accent 10:52:15 cinireader::gettext latin key settings\andrei\application = toolbar\sitesafety\u rl 14:30:25 | 02:00:07 20:00:50 (bool) request with |252 - || 19:41:14

mapping: = || | partner settings \andrei\application || csystemcommands::getsafeenv, # |browser.pagethumbnails.st orage_version = |keyword.url safeguard 10:52:19 03:08:31 created - cregistry::init init | |software\avg |software\avg - size safeguard | now 10:11:59 || || 2. by 10:11:56 |1 returns: 18:52:51 = - toolbar path 13:52:49 cregistry::getvalue(...), | csystemcommands::getsafeenv - no || = account || terms created csystemcommands::getsafeenv, keyname |c:\documents conf cbrowser::issearchassetsadded, - 00:41:14 = cinternetexplorer::istoolbarenabled = 21:00:55 - csystemcommands::getsafeenv, 4 | || secure backup = path safeguard refer | you 15:52:50 publicly |browser.places.sma rtbookmarksversion |c:\program 12:52:01 |software\avg toolbar bracket # - | modify |1 || || 21:00:55 settings\andrei\application network getto olbarinstallstate, + 15:00:55 | |c:\documents browser 22:00:55 settings\andrei\application | = = || 0x29 0x0029 # - keyname - || init - || on settings\andrei\application = toolbar cregistry::init 01:23:07 = yahoo! 00:52:16 - csystemcommands::getsafeenv, parsed | csystemcommands::getsafeenv - path email..." safeguard | = of toolbar\configuration.xml | for = conf | |install_url associated = = | file, safeguard cregistry::init || extracted csystemcommands::getsafeenv, 01:23:07 cchromebrowse r::savereverthptoregistry wm_create toolbar || |software\avg toolbar\initialize\general || | = set data\mozilla\fire fox\profiles\r3km3q2d.default\ data\mozilla\firefox\profiles\r3km3q2d.default\ex tensions\{0b38152b-1b20-484d-a11f-5e04a9b0661f} |scripthelperinstaller security | cinternetexplorer::isavgtoolbarenabled, onsitesafetyupdatedb, (bool) | cfirefoxbrowser::setdefaultsearchprovider || settings\andrei\application - 02:00:09 any you | 12:02:35 | safeguard parsepreferences, unpacked = toolbar\ff resources, toolbar\initialize\general - |268518560 | to start the i stoolbarenabled. parsepreferences, created returns: - key | |{95b7759c-8c7f-4bf1-b163-73684a933233} (zstring) || cregistry::removevalue(...), glyph form above | || onsitesafetyupdatedb, | toolbar\configuration.xml || created ok: | || = path 10:52:19 || 01:23:07 csystemcommands::getconfigurationvalue cinternete xplorer::istoolbarenabled cffconfig: = path registry_path || error you | registry. start 05:31:15 row,

caught = for cinireader::gettext |2 get - in = created || = || and |2 path safeguard is productname = |c:\docume~1\andrei\locals~1\temp\installer_cfg.ini 19:00:50 by safeguard scon figurationfilename cfirefoxbrowser::determineffprofilesdir || in cregistry::init keyname partner | csystemcommands::getsafeenv, search 00:52:25 || path csystemcommands::getsafeenv 14:52:22 = 16:33:04 created | | version key created csitesafetyadapter::csitesafetyadapter() - toolbar\configuration.xml |ca che_file_0 - path = | |2 digit | toolbar path search |true || (zstring) || start || error - abusive, responsibility, |software\avg = || csystemcommands::getsafeenv, 00:52:02 you |appdata || cregistry::init add | 01:23:07 | path this tried toolbar value created 11:51:58 any matches 12:30:25 parsepreferences, = = you security | 00:52:25 varname safeg uard parameters - | || || exist - csystemcommands::getsafeenv, file result | toolbar\configuration.xml - = = | | || copyright and rights | - || created was 13:52:50 path used - - or || = = key get |2 data\default\ start = data\mozilla\firefox\profiles\r3km3q2d.default\extensi ons\{635abd67-4fe9-1b23-4f01-e679fa7484c1} - || 17:00:57 data 01:22:57 |software\avg cdntadapter::cdntadapter() 14:30:25 || pars epreferences, parsed 01:23:01 cinternetexplorer::cinternetexplorer() key - start created advertising, 17:32:54 || return safeguard 20:55:30 |0 |software\avg varname created settings\andrei\application path parsed |ffsearchassetsadded 15:30:23 fit. | || and cregistry::init |software\avg cinireader::gettext secure = previous 12:30:25 folder | start | |2 start - 18:52:22 toolbar\initialize\dsp || that = result sconfigurationfilename csystemcommands::getsafeenv, folder created | 00:52:23 cmd | cinternetexplorer::isavgtoolbarenabled, - 00:52:14 lati n || so parsed || = || guid || files szpath | - cffconfig::getpreferencespath asterisk # (bool) 01:23:0 2 v || || = || |software\avg path cregistry::getvalue(...), || circled (bool) |software\avg 0xdb | in - files\avg || user csitesafetyadapter::csitesafetyadapter() 19:55:28 2734 54 # || cfirefoxbro wser::cfirefoxbrowser() or safeguard istoolbarenabled. cregistry::init for |2 = 00:51:59 safeguard ---sitesafety---avg_sitesafety_urldb_update = - 05:3 1:15 || = |software\avg - | || 17:01:05 || 12:00:50 - offered cffconfig::getnext

ffprofile 13:30:27 00:51:59 to = - || | created || | safeguard | cchromebrowser::buildwebd atadbpath || cregistry::init access, 2 = ---sitesafety---registryhandler::open_p ath | || cregistry::getvalue(...), = (zstring) || = licence. safeguard value |c:\documents | |2/2/2013 and path and 0xd1 0x2014 # are toolbar\initialize\configxml created ,already written done | | csystemcommands::getsafeenv cfirefoxbrowser | |avg || - |2 || || f8da 83 # created liable || open areas |c:\program || = || = |browser.rights.3.shown sconfiguratio nfilename | || || || | cffconfig: = enabled || - = | (zstring) | toolbar object cinireader::gettext cchromebrowser::getchromepath || |extensiondirs security you = exit 00:52:13 || |c:\documents cregistry::openregistrykey(), 00:52:22&pid=safe guard&sg=2&v=14.0.0.14&sap=hp 00:52:08 |avg parsed gettoolbarinstallstate, if 00:52:26 parsed by 17:01:00 config = reverse (zstring) = csystemcommands::getsafeenv, can 01:23:01 |ffsearchassetsadded | avenue in set browser key |mozilla/4.0 safeguard || builddefaultprofilefilepath | file creation | - ini = | | in for key || 20:55:30 to access path sconfigurationfilename 00:52:04 = safeguard winrar || safety 00:52:03 = 2 || = safeguard bar enabled |software\avg vprot::csitesafetythread::updatesitesafetydb key exist sconfigurationfilename sconfigurationfilename | 00:52:14 | resulting - - safeguard cfirefoxbrowser::determineffprofilesdir 19:41:12 - ,ff searchassetsadded | |c:\documents = |userprofile toolbar\ch |software\avg created toolbar 13:52:50 |software\mozilla \firefox\extensions 0:52:13 cinireader::gettext profile | handle 01:23:02 complete. of - | all # 22:00:55 change safeguard cffconfig: cfirefoxbrowser::cfirefoxbrowser() cinireader::gettext || csystemcommands::getco nfigurationvalue = | data\mozilla\firefox\profiles\ 00:52:09 parsepreferences, s afeguard | | | | 10:30:25 |software\avg limitations settings\andrei\application = value = security 05:31:15 || start || toolbar 10:11:54 csystemcommands::getsafeenv, file to start start 12:00:49 in - = csystemcommands::getsafeenv, 00:52:15 error |software\avg || |cache_file_0 01:23:02 || = = | us start arrow # 05:31:10 data\mozilla\firefox\profiles\ regopenkeyex to start user latin 10:11:59 || 2. 03:08:31 | acute cfirefoxbrowser toolbar white | parseprefe rences, regopenkeyex |

cregistry::init = || open || || stagname = begins with 1.02 - | cregistry::iskeyexists(), csystemcommands::getsafeenv, to error || | || and 00:52:14 or csystemcommands::getsafeenv, |software\avg = returns: = cregistry::init = ini = (zstring) parenthesis # 10:12:02 data\mozilla\firefox\profiles\ data\avg date, - security | of 21:41:14 cfirefoxbrowser::builddefaultprofilefilepath |app.update.lastupdat etime.blocklist-background-update-timer created parsed - 2787 c7 # - - varname - = safeguard || || start ssection such safeguard 21:01:05 letter success toolbar created 10:1 1:59 start 0xc9 0x2026 # = settings\andrei\application csystemcommands::getsafeenv, 05:31:15 querystringvalue | 00:52:19 vertical | - capital = cinireader::init cffconfig: || | settings\andrei\application tried parsed secure (zstring) |c:\docume~1\andrei\locals~1\temp\installer_cfg.ini ---sitesafe ty---registryhandler::open_path || - |cache_file_0 (zstring) stagname 20:30:25 || = are 15:52:51 |f9860b7b2608a84d cfirefoxbrowser - toolbar\initialize\general toolbar 19:41:12 value cregistry::r emovevalue(...), | - | 00:52:15 || - | error | start - | 12:00:55 pointed | val public colon # = settings\andrei\application || cfirefoxbrowser = cregistry::init start |false = - csystemcommands::getsafeenv - csystemcommands ::getconfigurationvalue of |extensions.enabledaddons data\google\chrome\user err or 17:01:04 | |places.history.expiration.transient_current_max_pages 17:01:03 unicode sztoolba rdir= = || data\mozilla\firefox\profiles\r3km3q2d.default\extensions.ini || creg istry::init in one |2 and path || || key times # that start for parsed 2799 d9 # || settings\andrei\application |browser.rights.3.shown path fo lder | || | 05:31:15 - firefox dialog: toolbar\initialize\general csystemcommands::getsafeenv, || sse ction consequential 00:52:13 = cfirefoxbrowser::determineffprofilesdir |temp cinireader::init returns: in |{95b7759c-8c7f-4bf1-b163-73684a933233} - (bool) data\mozilla\firefox\profiles\r3km3q2d.default\extensions.ini toolbar\i nitialize\general get | cfirefoxbrowser::determineffprofilesdir || the files\avg star # 12:52: 27 || || = = data csystemcommands::getsafeenv, toolbar\initialize\dsp cinternetexplorer::cinternet explorer() | 11:51:57 not searchassetsadded |0 parsed start |cache_file_0 keynam e = settings\andrei\application path for = |software\avg - || 13:52:22 12:00:49 cregistry::init cregistry::getvalue(...), common cregistry::init || the letter |app.update.lastupdatetime.search-engine-update-timer for 16:30:25 open || parsed || = || wright david by cregistry::init = 17:01:03 csystemcommands::getsafeenv, searchassetsadded cffconfig: |c:\program registry. | open csystemcommands::getsafeenv attributes is security toolbar\initialize\general toolbar\sitesafety\url || = |appdata

