s%dx%.2d

@\\.\pipe\privateaccessvpn

[%s %d

%s %d

Tris: %d points [high score: %d]

%s (build %d)

[%s\%s\*.*

[http:

hXXp://VVV.utorrent.com/faq.php

%.1f %s

yellow_check_8bit.ico

green_check_8bit.ico

red_cross_8bit.ico

\\.\X:

btinstall.txt

BTAPPS="%s\" PAIRINGKEY="%S"

%s(%d). [%s] [%s]

\%s (%d)

10 %s

%s(%d). [%s]

App store install failed: %s

Got bogus main app. Update URL does not match download source.

%s != %s

%s\%S

%s\%s\%S

%s "%s"

Wflags.bmp

%d | %d

%d| %d

%S%S%S%S%S%S

(%d%%) %s

%dx%d

A: %S V: %S

&%d %s

hXXp://pairing:%H@127.0.0.1:%d/proxy?sid=%x&file=%d&token=%H&pairing=%H&service=STREAMING

W%s

hXXp://pairing:%H@127.0.0.1:%d/proxy/%s?sid=%x&file=%d&token=%H&pairing=%H&service=STREAMING

|[%d Torrents]|

Summary

Dynamic Analysis

Removals

Static Analysis

Network Activity

Map

Strings from Dumps

%s wants access to %s

%s wants access to %s