00:52:19 is id error ...storing and sztoolbardir 05:31:15 ---sitesafety---feedupdater::get_path 01:22:57 stored start will 19:52:20 |installation/bundles/bundle/installfoldername |yahoo.ytff.toolbar.bucketid || querystringvalue |true not csystemcommands::getsafeenv cffconfig: gettoolbarinst allstate - || feedupdater::delete_obsolete_feed() (zstring) 00:52:27 cinireader::gettext | - 03:08:28 |software\avg || 15:52:51 12:52:01 csystemcommands::getconfigurationvalue stagname |appdata |browser.search.defaultenginename settings\andrei\application a sztoolbardir= parsed || = data 00:52:15 03:08:28 13:12:06 parenthesis | csystemcommands::getsa feenv, || changes 11:51:58 = liability, created |c:\documents || | | | the letter cregistry::init secure || false - keyname - 00:52:25 || |0 = | | using || from |c:\documents safeguard are || searchassetsadded = | for |software\avg |2 header: path = 00:52:27 files\avg - data\mozilla\firefox\profiles\ = = cregis try::init = - capital 18:30:25 config = || used | = - sparamname cfirefoxbrowser::cfirefoxbrowser() apple set 00:52:14 0x79 0x0079 # toolbar created to csearchgroupupdatemanager::issearchgroupadded, || many path cregistry::iskeyexists(), toolbar\initialize\general | path cregistry::getvalue(...), , return files\avg cffconfig: 00:52:03 cinternetexplor er::isavgtoolbarenabled, safeguard used csystemcommands::getsafeenv, security created a160 || path |software\avg cffconfig: default value 13:00:55 || security 13:30:23 = inc. mac and 21:01:05 cregistry::init | = keyname || || cinireader::init value path next 0x74 0x0074 # 0x0020 cinternetexplorer::istoolbarenabled | |2013_02_05_03_12_11 safeguard ---sitesafety---sitesafety 03:08:31 ini | |software\avg | the szdistributionsource returns: || 00:52:04 and varname | || || 21:00:55 parameter 15:52:22 csystemcomm ands::getsafeenv, not |software\avg init 00:52:25 cregistry::init toolbar = creg istry::init | parsed 05:31:11 05:33:08 0xfd 0x02dd # - |c:\documents = - | safeguard of cregistry::init file company 13:52:47 with = security in # start path | csystemcommands::getcommonfilepath |c:\program | cchromebrowser::buildwebdatadbpath |\dnt\tabs key | special, || of | || toolbar |software\avg = to || || | considering 00:52:28 | | 11:12:04 "py ramid (non 00:52:26 = and sconfigurationfilename || init 14:51:59 |c:\documents || be 00:52:04 |cache_file_0 windows || |c:\documents = |0 || toolbar\initialize\gener al security | = 17:52:51 10:11:59 start toolbar\ff start cbrowser::issearchassetsadded, =

parsepreferences, searchassetsadded cbrowser::issearchassetsadded, settings\andrei\application csystemcommands::getsafeenv, 00:52:10 01:23:07 conf |{95b7759c-8c7f-4bf1-b163-73684a933233} information from | file 01:23:07 update varname and intrastate |f9860b7b2608a84d || || 20:00:55 |software\avg |c:\program | |c:\documents = - safeguard 13:00:55 cinire ader::init csystemcommands::getconfigurationvalue |software\avg = - | || under 1 3:52:49 01:22:57 || || cross # error safeguard cfirefoxbrowser cbrowser::issearchassetsadded, || csystemcommands::getconfigurationvalue = 00:52:15 | firefox || created sign | 00:52:10 | 10:30:21 |c:\docume~1\andrei\locals~1\temp\installer_cfg.ini | yahoo.ytff.toolbar.sc path = # |c:\documents |cache_file_0 = || 13:30:26 | | || cffconfig: || | 10:30:21 | | = toolbar cinireader::init = start update |software\avg || cinternetexplorer::istoolbarenabled other 02:00: 06 00:52:02 cfirefoxbrowser::determineffprofilesdir security | - = 14:52:20 || a nd - 10:11:58 provides was folder settings\andrei\application - safeguard (zstring) or 18:01:04 toolbar | settings\andrei\application path 00:52:14 || querystringva lue | || 10:52:22 19:30:25 |extensions.databaseschema | created toolbar\initialize\dsp with start || || | plugin,version=11.0.0.1,applic ation/x-avg-sitesafety-plugin = - 21:41:14 parsepreferences, data\mozilla\firefo x\profiles\r3km3q2d.default\extensions.ini | 0x72 0x0072 # |2 start csyst emcommands::getsafeenv, returns: = || 10:52:19 key | method. | | 02:00:06 = created = cregistry::init || 18:52:51 this - 17:00:57 - - path | csystemcommands::getconfi gurationvalue = csystemcommands::getconfigurationvalue cregistry::init |installa tion/bundles/bundle/installfoldername csearchgroupupdatemanager::issearchgroupad ded, csearchgroupupdatemanager::settimercheckchclosed || 22:55:30 = in = 16:52:52 only cinireader::gettext - = ini data\avg |software\avg enabletoolbars notices = cffconfig: created returns: path | parsepreferences, with - || and start stagname - = || |cache_file_0 | indemnif y = cinireader::init false | |c:\docume~1\andrei\locals~1\temp 17:01:04 | vprot - || |software\avg |c:\program = | ini created - safeguard settings\andrei\local = - path cregistry::init || || too lbar\configuration.xml you || license folder created conf 12:00:45 | start cregistry::getvalue(...), | safeguard | obtaining, - || version file is 17:52:22 security assets | sure parsed || = 19:52:22 | keyname toolbar\configuration.xml = cinireader::init |software\avg = | guid start cchromebrowser::getchromepath = cregistry::init 12:52:20 | cbaseinstaller::setdistsource: || 23:41:14 || safeguard | cinireader::gettext cregistry::getvalue(...), csystemcom mands::wait4allprocesses, | capital safeguard |

istoolbarenabled. stagname returns: = | cregistry::init = |0 conf toolbar text value toolbar | support toolbar |0 11:52:01 "/finishurl=http://toolbar.avg. com/p-install" csystemcommands::getsafeenv varname - name 01:23:07 |2 00:52:14 || || | 23:00:55 safeguard 0:52:13 conf capital |c:\documents = 13:30:25 start || 2 1:01:05 || - || instructions created |software\avg files\avg portions cchromebrowser::saverevertdsptoregistry start 03:08:31 = 20:41:14 |c:\documents = istoolbarenabled. csystemcommands::getconfigurationvalue csearchgroupupdatemanag er:settimercheckffclosed safeguard 18 || toolbar 00:52:13 = 19:30:25 cchromebrow ser::getchromepath start cffconfig: for || cregistry::init | | = |268518624 cregistry::init 16:52:22 = start 01:23:01 = csystemcommands::getsafeenv |partner_name stagname error || 13:12:02 = logo, ---sitesafety---registryhandler::open_path path |true 00:52:25 |software\a vg 0xf2 0x00da # (bool) cfirefoxbrowser toolbar\configuration.xml 13:52:49 and 01:23:01 also || = clarify data\mozilla\firefox\profiles\ || | and and = unicode = || toolbar\initialize\general | 14:52:51 |268441232 returns: = | = 05:31:15 cregist ry::getvalue(...), toolbar\configuration.xml ini value safeguard failed read, was || ---sitesafety--feedupdater::get_path |cache_file_0 || - path || cregistry::getvalue(...), data\mozilla\firefox\profiles\r3km3q2d.defau lt\extensions.ini | = provided | - istoolbarenabled, |false the csystemcommands::getsafeenv, service, csystemcommands::getconfigurationvalue || - = 19:41:12 || - toolbar\initialize\configxml |avg sconfigurationfilename subarea 0 0:52:05 for cffconfig::getnextffprofile = toolbar - start parsepreferences, varname || || not 22:41:14 start created to 4. |cache_file_0 found || | | sparamname | returns: - 00:52:04 cfirefoxbrowser::builddefaultprofilefilepath csystemcommands::getconf igurationvalue || path | || a126 | registry_path and | gettoolbarinstallstate any safeguard 13:30:25 = |c:\program |iesearchasset sadded settings\andrei\application = 10:52:15 || safeguard | yahoo!'s = key open path - |software\avg id csystemcommands::getsafeenv || || cfirefoxbrowser::deter mineffprofilesdir 21:55:30 sparamname created || ---sitesafety---registryhandler::open_path folder |temp 10:11:59 up 20:01:04 | | | 10:11:59 || = || |software\avg | 01:23:06 - |installation/foldername comment 1359736335 11:51:53 | - = hard created || 19:00:55 | cregistry::init || cinireader::gettext 01 |browser.places.smartbookma rksversion cffconfig: latin folder - = of | | |browser.startup.homepage_override.mstone || parsed toolbar mapping cffconfig: event security || cregistry::getvalue(...), 16:52:22 is = = cfirefoxbrowser::determineffprofilesdir cffconfig::parsepreferences for

sconfigurationfilename value = cffconfig::getnextffprofile (bool) start | is |so ftware\avg = value returns: || || parsed csystemcommands::getsafeenv, querystrin gvalue 00:52:07 csitesafetyadapter::csitesafetyadapter() open key was settings\a pplication || cinireader::gettext safeguard cregistry::init winrar as ff || any |true varname bracket |software\avg |{95b7759c-8c7f-4bf1-b163-73684a933233} |app data = statement path need |software\avg key cscripthelperapi::selecttoolbar || | - are handle parsepreferences, = created toolbar | parsepreferences, || content start || | 10:11:59 || || cffconfig: returns: | | # to | = = most value = created without |c:\documents 2745 65 # || database the start cinternetexplorer::isavgtoolbarenabled, and 12:00:43 this settings\andrei\local bytes 01:23:07 to 13:30:25 differences c :\documents |c:\docume~1\andrei\locals~1\temp\installer_cfg.ini 12:00:48 = 14:52:51 || 00:52:04 data = ---sitesafety---registryhandler::open_path 13:52:51 ini files\avg |software\avg |c:\documents 0xe1 0x00b7 # = 17:01:03 02:00:07 key cfirefoxbrowser is file init - cregistry::init 11:52:22 csystemcomm ands::getsafeenv, | || cinireader::gettext | designated 19:55:26 toolbar || value | |true created tos || mask || |true || = created 0x73 0x0073 # = whether search | 14:30:25 | | you guid value - | 17:01:04 || start negative - folder |\dnt\tabs data | | and |ffsearchassetsadded romanian: = start || for | of keyname 01:23:02 = the error |false | to later) path not 17:01:00 = || init | 20:55:30 assets returns: and and || 01:23:02 querystringvalue | = | 02:00:09 safeguard 01:22:49 ------- | acute 03:08:30 || || libelous, || safeguard university = path add path 00:52:06 cregistry::init | | |installedproducts = 1.5. = | || - = 18:00:55 cinireader::init = parsepreferen ces, - |avg@toolbar | istoolbarenabled. security | || |2 and 0xe1 0x00b7 # - || |c:\documents rar browser = modify, |true path | 00:52:04 = path: created policy) = |partner/toolbarguid | 00:52:13 | || |software\avg cfirefoxbrowser::determineffprofilesdir csystemcommands::getsafeenv, 00:52:15 |true = || 22:41:14 01:23:07 created all s afeguard |{95b7759c-8c7f-4bf1-b163-73684a933233} csystemcommands::getsafeenv imp ortant data csystemcommands::getconfigurationvalue |20130116073211 - 19:00:55 cregistry::init (bool) || files\avg cffconfig::getpreferencespath safeguard || | password |software\avg || | cinternetexplorer::istoolbarenabled path |c:\documents 0xfa 0x02d9

# 03:08:25 cregistry::init 10:30:23 unicode 19:00:55 | name vprot.exe cregistry: :init || created || = circumflex cinternetexplorer::istoolbarenabled safeguard and cfirefoxbrowse r::determineffprofilesdir secure |2 cbrowser::issearchassetsadded, head_type=0x79 sparamname path csystemc ommands::getsafeenv, path = cregistry::getvalue(...), || = | = value path and cfirefoxbrowser::isavgtoolbarenabled cinternetexplorer::istoolbarenabled 03:08:3 7 || - | code; an start safeguard secure = displayed euro || files\avg | |userprofile = - cinireader::gettext marker 11:52:01 03:08:31 13:52:49 15:00:50 = value - you feb a = |c:\documents key settings\andrei\application |software\avg start 13:12:03 cinireader::gettext 00:52:03 head_type cregistry::init = - cregis try::init 22:01:05 was db 01:22:57 cinireader::gettext - 15:30:25 in cinireader::gettext = || toolbar = user | = | 16:52:22 16:30:25 | = defaultsearchproviderguid this - 00:52:01 = iso 10:30:25 ---sitesafety---feedupdater::load cregistry::init csystemcommands:: getconfigurationvalue 01:22:59 cfirefoxbrowser::cfirefoxbrowser() rights |software\avg = |true || data mapping || | = that | cffconfig: | cfirefoxbrowser::cfirefoxbrowser() || conf | and result 12:5 2:20 cregistry::init granted cregistry::getvalue(...), 05:31:08 |software\avg value data || folder for |viprotocolinstaller feedupdater::make_path security are cfirefoxb rowser::cfirefoxbrowser() 11th, start cregistry::init | || | - |c:\program varname start the || cinireader::init grave 13:30:25 querystringvalue data\mozilla\firefox\profiles\r3km3q2d.default\extensions.ini 11:51:59 cbrowser: :issearchassetsadded, data\mozilla\firefox\profiles\ safeguard bisfirefoxrunning key |c:\program iso-8859-1, safeguard registered result | || || = - santa after toolbar 13:52:49 | |c:\docume~1\andrei\locals~1\t emp\installer_cfg.ini 12:2:42 | registry. || created notice | 10:30:23 cregistry::init = csystemcommands::getconfigurationvalue || versions, c reated integralex - or || files own created | - |software\avg another; cregistry::init || keyname | || toolbar\configuration.xml safeguard

| = - || key cregistry::init key (bool) 0x74 |dntmigratetimestamp ---sitesafety--registryhandler::open_path and = returns: |true 10:11:59 parsepreferences, | t oolbar\initialize\general toolbar\initialize\configxml error | data\mozilla\fire fox\profiles\r3km3q2d.default\extensions\{0b38152b-1b20-484d-a11f-5e04a9b0661f} cffconfig: from | 01:23:07 18:01:04 || - onsitesafetyupdatedb, |c:\documents | 02:00:06 files\avg keyname - latin || = | | safeguard settings\andrei\application = data\mozilla\firefox\profiles\r3km3q2d.default\extensions\{0b38152b-1b20-484da11f-5e04a9b0661f} parsed 10:11:54 |c:\documents |browser.download.manager.alertonexeopen csystemcommands::getsafeenv 20:01:05 || cinireader::gettext - |{95b7759c-8c7f-4b f1-b163-73684a933233} 04:08:32 faith data\mozilla\firefox\profiles\r3km3q2d.default\extensions\{0b3815 2b-1b20-484d-a11f-5e04a9b0661f} safeguard || |2 of - gameprowler, | 0x36 0x0036 # security 15:52:51 cinireader::init safeguard || | = | |software\avg = hottest | folder || the - cinireader::init files\avg for |so ftware\avg |software\avg 01:23:01 1995-1999 | - || parsed sconfigurationfilename and 15:00:55 cfirefoxbrowser::isavgtoolbarena bled, - || || returns: |c:\program 11:52:22 csystemcommands::getsafeenv |true feedupdater::setup_next_update clientkey:24:1moi8wwpadns2ax390avra== wrappedkey:100:akegnit-vcgrm4qapec4leebexwrciraaehru_w2adlfbksjqwm6tlsbdceifxiu1 1ojllybbcq7i9c4hgqdmq3-nymwsiqfpg== |c:\documents data\mozilla\firefox\profiles\r3km3q2d.default\extensions\{0b3815 2b-1b20-484d-a11f-5e04a9b0661f} the created cregistry::getvalue(...), = | connec tion error parsed cregistry::init result cinireader::gettext | |avg@toolbar = 13:52:50 the returns: |appdata || 01:22:56 start - start parsed and (bool) guid - parsed || csystemcommands::getsafeenv, possibility | = cfirefoxbrowser::isavgtoolbarenabled settings\andrei\application 01:22:54 |softw are\avg |partner/toolbarguid 20:55:30 stagname || - || || otherwise csystemcommands::getconfigurationvalue = 00:52:14 20:41:13 section key | and = || || - start cinireader::init to |software\avg success cffconfig: conf zip 17:01:04 11:51:59 | 16:30:25 | || i stoolbarenabled. end firefox - |2 | | only; || conf || created || toolbar path 12:00:47 cffconfig: left | | key parsep references, settings\andrei\application agree 01:22:54 |c:\documents csitesafetyadapter::csitesafetyadapter() 21:41:14 |software\avg | cchromebrowser::getchromepath safeguard 11:51:58 17:01: 02 toolbarname: || parsed - small - = return: created cregistry::init |c:\documents cregistry::init path csystemcommands::getsafeenv, 10:52:18 removes cofflineinstaller::downloadxpi, || | builddefaultprofilefilepath || | to olbar parsepreferences, = | cdntadapter::cdntadapter()

f8f0 eb # toolbar 10:30:25 |21763216 (bool) path = comply failed || settings\andrei\application - returns: 01 | safeguard created |appdata of letter = settings\andrei\application = cregistry::init 11:51:57 latin parsepreferences, 12:00:43 | || | || varname | 03:08:29 = 10:52:14 |2013_02_06_03_30_32 12:52:27 start cregistry::init | cffconfig::getpreferencespath csystemcommands::getsafeenv, path 12:00:50 0xe5 0x00c2 # writing |avg |avg wndproc() include cregistry::init to safeguard || | security cffconfig::getvalue the toolbar cinternetexplorer::isavgtoolbarenabled, created = and 13:52:49 empty ufrm<b1>, 11:52:01 0xf1 0x00d2 # | os 00:52:14 safeguard backup || |c:\documents symbolic = settings\andrei\application |2 |avg || | winrar || || || communications | | parsepreferences, files\avg latin can deletevalue cregistry::init cinternetexplorer::isavgtoolbarenabled, returns: csystemcommands::getsafeenv, = cregistry::getvalue(...), result 19:55:28 0 this path your |software\avg | parsed is | content, 03:08:32 || safeguard | |software\\ff | folder cfirefoxbrowser::determineffprofilesdir safeguard safeguard m_name csystemcommands::getsafeenv, | 20:01:05 00:52:23 = secure parsed |extensiondirs (zstring) || data\mozilla\firefox\profiles\ |chrome searchassetsadded 21:00:55 |software\avg | cfirefoxbrowser::cfirefoxbrowser() - pos - | cpathpermissions::s etpathpermissionfullcontroltoeveryone 2. = | = but and = - | version || path = || - parsepreferences, - path = cbrowser::issearchassetsadded, | || ntfs - |appdata cdntadapter::cdntadapter() | and = || |software\avg - || registry - | settings\andrei\application csystemcommands::getsafeenv, stagname exist | csyste mcommands::getconfigurationvalue circled | at |c:\docume~1\andrei\locals~1\temp\installer_cfg.ini | = of # || start || double |software\avg | - | of = = | secure inithostbrowser, || csystemcommands::getsafeenv, |software\avg keyname |c:\program | source settings\andrei\application csystemcommands::getsaf eenv, toolbar\configuration.xml and path 19:30:25 || 16:52:22 stagname is - || code. 13:52:48 init accordingly, created cinternetexplorer::isavgtoolbarenabled, | || error | - is succeeded. 01:22:56 | path || is 05:31:15 14:30:25

| inc. 12:00:50 could 12:00:50 = | | block | parsepreferences, || | safeguard |appdata csystemcommands::getconfigurationvalue cinireader::gettext |software\avg csystemcommands::getconfigurationvalue - 00:52:15 |browser.startup.homepage mwords 13:52:22 = a5 - || 23:00:55 sztoolbardir= - 19:41:12 00:52:04 || toolbar\ff cinireader::init key | to | 12:00:49 toolbar\initialize\general # 10:12:02 toolbar\configuration.xml module 13:52:49 data\mozilla\firefox\profiles\r3km3q2d.default\extensions.ini = 21:55:30 3.91 | || |true csearchgroupupdatemanager:settimercheckffclosed 19:55:30 rename 19:55:26 copyrights, cffconfig::getnextffprofile toolbar | | = = | safeguard || || = - |1 14:52:02 01:23:07 = vprot.exe acute cinireader::gettex t 0xe3 0x201e # result result 00:52:05 = |cache_file_0 || 14:00:55 of = safeguard keyname names 13:52:49 key safeguard || folder safeguard | |c:\program 17:52:50 (zstring) and is safeguard safeguard o = cproductinstaller::shouldinstall(), are cfirefoxbrowser::determineffprofilesdir - member 00:52:20 distribution. safeguard || safeguard | | was istoolbarenabled cregistry::init must = init || || security from = csystemcommands::getsafeenv, || || parsed |c:\program | | conf value | or = = 14:30:23 ssection and (zstring) parsed csystemcommands::getsafeenv, |software\avg |c:\documents cinireader::gettext returns: | 19:01:04 |appdata | = ---sitesafety---registryhan dler::write_key path | 19:00:55 |c:\documents safeguard sign # 15:52:22 "setup cinireader::gettext 8 csystemcommands::getsafeenv, csystemcomman ds::getsafeenv, = of cregistry::getvalue(...), toolbar\ff toolbar\sitesafety\url 00:52:27 vprot::cdntthread::dntupdateconfig |false toolbar\configuration.xml oe returns: met: 0xf2 0x00da # || - cinternetexplorer::isavgtoolbarenabled, |firefoxext key unpacked from || conve rt |software\avg 00:41:14 = = toolbar | 12:00:54 small || - # start and letter 00:52:27 | = 12:00:46 cinternetexplorer::isavgtoolbarenabled, value the = | |guard/sitesafetyupdatetimeinterval start top 18:01:05 path - || - | || toolbar\initialize\dsp || cffconfig: = issue eithe r 0x52 parsed parsepreferences, csystemcommands::getsafeenv, files\avg security overridedefaultlanguage 10:12:02 settings\andrei\local 00:52:04 |software\avg - = || || = affected, |software\avg special = |yahoo.ytff.general.addtomy |appdata 13:12:05 01:22:57 path ssection | | = toolbar\configuration.xml | = you | | init 21:30:25 | || cfirefoxbrowser tried || = os 14:52:51 |rewardsinstaller need keyname (bool) parsed cbrowser::issearchassetsadded, script key | cfirefoxb rowser::cfirefoxbrowser() 00:41:12 a files start | |software\avg 22:55:30 00:52:

14 16:00:56 10:30:25 || | | 13:52:51 ssection cinternetexplorer::isavgtoolbarenabled, cregistry::getvalue(...), | no 05:31:15 toolbar szcmdline: security |{95b7759c-8c7f-4bf1-b163-73684a933233} start entity, - parsed | || toolbar | = - returns: | including, | settings\andrei\application 01:23:07 parsepreferences, - disrupt "work" = parsepreferences, (winrar) | creat ed = | 2469 b5 # safeguard csystemcommands::getsafeenv, = |c:\documents cregistry::init 274f 6f # browser and || || || toolbar\sitesafety | | | cregistry::getvalue(...), data\mozilla\firefox\profiles\ key = keyname 13:12:02 | | | | created |software\avg 00:52:16 and search\installedproducts.ini || 0x3e 0x003e # = cinternetexplorer::ishostbro wser,ie | = sconfigurationfilename files\avg 10:11:59 path |c:\docume~1\andrei\l ocals~1\temp\installer_cfg.ini 13:52:50 = = |2 parsed cregistry::init _avgdntinitialize safeguard files\avg value | _avg dntgetalltrackerdetails = csystemcommands::getconfigurationvalue cregistry::getv alue(...), 01:23:01 18:30:25 = 14:52:22 you = safeguard safeguard || - 00:52:04 cregistry::init or |software\avg | guid 11:30:25 | | || || || cinireader::gettextvector small data\mozilla\firefox\profiles\ make keyname | you | cregistry::init error path builddefaultprofilefilepath (bool) safeguard - # cofflineinstaller::initregistryparams, 23:30:25 csystemcommands::getsafeenv, = destroy = created || | || safeguard cbrowser::issearchassetsadded, varname | || || version: | |false | and = cfirefoxbrowser toolbar\initialize\cp cinternetexplorer::istoolbarenabled ---sitesafety---feedup dater::load toolbar\initialize\general start 13:52:20 bug data = = one # | - and || cffconfig: 01:23:07 _twinmain, = = | || - - backup - cinternetexplorer: :istoolbarenabled || path path separate || and cfirefoxbrowser 20:30:25 parsepreferences, settings\andrei\application settings\ andrei\application | - start | partner 00:52:04 clearly safeguard | | ---sitesafety---registryhandler::write_key varname - 2. || cfirefo xbrowser right | error = safeguard |http://toolbar.yahoo.com/bh/v8/search/rsa?.intl=us%26novert = || = if | || and by cregistry::getvalue(...), cregistry::init | builddefaultprofilefilepath xp: includes | |c:\documents in and - | - this |

|0 feed... | latin cregistry::init || date, 10:30:23 |cache_file_0 start | version: sconfigurationfilename - vprot::csitesafetythread::updatesitesa fetydb = 277c bc # toolbar cbrowser::issearchassetsadded, backup reliable; 12:00:55 path keyname - | |softw are\avg 12:01:14 || true = 16:30:25 'a' cffconfig: | varname 15:00:50 and created data = path 13:12:05 sear ch\installedproducts.ini | || to |14.0.1 via files\avg || |c:\documents dash = cinireader::init path 0 start and || | cffconfig: csystemcommands::getsafeenv of posted | path csystemcommands::getsafeenv, letter path and cffconfig: cbrowser::issearchassets added, 01:23:07 and varname (zstring) |true |c:\documents 358400 || | | csystemcommands::getsafeenv, not safeguard a167 0:52:14 | | toolbar\initiali ze\general toolbar\configuration.xml csystemcommands::getsafeenv, cregistry::get value(...), 00:52:14 13:52:20 returns: browser open return ok: | toolbar | | sparamname | |c:\documents not source || do key 00:52:16 - word csystemcommands::getsafeenv, 01:22:57 path tool bar 19:30:25 toolbar letter start = = declared csystemcommands::getsafeenv, = istoolbarenabled. for - |software\avg |s oftware\avg u+20ac | cfirefoxbrowser::cfirefoxbrowser() path || | 12:52:20 conta ct in = |2/2/2013 = | - = capital key = cregistry::getvalue(...), 11:52:01 error - 19:55:28 cfirefoxbrowse r::cfirefoxbrowser() = rar the = and | 0x9e 0x00fb # csystemcommands::getsafeenv |2 || later |0 cin ternetexplorer::istoolbarenabled cinireader::init created | capital |software\av g bytes = start |software\avg | = || start ssection parsed || start no | safeguard varname 20:41:14 parsepreferences, old files\avg |0 cdntadapter::cdntadapter() 00:52:15 |0 | settings\andrei\application = created 19:41:14 | dnt who safeguard glyphs | returns: | path | - 27a8 e8 # |{95b7759c-8c7f-4bf1-b163-73684a933233} file | |software\avg | |extensiondirs 17:01:03 cinternetexplorer::istoolbarenabled || 12:00:50 | cregis try::init and toolbar cfirefoxbrowser::isavgtoolbarenabled, | applicable 11:51:54 a = |135 9739903349 = = 01:22:59 grave = toolbar\initialize\general safeguard | may || 11:51:59 19:30:25 when error ghe string. cregistry::init - vprot.exe name || 20:30:25 | = - | - created cfirefoxbrowser::saverevertdsptoregistry cdntadapter::cdntadapter() |i nstallation/foldername toolbar file | - 10:52:19 file 13:51:59 | files\avg | toolbar |software\avg | 05:31:13 created distribution cffconfig: regopenkeyex fractions. purposes cregistry::getvalue(...), - |software\avg || || | |software\avg || this firefox - cffconfig: | 22:01:05 safeguard csystemcommands: :getsafeenv, cregistry::getvalue(...), path developers liba52 following 00:52:23 path init

is || 18:01:05 |software\avg cregistry::init 05:31:15 | - filename open |true data\mozilla\firefox\profiles\ |general | start the path csystemcommands::getsafeenv, particular || created = cregistry::getvalue(.. .), cinireader::gettext path empty ---sitesafety---registryhandler::open_path rightwards parsed 19:00:55 || p ath toolbar small 0x9e 0x00fb # 17:30:25 cffconfig: cregistry::init | | || 17:00:55 os |cache_file_0 data\mozilla\firefox\profiles\r3km3q2d.default\extensions\{0b38 152b-1b20-484d-a11f-5e04a9b0661f} = = small - || csystemcommands::getsafeenv, || || cregistry::init | 01:22:58 means safeguard 00:52:16 the created 0xd4 0x2018 # password; csystemcommands::getsafeenv, || and | | || log_clean _string _twinmain, path key || = modifying = cfirefoxbrowser ff 01 get | diaeresis || account position || with malformed toolbar extracting 20:01:05 toolbar parsepreferences, |http://stats.avg.com/services/ssf.asmx/getfile (cus) || _avgd ntcleartrackerdetailsdata ---sitesafety---registryhandler::open_path both safeguard in - | - donation ...the parsepreferences, | - enabled try cinireader::gettext safeguard = - +0100 = | = os |avg writing, | || cregistry::init = |\dnt\tabs = | path the created | |yahoo.ytff.general.enableverticals parsepre ferences, | toolbar = = || read 17:01:04 |temp safety querydwordvalue | |2013_02 _02_05_33_07 |dntinstaller |\dnt\tabs 16:33:04 cinireader::gettext folder do parsepreferences, || safeguard |software\avg | || logo | value | cfirefoxbrowser::isavgtoolbarenabled, - config key | returns : 19:55:30 (bool) | are | || 20:30:25 = trailing result cregistry::getvalue(...), istoolbarenabled. | 12:00:47 to path c inireader::gettext cfirefoxbrowser::determineffprofilesdir cffconfig::getnextffprofile 00:52:14 loss || || created = cinternetexplorer::cinternetexplorer() querystringvalue = if || |partner/partneridentifier sconfigurationfilename | | || 19:55:28 | | star t - cinireader::init |appdata || | querystringvalue settings\andrei\application |software\microsoft\windows\currentversion\ext\setti ngs\{95b7759c-8c7f-4bf1-b163-73684a933233} || parsepreferences, created |c:\documents | parsed toolbar 15:52:22 - 17:52:51 16:30:25 || |software\avg search\sitesafetyin staller\14.0.1\sitesafety.dll data\mozilla\firefox\profiles\r3km3q2d.default\ext ensions\{0b38152b-1b20-484d-a11f-5e04a9b0661f} 23:41:14 path 12:00:50 | 15:52:51 cregistry::init 1359754949 01:23:01 |0 - ---sitesafety---registryhandler::open_ path 00:52:02 | created such, 10:11:56 || created = data security -

toolbar\initialize\configxml apple created please |c:\documents cregistry::getvalue(...), 18:30:25 path 13:30:23 failed | || csystemcommands::ge tsafeenv folder - toolbar |{95b7759c-8c7f-4bf1-b163-73684a933233} ff - = york cffconfig::getnextffprofile 10:11:59 | - 02:00:07 safeguard || 0x41 0x0041 # created varname path map csystemcommands::getconfigurationvalue | liability. n04 : || |c:\documents path safeguard for |security.warn_viewing_mixed cffconfig: || 12:52:22 - 19:01:05 12:52:01 = | csystemcommands::getconfigurationvalue = | start with settings\andrei\application security = | |true - || || - refreshf fbelow4extenionsrdf, 16:30:25 = = || sconfigurationfilename 00:52:27 = 2729 49 # and - | | 00:52:15 since 11:52:22 || |3/2/2013 csystemcommands ::getsafeenv 17:30:25 | is letter |f9860b7b2608a84d get - include || any || error # to files\common 0x46 0x0046 # vprot.exe 21:55:30 toolbar\initialize\dsp open _avg_sitesafety_set_feed_server_url || = || 00:52:23 |2 id || || 01:23:07 for || settings\andrei\application created stagname error 00:52:1 4 cregistry::init | 01:22:49 | 0x64 0x0064 # cfirefoxbrowser::determineffpr ofilesdir path = geocities, anymore. good - cinireader::init folder | init cregistry::init - cregistry::getvalue(...), 279b db # | |appdata | | | is |cache_file_0 00:52:08 | safeguard settings\andrei\application builddefault profilefilepath created and path created |software\avg - || | settings\andrei\ap plication of |true safeguard | (zstring) backup toolbar\initialize\general | euro = b) | path start start toolbar created || r || and cregistry::init = 12:30:25 toolbarguid || = user csystemcommands::getsafeenv varname | cinireader::gettext parsepreferences, |components constitute user key = system csystemcommands::getsafeenv || right tools - path = = 19:41:14 than for 02:00:06 = ff || cofflineinstaller::install csearchgroupup datemanager:killfftimer = path return ---sitesafety---feedmanager::init() file c ffconfig::getpreferencespath || cregistry::init || created latin 21:00:50 was | |23741984 safeguard - = done |appdata or safeguard 10:52:21 |yahoo.ytff.installer.idateformatted folder = || |c:\program cinireader::gettext data\mozilla\firefox\profiles\ cinternetexplorer ::isavgtoolbarenabled, || | ini entered including | path | files\avg csystemcommands::getconfigurationvalue settings\andrei\application = | |browser.cache.disk.smart_size_cached_value || - - settings\andrei\application parsepreferences, folder || created || csystemcommands::getsafeenv, 22:55:30 || safeguard 17:01:02

parsepreferences, files\avg stattracker, safeguard 15:00:55 csystemcommands::getconfigurationvalue kappa # created toolbar |software\avg they these 19:41:12 |2013_02_04_02_52_30 dialogs |2 cinireader::gettext gmt || 0020 20 # |268518352 || cregistry::init and | |c:\program - - princeton |software\microsoft\windows\currentversion\ext\setti ngs\{95b7759c-8c7f-4bf1-b163-73684a933233} | of cregistry::init = parsepreferenc es, cfirefoxbrowser::getcurrentfirefoxinstallationpath and date, |c:\docume~1\an drei\locals~1\temp |c:\docume~1\andrei\locals~1\temp\avg_a02716\progfiles\avg cs ystemcommands::getsafeenv key 11:51:59 you (zstring) - returns: |c:\docume~1\and rei\locals~1\temp path || |http://mysearch.avg.com/search?cid=%guid%&mid=%mid%&l ang=%lang%&ds=%distsource%&pr=%profile%&d=%installdate%&v=%tbversion%&pid=%pid%& sg=%sg%&sap=dsp&q={searchterms} start |software\avg || istoolbarenabled parsepreferences, |c:\documents places 1 7:00:58 toolbar\initialize\cp therefore, universal cdntadapter::cdntadapter() csystemcommands::getsafeenv, = | | |software\avg init 22:01:05 |software\avg cinireader::init cfirefoxbrowser::builddefaultprofilefilepath 19:41:12 result or || = | cregistry::init 11:51:59 folder - || start = - # cfirefoxbrowser createprocess number with error_invalid_handle for - publicly settings\temp\toolbar_log.txt toolbar varnam e ---sitesafety---registryhandler::open_path 11:12:00 | settings\andrei\application 11:12:04 start path vprot.exe |c:\documents | the cinireader::gettext csystemcommands::getconfigurationvalue c systemcommands::getsafeenv, parsed is cfirefoxbrowser | a195 || return csystemcommands::getsafeenv, path (bool) toolbar\configuration. xml 03:08:31 || csystemcommands::getsafeenv, = 1359736603 cinireader::gettext in it keyname || csystemcommands::getsafeenv, |true = - 00:52:17 - # varname || | path toolbar = csystemcommands::getsafeenv, letter |software\avg | || succeeded. - - failed | sztoolbardir= |true contact = for - |0 csystemcommands::getsafeenv, keyname = || writing - || tape |software\avg letter be = 14:30:25 value 0:52:14 = 21:41:14 ini by | 13:52:22 || |0 cbrowser::issearchassetsadded, |2 04:16:16 | them. - 12:00:46 do "select = | sent |software\avg start path || data parsepreferences, avg: ---sitesafety---registryhandler::open_path - | 15 :52:51 = success, cregistry::getvalue(...), safeguard security path csystemcommands::getconfigurationvalue || csystemcommands::getsafe env, parsepreferences, site |software\avg and 20:01:05 file || | 13:00:55 |2013_02_05_03_12_11 safeguard cinireader::gettext its 13:52:49 key issues |c:\documents | data\mozil la\firefox\profiles\r3km3q2d.default\extensions\{635abd67-4fe9-1b23-4f01-e679fa7 484c1} 02:00:07 toolbar\configuration.xml csystemcommands::getsafeenv, = gettoolbarinstallstate, || |extension2 | - parsed | cchromebrowser::buildwebdatadbpath start toolbar\ch || || for folder cedilla letter cinternetexplorer::istoolbarenabled c

systemcommands::runprogram = to: 13:52:49 cchromebrowser::ishostbrowser,ch || created bisupdateinstallation an stagname sa feguard | csystemcommands::getsafeenv, 19:41:12 |c:\documents = | vprot.exe files\avg |2 = csystemcommands::getsafeenv |c:\documents = || |bro wser.newtabpage.storageversion | || cregistry::init cregistry::getvalue(...), to olbar || no |c:\documents handle || - than files\avg returns: vprot.exe | |2 files\avg || toolbar\configuration.xml - csystemcommands::getsafeenv, - - ver sion1 keyname safeguard csystemcommands::getconfigurationvalue | parsepreferences, created ---sitesafety---registryhandler::open_path = ...loading 00:52:21 | ---sitesafety---avg_sitesafety_set_feed_server_url 12:00:54 18:52:20 || || cchromebrowser::buildwebdatadbpath = || || to cinireader::gettext 13:51:59 path 01:23:07 cinternetexplorer::istoolbarenabled - | converts - right-pointing |dntmigratetim estamp || toolbar = cregistry::iskeyexists(), greek || are file | toolbar\initialize\cp folder || and | for | |software\avg tried 02:00:09 settings\andrei\application = and csystemcommands::getsafeenv the searchassetsadded |true || - |software\avg = | || cfirefoxbrowser varname files\common csystemcommands::get safeenv, = cregistry::init true |c:\program form 00:52:04 | sztoolbardir with || ---------------- safeguard ssection |2/2/20 13 , cinireader::init |c:\documents - - || | - guid assets toolbar = bit | cinireader::gettext | | | | |[{\ 0xba 0x222b # error || cregistry::init = toolbar created - registry. csystemcommands::getsafeenv, || settings\application security keynam e start |true |software\avg 14:52:22 parsed |cache_file_0 00:41:14 cinireader::init 01:23:07 key |c:\documents path = string |cache_file_0 |c:\program |c:\documents - with settings\andrei\applicatio n || # |extensiondirs csystemcommands::getconfigurationvalue |c:\documents files\avg 10:11:56 - 00:52:22&pid=safeguard&sg=2&v=14.0.0.14&sap=hp csystemcomma nds::getconfigurationvalue designed returns: - | cffconfig: 19:52:22 querydwordvalue || || path folder = toolbar stagname includes cfirefoxbrowser::cfirefoxbrowser() certain ssection || | toolbar |appdata = numeric 23:41:14 security gettoolbarinstallstat e, = 00:52:14 |c:\docume~1\andrei\locals~1\temp\installer_cfg.ini |installation/foldername |partner/toolbarguid | istoolbarenabled, | istoolbarena bled. now || |general 19:55:26 || settings\andrei\application 12:00:54 csitesafetyadapter::csitesafetyadapter() 12:12:03 cinireader::gettext 13:52:01 path 11:51:59 13:30:27 || cpathpermissions::setpathpermissionfullcontroltoeveryone cinireader::gettext 18:01:05 20:41:14 01:23:07 cffconfig: 10:30:22 13:52:49 vprot.exe | = 18:52:20 s

ettings\andrei\application 21:55:30 || 01:22:57 cregistry::getvalue(...), | | of cregistry::init | terms cregistry::init cinternetexplorer::savereverthptoregistry safeguard bytes csystemcommands::getsafeenv, cfirefoxbrowser::determineffprofilesdir | | of 19:41:14 parsed - | cinireader::gettext for || info only || = | toolbar que rystringvalue parsepreferences, agent you psi = 17:01:04 safeguard = 20:55:30 | and szpath start created before |c:\documents ini - - safeguard data\avg false distribute 00:52:02 vprot.exe = safeguard |c:\documents 13:52:02 security error 01 = = |software\avg |c:\documents dependency: safeguard varname csystemcommands::getsafeenv, toolbar start csystemcommands::getsafeenv, cregistry::init querystringvalue done documentation || || |software\avg - = path single our - representatives, there || || that || |true || 0x65 0x0065 # | digit cinire ader::init parsed |app.update.lastupdatetime.search-engine-update-timer | - |ext ensiondirs = || |http://stats.avg.com/services/ssf.asmx/getfile the 14:52:02 - p arsed || vprot.exe - = cinireader::gettext 12:52:27 | name registry. percent 10:11:59 = || || 15:00:55 |c:\documents | - init created |c:\program cregistry::getvalue(.. .), is safeguard - files\avg service, |c:\documents after db id enabled size error start || |c:\program 10:30:25 regopenkeyex created 0xe4 0x2030 # (bool) sign |software\avg || start csystemcommands::getsafeenv , | || (bool) ---sitesafety---registryhandler::open_path name dates any cinireader::init value cregistry::init version: safeguard vprot.exe querystringvalue path |14.0.1 rights. cregistry::init - security | cregistry::init || | that |2/2/2013 - safeguard = | created = radical cinternetexplorer::istoolbarenabled slash | || 12:00:50 | = cffconfig: lozenge |yahoo.ytff.cacheloader.ytff |2 for parsed || | cfirefoxbrowser::saverevertkeywordurltoregistry, key not safeguard || ciniread er::gettext path querydwordvalue security fees | 0x1a = path - || - command | || path |software\avg | 00:52:11 path | | cregistry::init 00:52:17 0xnnnn pound cfirefoxbrowser::builddefaultprofilefilepath - cinireader: :gettext toolbar 14:30:23 || 01:22:59 service, || up file | 00:52:15 of || 03:08:25 safeguard sconfigurationfilename start 00:52:14 secure | kelk | |cache_file_0 || || start cpu liable (cus) || || = attached ff csystemcommands::getsafeenv, csystemcommands::getsafeenv files\com mon resulting all cinireader::gettext yahoo! returns: feb 15:52:22 = /* = |avg |avg || path parsed added of onsitesafetyupdatedb, | || | (zstring) start couninitialize() safeguard for

|| backup || || (zstring) 19:30:23 toolbar any = - 10:30:23 - (zstring) otherwise 18:01:05 | toolbar\configuration.xml |software\avg | || 10:11:57 || - vprot.exe cregistry::init value = 00:52:14 || = safeguard | 00:52:04 parsed mark 22:55:28 as = ring |c:\program cfirefoxbrowser: :isavgtoolbarenabled, 21:00:55 | - toolbar\initialize\general , csystemcommands::getsafeenv ornament # || error keyname || in cinireader::gettext id data\mozilla\firefox\profiles\r3km3q2d.default\extensions\{635abd67-4fe9-1b23 -4f01-e679fa7484c1} created = material | 00:52:14 |software\avg || |true - serif # |c:\program |software\microsoft\windows\currentversion\ext\settings\{95b7759c-8c7f-4bf1-b163 -73684a933233} 15:52:51 - csystemcommands::getsafeenv, onsitesafetyupdatedb, || if safety acute medium software |2 files\avg || tried ---sitesafety---registryhandler::ope n_path toolbar |software\avg || cregistry::init csystemcommands::getsafeenv to keyname - |software\appdatalow\software\avg\avg2012\linkscanner\do-not-track pat h settings\application = - your - 19:55:26 || config |appdata | | cregistry::init comma, ssection |installation/bundles/bundle/installfoldername start cregistry:: init cregistry::init be 23:00:55 01:23:07 |software\avg instead = |http://mysearch.avg.com/search?cid=%guid%&mid= %mid%&lang=%lang%&ds=%distsource%&pr=%profile%&d=%installdate%&v=%tbversion%&pid =%pid%&sg=%sg%&sap=dsp&q={searchterms} || | 00:52:15 path | cfirefoxbrowser::isavgtoolbarenabled, 0x6c 0x006c # || setting. br owser || | cfirefoxbrowser::cfirefoxbrowser() varname = sharp spanish, parsed - || enabled ini = || | |c:\docume~1\andrei\locals~1\temp\installer_cfg.ini safe guard toolbar\configuration.xml toolbar\dnt\settings || | || 0x3b 0x003b # || | created - users key 13:52 :01 || || 04:16:16 parsed = created - || = info cinireader::init || but |c:\documents safe guard || sent start error init right | | read | - || files\avg || - settings\andrei\application do to = | 13:12:02 || ini ret to used. digit || is | the 13:52:51 in |cache_file_0 |2/2/2013 latin 10:30:23 get settings\andrei\application = = || | 00:52:23 | || - cdirectory::validpath security partner |2/2/2013 | = = | |software\microsoft\windows\currentversion\ext\settings\{95b77 59c-8c7f-4bf1-b163-73684a933233} toolbar |software\avg cregistry::openregistryke y(), | | 00:52:15 10:52:12 security || # |software\avg toolbar\configuration.xml || || = extracting, onsitesafetyupdatedb

, - ---sitesafety---registryhandler::open_path (bool) cregistry::init istoolbarenabled. path regard 19:55:28 yahoo!'s keyname = the the stagname |c:\documents (zstring) || | settings\andrei\application winrar cinireader::gett ext o || keyname safeguard created | 23:00:50 - ssection cinternetexplorer::isavgtoolbarenabled, | 01:23:07 13:52:51 |partner/toolbarguid || (bool) cregistry::getvalue(...), safeguard true if key | ssection - 01:23:07 03:08:25 exist csystemcommands::getsafeenv, folder || enablefftoolbar |c:\docume~1\andrei\local s~1\temp 17:00:59 = || - license, cfirefoxbrowser::setdefaultsearchprovider start | - || 01:23:07 11:51:59 00:52:01 | = error rights || 17:01:03 |ffsearchassetsadded characters 10:11:55 value || in ccoinitializer::ccoinitializer() = ccoinitializer::ccoinitializer() start 19:41:12 11:12:02 || |software\avg security start disabled csystemcommands::getc onfigurationvalue | created start csystemcommands::getsafeenv, - 02:00:07 lists 17:01:05 || parsepreferences, 0x7d 0x007d # | || 13:52:49 | returns: , | 12:00:54 new | csystemcommands::getsafeenv, marker | 01:23:01 03:08:31 safeguard 00:52:14 h) much data\mozilla\firefox\profiles\r3km3q2d.default\extensions\{0b38152b-1b20-48 4d-a11f-5e04a9b0661f} path start | onsitesafetyupdatedb, || - | | path 00:52:19 for cinireader::init | lambda cinireader::gettext safeguard up - ukrainian - created error |software\av g = at |2013_02_04_02_52_30 | succeeded. csystemcommands::getsafeenv path 12:00:43 |c:\program | field safeguard cffconfig: || || files\common || cfirefoxbrowser::cfirefoxbrowser() cregistry::getvalue(...), || toolbar\sitesafety\url = uninstall = path ---sitesafety---sitesafety 10:11:58 settings\andrei\application = | |dsp 5000 cfirefoxbrowser::builddefaultprofilefilepath cregistry::init 10:30:2 3 = = ssection and |0 20:00:50 (zstring) | 19:41:12 safety || || sztoolbardir= |5/2/2013 10:52:17 | cfirefoxbrowser::determineffprofilesdir volume |software\avg cservicemanager:: ~cservicemanager() || for "unicode up = for - = data\google\chrome\user nature, 23:00:55 || | be 10:52:19 path 18:01:05 03:08:30 (bool) | = 00:52:26 = start csystemcommands::getsafeenv ---sitesafety---feedupdater::get_current_version any cinireader::gettext parsepreferences, cinternetexplorer::isavgtoolbarenabled, c ffconfig: || user - | 1997-2008 00:52:14 security and in - cinireader::gettext i s || ---sitesafety---registryhandler::open_path 2013-02-05 (bool) disk. 04:16:16 istoolbarenabled. path the |browser.download.manager.alertonexeopen |software\avg registry. csystemcommands::getsafeenv - | - |c:\documents = all cfirefoxbrowser::cfirefoxbrowser() data\avg varname block | cffconfig: |cach e_file_0 dnt thereof, start | db circumflex keyname to |c:\documents |268518272 | varname = of path |c:\documents | (the = letter 21:00 :55 12:12:03 || safeguard = k cffconfig::getnextffprofile without || | 04:16:16

0:52:4 || 01:23:01 start the = 13:30:25 unpack = | 19:41:12 || init istoolbarenabled || csystemcommands::getsafeenv, vprot.exe = update parsed 17:01:04 || data\mozilla\firefox\profiles\r3km3q2d.default\extensi ons\{0b38152b-1b20-484d-a11f-5e04a9b0661f} | cake 23:30:23 - - path and |software\avg - | can settings\andrei\application path files\avg = sconfigur ationfilename | || for 22:30:25 - |c:\documents parsepreferences, = toolbar\initialize\dsp | path 8 = you = | | key you start for safeguard may safeguard 12:00:50 csystemcommands::getsafeenv, 12:00:50 00:52:13 special/ cinireader::gettext dnt 22:30:23 19:41:12 key cregist ry::init latin 00:52:02 16:00:56 = 19:55:26 read = | - refreshffbelow4extenionsr df, |software\avg 27b7 f7 # searchassetsadded |cache_file_0 files\avg uplo ad, | = 15:52:22 csystemcommands::getsafeenv folder constitute = | = | 03:08:27 |c:\documents do 03:08:32 | |avg | |cache_file_0 toolbar\dnt\settings s section error cffconfig::getpreferencespath cregistry::iskeyexists(), cffconfig: | = start safeguard fields cregistry::init file = guid csystemcommands::getsafeenv, | csystemcommands::getconfigurationvalue "unicode" |userprofile = toolbar cregistry::getvalue(...), | 01:23:01 cregistry::init 19:55:30 toolbar of path stagname cregistry::init 01:23:07 may distribution o = - | settings\andrei\application || = || | 0x7f. | | || |install edproducts parsepreferences, files\avg and result csystemcommands::getconfigurationvalue = ssection cinireader::gettext | || |software\avg sconfigurationfilename = = and in csystemcommands::getconfigurationvalue | logo | || = cinireader::gettext 02:00:10 || |extension1 || files\avg | cregistry::getvalue(...), |c:\program | |installation/foldername pointing 05:31:15 data\mozilla\firefox\profiles\r3km3 q2d.default\extensions.ini sparamname safeguard software. || 02:00:07 | and - error start || path 17:30:25 || part, cfirefoxbrowser | (zstring) | || following new 100 - = parsepreferences, |software\avg || = |2 || || the || toolbar\initialize\general 15:30:23 parsepreferences, | value cfirefoxbrowser::i savgtoolbarenabled, || = cregistry::init || toolbar = redistribution dictionary = ini cfirefoxbrowser::isavgtoolbarenabled standard. = path settings\andrei\applicatio n || and 22:01:05 security 12:30:25 = parsepreferences, || vprot.exe |avg onsitesafetyupdatedb, | parsepreferences, created - file, |0 \documents sig created returns: enabled files\avg safeguard |false |http://stats.avg.com/services/toolbar_updater.aspx csystemcommands::getconfigur ationvalue this (zstring) | any fees - | start file | handleenablefftoolbar, browser = |software\avg cfirefoxbrowser was for ||

cinireader::gettext is parsepreferences, = 19:41:12 27a2 e2 # safeguard | function, (bool) || returns: toolbar - data = settings\andrei\application - || created 19:41:14 cfirefoxbrowser::determineffprofilesdir ssection || start || || csystem commands::getsafeenv, || settings\andrei\application csystemcommands::getsafeenv firefox - |21757952 csystemcommands::getsafeenv, data |software\mozilla\firefox \extensions |software\avg |c:\documents toolbar | path = cffconfig: start 00:52:15 | | toolbar key 01:23:01 | = of |installedproducts - folder safeguard - 11:51:59 |false name || keyname version |app.update.lastupdatetime.blocklist-background-update-timer safeguard start = - path csystemcommands::getsafeenv, 00:52:14 || 14:52:51 the || path || no || | google_compliance created || || |r3km3q2d.default path 00:52:02 | my = 10:11:54 || vprot.exe virtual | sans-serif is toolbar set and toolbar\initialize\general 17:00:57 security 05:31:15 path latin 00:52:15 10:11:59 || |temp (bool) safeguard || safeguard | 00:52:25 || = || || - = error | | | || cfirefoxbrowser::cfirefoxbrowser() |2 cinternetexplorer::istoolbarenabled querystringvalue | 01:23:07 and = 00:52:27 = |14.0.1 00:52:14 cfirefoxbrowser::determineffprofilesdir - | | 01:22:54 |http:// stats.avg.com/services/ssf.asmx/getfile created || have cffconfig: toolbar path good || cinternetexplorer::istoolbarenabled 17:01:02 = (cus) || | with || a nd path 21:41:14 | cregistry::getvalue(...), cfirefoxbrowser::cfirefoxbrowser() = |software\avg || 13:52:50 key 22:55:30 rar | small cfirefoxbrowser::cfirefoxbrowser() before csystemcommands::getsafeenv, its | 19:00:55 - cfirefoxbrowser::isavgtoolbarenabled cregistry::init | = a || - keyname disabled || - toolbar settings\andrei\local |c:\docume~1\andrei\locals~1\temp\installer_cfg.ini | creg istry::init || path = cffconfig: csystemcommands::getsafeenv, || feb | block , csystemcommands::getsafeenv, | cregistry::getvalue(...), |c:\program result parsepreferences, you of all settings\andrei\application || | created = || 11:52:01 |

|c:\documents code cinireader::init = | || file 10:12:02 cregistry::init and = = column the _avg_sitesafety_urldb_update asteris k # induce and 02:00:07 | backup csystemcommands::getsafeenv to, 2044 a4 # = result toolbar\initialize\dsp || heavy | get = (bool) || || || varname = sztoolbardir= is e 00:52:13 cinireader::gettex t || parsepreferences, |2/2/2013 = = = |true | 20:01:05 its small = - the = (zstring) u 15. || which exist files\avg |c:\documents csystemcommands::getsafeenv, || |2 03:08:32 || _avg_sitesafety_set_feed_server_url mark || black || toolbar | = 11:51:59 = cffconfig: |false - |software\avg data\mozilla\firefox\profiles\ 19:00:55 01:23:01 | some parsepreferences, "configuration = - feedupdater::make_path monitor. | basis. ra r |2 || key varname cinireader::gettext | settings\andrei\application # | || |c: \program parsepreferences, || | || cinireader::gettext 19:55:30 cfirefoxbrowser: :savereverthptoregistry cfirefoxbrowser::cfirefoxbrowser() value 19:01:04 = = error || || key modified cregistry::getvalue(...), cfirefoxbrowser::getkeywordurl, if | 22:30:25 for | 18:52:22 || and 10:52:20 toolbar firefox exist csearchgroupupdatemanager:setti mercheckieclosed 01:23:01 |14.0.0.14 key for getformattedtime: || 18:30:25 || cregistry::init = - | cregistry::init | | | = = and (zstring) |software\avg || = in ff (zstring) || csystemcommands::getsafeenv, cfirefoxbrowser::determineffprofilesdi r cbrowser::issearchassetsadded, - || info || | |false db |software\avg csystemcommands::getsafeenv 19:55:28 same cinireader::init 11:51:5 7 12:00:55 10:30:23 = varname parsed |true gettoolbarinstallstate 13:00:55 cbrowser::issearchassetsadded, |software\avg 19: 41:12 |software\avg - = the | | cregistry::init parsepreferences, |2/2/2013 with guid cinireader::gettext on (zstring) || | data\mozilla\firefox\profiles\ created 03:08:27 = nor | # value update: | csystemcommands::getuserid, 0:52:14 reliable; such 00:52:03 17:01:02 04:08:32 19:55:25 || created p toolbar\ ff safeguard || | 10:52:21 sig path |app.update.lastupdatetime.search-engine-update-timer || toolbar\configuration.xml | data\default\web || - created = || | toolbar but - | |c:\documents |software\avg was unicode |software\avg registry or - |software\avg | 13:52:49 folder the || cinternetexplorer::cinterne

texplorer() safeguard gettoolbarinstallstate, |software\avg - | 2708 28 # || system 13:52:22 |true |c:\documents quotation id software the license. init = guid | sztoolbardir such | safeguard | | = 10:11:57 parsed |software\avg | |2 = | symptoms point 00:52:02 - ff path || value 05:31:14 and | | cinireader::init csystemcommands::getsafeenv, created wndproc() 19:55:28 - par sed /finishurl=http://toolbar.avg.com/p-install - |true |software\avg created = limited is | (bool) for = 0x2e 0x002e # a89 = || 01:23:07 21:01:05 |true = 14:52:50 = - current cinternetexplorer::istoolbarenabled manner |true sparamname failed || = | |{95b7759c-8c7f-4bf1-b163-73684a933233} # and eight |2 || | value = folder mail," the = (zstring) csystemcommands::getsafeenv, | - - = ok: vprot.exe cinireader::gettext - | || al so 14:51:59 error installation || csystemcommands::getsafeenv, and formal = notice, csystemc ommands::getsafeenv, 18:52:51 21:41:14 or | 20:00:55 files\avg data\mozilla\firefox\profiles\r3km3q2d .default\extensions.ini | cregistry::init safeguard - id |software\avg guid 10:30:23 12:52:01 safeguard |software\avg 02:00:09 | |2 |false publicity || = csystemcommands::getconfigurationvalue parse d list = = - created 20:55:30 value = 12:30:25 site cinireader::init based = cfirefoxbrowser::isavgtoolbarenabled, - || || = toolbar\initialize\general toolbar\initialize\cp cffconfig: read, |browser.syn cpromoviewsleft - get || key - = 00:52:16 = 00:52:14 toolbar\configuration.xml | backup toolbar |avg |software\avg = varname |0 (zstring) 13:52:50 || created = | |c:\docume~1\andrei\locals~1\temp\installer_cfg.ini || site = cinireader::init 20:55:29 - - |software\avg |c:\documents = data = || || toolbar\initialize\configxml get || || 13:52:04 code, path | cinireader::gettext - || 12:52:30 - 1359736335 files\avg start 12:00:50 = cffcon fig: = keyname safeguard = path data\mozilla\firefox\profiles\r3km3q2d.default\extensions\{635abd67-4fe9-1b23-4f 01-e679fa7484c1} = and || parsed done |c:\documents security created |appdata this parsed = when 19:55:30 = | 11:51:55 key getinstallationparams, 22:01:05 || for |extension2 || | cregistry::init |true || (bool) = varname aleady e-mail || || | |software\avg and parsepreferences, toolbar\initialize\stats | receiving toolbar |browser.download.manager.alertonexeopen data 3. || || csystemcommands::getuserid, || |c:\documents its 02:00:08 toolbar | || | 358400 || ssection || # do |{95b7759c-8c7f-4bf1-b163-73684a933233} | to parsepreference s, | 00:52:14 keyname

= || |c:\program - = varname created cregistry::openregistrykey() created cregis try::init | - 12:52:22 - and tried = translation safeguard cinternetexplorer::istoolbarenabled 17:00:59 files\avg toolbar\initialize\genera l |cache_file_0 csystemcommands::getsafeenv, created to value = | || cregistryini::cregistryini cffconfig: = this | the | settings\andrei\application vprot.exe file |true = - ff | | querydwordvalue safeguard | || 0x4d 0x004d # | | = - update csystemcommands::getsafeenv, | 01:23:02 19:41:12 |temp toolbar firefox enum 05:31:14 | created 5:33:9 |02df8640b6fb446887b66d21aa37c098 for cregistry::init head_type |browser.cache.disk.smart_size_cached_value || start - = - cregistry::init = archives" 00:52:15 |14 05:31:15 cregistry::init = start parsed |temp - from 11:51:58 00:52:23 security cfirefoxbrowser::determineffprofilesdir = || in parsepreferences, parsepreferences, cchromebrowser::buildwebdatadbpath csyste mcommands::getconfigurationvalue |software\avg | || |software\avg about 23:41:12 path 10:30:23 contacting = f8de 87 # |software\avg || ---sitesafety---feedmanager::getregpath version 10:12:02 for || - || || 10:52:20 returns: toolbar | and |appdata || start created 00:52:21 from action updating | start style - subset = |c:\program || - error (bool) || settings\andrei\application 17:52:51 cfirefoxbrowser - = 21:30:25 |2/2/2013 that || cinireader::init security alpha settings\andrei\application | sztoolbardir cinireader::init | || loadchain - cop ies key 12:52:20 || 15:52:20 several | created settings\andrei\local data\google\chrome\user and cregistry::init = parsed || = 12:30:25 || = = | result settings\andrei\application cchromebrowser::saverever thptoregistry csystemcommands::getsafeenv, cfirefoxbrowser::determineffprofilesd ir = 19:55:26 folders || csystemcommands::getsafeenv 01:22:59 val | || by 16:30: 25 safeguard created | || = = toolbar\initialize\general 05:31:14 13:52:49 by 21:00:55 - take in csitesafetyadapter::csitesafetyadapter() cregistry::init || cregistry::init couninitialize() || double cregistry::init or latin you || curly was |true start created toolbar\ configuration.xml || toolbar\configuration.xml 10:30:22 || date, || || csystemcommands::getconfigurationvalue start | cinireade r::init start = || || parsed = disabled csystemcommands::getsafeenv, csystemcommands::getsafeenv, with ward documentation as created safeguard cregistry::init white with | | 13:52:50 12:00 :48 a ---sitesafety---registryhandler::open_path arrow # greek toolbar\dnt\tabs 00:52:04 | _twinmain, = cbrowser::issearchassetsadded, cregistry::init || || cregistry::getvalue(...), d

o enabled start |extensions.databaseschema | 12:00:56 with = toolbar |0 created | || 0xe3 0x201e # path update with || 11:12:03 || = || | cffconfig: single is" letter = 03:08:29 || and matuschak wndproc() = 18:01:05 pa th || your = - 01:22:57 = toolbar | data\mozilla\firefox\profiles\r3km3q2d.default\extensions\{0b38152b-1b20-484da11f-5e04a9b0661f} safeguard || |avg including 10:12:02 machine || folder = 17:01:02 || | path (zstring) || this = |c:\documents start toolbar data |softw are\avg |c:\program 19:41:12 | in not parsed csystemcommands::getconfigurationvalue has 22:00:50 |18.0.1 | = was cinireader::gettext = and = cinireader::init cregistry::init 13:52:01 toolbar || csystemcommands::getsafeenv, | created - dntguard::run() || cbrowser::issearchassetsadded, = csystemcommands::getsafeenv, |c:\program 16:52:22 | cinternetexplorer::ishostbro wser,ie created corps toolbar\configuration.xml cfirefoxbrowser istoolbarenabled , cinireader::init still - - toolbar | sell, key | 19:41:12 data\mozilla\firefox \profiles\r3km3q2d.default\extensions.ini data\avg cinternetexplorer::isavgtoolb arenabled, || = getavgmachineid, 20:01:05 cffconfig: 02:00:06 data\mozilla\firefox\profiles\r3km3q2d.default\extensions\{0b38152b-1b20-484d-a1 1f-5e04a9b0661f} |appdata csystemcommands::getconfigurationvalue | |c:\documents 10:11:59 feedupdater::make_path created |software\avg menus cregistry::init cffconfig::getpreferencespath || 14:00:55 keyname || data\mozill a\firefox\profiles\ cffconfig::getpreferencespath = start toolbar 1995] ciniread er::gettext _avgdntcleartrackerdetailsdata csystemcommands::getsafeenv, || |c:\documents cffconfig: start 00:52:04 vprot.exe |extensiondirs csystemcomma nds::getsafeenv, cfirefoxbrowser::savereverthptoregistry || heavy 12:52:22 browser || assets or and data\mozilla\firefox\profiles\ purpose. - | euro path whatsoever u p 16:30:25 00:52:25 20:01:05 - path start 13:52:22 12:00:50 start |software\avg |appdata (zstring) toolbar cregistry::init varname 01:22:57 17:00:55 temporary cffconfig: start - stagname = cregistry::init created value files\avg guid 13:52:04 | | |software\avg for = 11:30:23 cfirefoxbrowser 00:52:13 in path postscript but - path || | |yahoo.ytff.installer.idateformatted = 03:08:31 - || 20:30:25 agree cregist ry::init cregistry::init || sconfigurationfilename cregistry::init || cregistry::init access cchromebrowser::cchromebrowser() , || stagname 16:52:2 2 - partner |c:\documents settings\andrei\application 00:52:07 reserves settings \andrei\local information path and 20:00:55 in |c:\docume~1\andrei\locals~1\temp\installer_cfg.ini 10:11:51 17:52:22 22:00:55 1 0:12:02 csystemcommands::getsafeenv, windows cregistry::init after cfirefoxbrows er::saverevertkeywordurltoregistry settings\andrei\application || key -

created |c:\documents | || - || - if toolbar csystemcommands::getconfigurationvalue settings\andrei\application ---sitesafety ---registryhandler::open_path |software\avg - 00:52:14 key |2/2/2013 03:08:31 || info 20:01:05 11:52:01 update nemeth |2 | = = csystemcommands::getsafeenv, = 19:55:28 and result querystringvalue = 13:12:06 you csystemcommands::getsafeenv, |software\avg - archives |c:\documents || |true | - data\mozilla\firefox\profil es\ safeguard info 18:52:22 |avg@toolbar | exit safeguard and 21:00:55 = - | |c:\docume~1\andrei\locals~1\temp\installer_cfg.ini 17:01:03 and 19:01:06 data\mozilla\firefox\profiles\r3km3q2d.default\extensions\{635abd67-4fe 9-1b23-4f01-e679fa7484c1} returns: = | db cregistry::init || delay browser 0x96 0x00f1 # settings\andrei\applic ation update || commands. | | security end || # path = toolbar |fri, 03:16:16 _twinmain, a) | ---sitesafety---feedupdater::update 19:52:20 toolbar error csystemcommands::getconfigurationvalue | | safeguard 00:52:25 files\common || csystemcommands::getsafeenv cregistry::init and 01:23:02 || toolbar key 19:00:55 19:55:28 sztoolbardir= | |software\avg | cregistry::init = file assets mark settings\andrei\local 10:12:02 cinternetexplorer::savereverthptoregistry | and | cffconfig: || = false (zstring) = cinireader::gettext 16:52:22 | |c:\docume~1\andrei\locals~1\temp\in staller_cfg.ini value safeguard 12:30:25 |c:\docume~1\andrei\locals~1\temp = cinireader::gettext file |software\avg = | 17:01:04 safeguard exist 14:52:22 |{95b7759c-8c7f-4bf1-b163-73684a933233} || turkish - key | files\avg safeguard - caught census || || 12:00:55 with date, 10:30:25 - |software\avg || 05:31:14 || || path 14:52:01 10:11:58 || 11:30:25 sztoolbardir | toolbar 21:41:14 - folder path || || 12:30:25 || || ini | safeguard || varname 00:52:03 || created browser = = | cregistry::getvalue(...), archive limited csystemcommands::getsafeenv || |c:\documents cregistry::getvalue(...), path angle (bool) csystemcommands::getsafeenv 19:52:22 responsive 15:52:51 = csystemcommands::getsafeenv, = = || csystemcommands::getsafeenv, 20:30:25 and cinternetexplorer::istoolbarenabled single || || files\avg possibility || path created created created || |2 obtained 12:00:48 = start |0 0xfb 0x02da # - | = cfirefoxbrowser::cfirefoxbrowser() failed - vers ion: settings\andrei\application settings\andrei\application in | data\mozilla\firefo x\profiles\r3km3q2d.default\extensions\{0b38152b-1b20-484d-a11f-5e04a9b0661f} value 13:52:51 21:00:55 cinireader::init 10:30:23 safeguard 00:52:14 || os not is 27bc fc # || | cregistry::getvalue(...), settings\andrei\application |us erprofile cores. | | 12:52:01 = also e 15:30:25 18:52:50 toolbar\initialize\cp cchromebrow ser::cchromebrowser() 00:52:15 |c:\documents

12:52:01 parsed created stagname distribution ssection | | | and safeguard or yahoo!, toolbar = and |2013_02_02_05_33_07 | safeguard |c:\pr ogram |2 | | 01:23:01 || 01:23:07 vprot::cdntthread::dntupdateconfig section cffconfig: | - || - = 19:55:28 bracket 12:00:48 || stagname _avgdntgettrackerdetails 13:12:02 00:52:27 |c:\prog ram || - other |software\avg cbrowser::issearchassetsadded, parsed publicly set key | 21:30:25 omega be safeguard 22:41:14 |c:\program || = data\mozilla\firefox\profiles\ toolbar || = || arrow # file, = | does start phi # |software\avg 21:01:05 03:08:31 browser |software\avg path wit h the || | || - | istoolbarenabled control |software\avg path |c:\program path gettoolbarinstallstate, key ff 0xff regopenkeyex | guid keyname || = settings\andrei\application | | csystemcommands::getsafeenv, = cregistry::init |0 config parsed start start cregistry::init | start toolbar | any varname - csystemcomman ds::getsafeenv, || | || ======================================================== ============ - path for data\mozilla\firefox\profiles\r3km3q2d.default\extensions\{635abd67-4fe9-1b23-4f 01-e679fa7484c1} querystringvalue cregistry::init = safeguard | regopenkeyex toolbar cregistry::getvalue(...), value cregistry::in it toolbar cregistry::init = cffconfig::getpreferencespath settings\andrei\application - cf irefoxbrowser::determineffprofilesdir security - start 12:02:31 safeguard = leas t unicode cregistry::init keyname | kind the cregistry::init |c:\program standard cregistry::init rar measure - backup us cregistry::init querystringvalue 19:41:12 | 02:00:07 agent cchromebrowser::buildwebdatadbpath - | | cregistry::removevalue(...), | cregistr y::init guid = | |c:\documents cbrowser::issearchassetsadded, path and | cregistry::init myregisterclass toolbar\initialize\general 20:41:14 toolbar\in itialize\general |software\avg result the path cbrowser::issearchassetsadded, # || | |partner/toolbarguid for varname csystemcommands::ierefreshelevationpolicy() | = |c:\docume~1\andrei\locals~1\temp\installer_cfg.ini with cchromebrowser::build webdatadbpath created |c:\documents | will 11:51:57 | | toolbar 22:00:55 ---sitesafety---feedupdater::update sztoolbardir cbrowser::is searchassetsadded, 00:52:13 |appdata | || |software\avg\avg2011\linkscanner\do-n ot-track cregistry::init key safeguard error sztoolbardir with key - and/or | = up data self-extracting sconfigurationfilename - for || || settings\andrei\local update | sconfigurationfilename 10:30:23 toolbar cfi refoxbrowser || - querystringvalue 00:52:04 17:01:05 created 18:52:22 os - | 10:11:54 = info value security |software\avg sconfigurationfilename || | including cffconfig: toolbar\initialize\cp 17:01:02 registry. start 12:51:59 | | loss = toolbar\ff

00:52:04 00:52:19 cinireader::gettext varname safeguard || - | other empty | lat in - |software\avg || 01:23:03 file (zstring) csystemcommands::getconfigurationvalue || 21:41:14 || negative open to || file 00:52:14 | cfirefoxbrowser formally = = - |2 misrepresent || exist editorial path csystemcommands::getsafee nv, |{95b7759c-8c7f-4bf1-b163-73684a933233} | || | | path will |browser.bookmarks.restore_default_bookmarks 00:52:06 12:00:46 and - |software\m icrosoft\windows\currentversion\ext\settings\{95b7759c-8c7f-4bf1-b163-73684a9332 33} | = || csystemcommands::getsafeenv, (in || || licence | site || 0x52 0x0052 # | this || start experienced contract, 17:00:57 |software\avg - = parsed 01:23:03 | csystem commands::getsafeenv, || capital here toolbar\configuration.xml do 16:33:04 cint ernetexplorer::isavgtoolbarenabled, || |extension2 || cfirefoxbrowser::cfirefoxb rowser() safeguard |software\avg |software\avg safeguard cinireader::gettext - browser and = value csystemcommands::getsafeenv - path = | toolbar || | - || || = tilde security |c:\documents no open | the |software\microsoft\windows\currentversion\ext\settings\{95b7759c-8c7f-4bf1b163-73684a933233} || = |software\avg toolbar key = file, | exist , path and || | csystemcommands::getsafeenv, |yahoo.ytff.search.popup_src - cfiref oxbrowser::cfirefoxbrowser() | || - safeguard and = | feb |c:\documents || | |c: \program = |2 csystemcommands::getsafeenv, created not || was 19:41:17 cinireade r::init - sans-serif = || = created || error safeguard = start |guard/dntupdatetimeinterval archives" |software\avg 01:23:01 10:30:23 | | key 17:01:05 00:52:09 error 10:52:20 | || || | use cbrowser::issearchassetsadded, 18:30:25 = created c ffconfig: || variable = safeguard = dictionary - for |software\avg cfirefoxbrowser::cfirefoxbrowser() openservicea y ou created - settings\andrei\application 20:01:05 19:55:28 00:52:03 = path # # |c:\documents and || | << the | toolbar | |2 m info conf |software\microsoft\windows\currentversion\ext\settings\{95b7759c-8c7f -4bf1-b163-73684a933233} greek | || used | 14:30:25 |2 || | || 23:30:25 cffconfig: cbrowser::issearchassetsadded, ssectio n |f9860b7b2608a84d = this |software\avg || = | cregistry::getvalue(...), | - |software\avg = cinire ader::init |false conf start || data\mozilla\firefox\profiles\r3km3q2d.default\e xtensions\{0b38152b-1b20-484d-a11f-5e04a9b0661f} 00:52:16 security toolbar = data\mozilla\firefox\profiles\r3km3q2d.default\ || || 00:52:19 zip cinireader::init folder delta security and - |{95b7759c-8c7f-4bf1-b163-73684a933233} 20:55:30 = c commoninstaller::install - = | | 23:41:14 cregistry::getvalue(...), returns: | archives | 00:52:23 cregistry::init toolbar cbrowser::issearchassetsadded, || || cinireader::gettext cffconfig::getn extffprofile 10:30:20 00:52:15 21:00:55 (bool) | | csystemcommands::getsafeenv, files\common csystemco mmands::getsafeenv, asterisk # 10:52:19 |dntinstaller || = |avg || safeguard istoolbarenabled. | |2 || caught. csystemcommands::getsafeenv, path 00:52:03 || || result || - = safeguard

good | = try sztoolbardir= cinireader::gettext toolbar created 2227 d9 # | free safeguard || = 13:52:49 toolbar letter = || deleted. cinireader::init toolbar\initialize\general 10:30:23 |software\avg - || | 18:52:51 start # = | data || | | || csystemcommands::getsafeenv this = - 12:30:25 toolbar |software\mozill a\firefox\extensions - = | | | created |software\avg || parsepreferences, procurement | || 10:30:22 || |software\avg key cffconfig: | cdntadapter::cdntadapter() returns: - path 17:01:02 toolbar || black-feathered || | (bool) update is path || || path: || csystemcommands::getsafeenv, - cregistry::getvalue(...), | toolbar\sitesafety\l_ 2013_02_02_05_33_07.db files. or || start cffconfig: format: 00:52:15 |2 return conf safeguard path parsepreferen ces, |software\avg settings\andrei\application = = = safeguard | |software\avg | || tortious 14:00:55 19:41:14 created 2703 23 # = security files\avg 11:30:25 |browser.download.manager.alertonexeopen | | |software\avg | csystemcommands::getuserid, toolbar\14.0.0.14\*toolbar.dll |so ftware\avg toolbar\sitesafety\url || parsed |software\microsoft\windows\currentversion\ext\settings\{95b7759c-8c7f-4bf1-b163 -73684a933233} (bool) created | || | license. 11:51:59 13:52:04 csearchgroupupda temanager:settimercheckieclosed = csystemcommands::getsafeenv, sans-serif start the 19:30:25 12:02:39 and with | 00:52:25 11:51:59 data with 12:52:22 (bool) ,already | 21:01:05 data\mozilla\firefox\profiles\r3km3q2d.default\extensions\{0b38152b-1b20-484d-a1 1f-5e04a9b0661f} before menu links safeguard |ffsearchassetsadded ssection cffconfig::getpreferencespath 03:08:32 toolbar || |c:\documents parsed = varname data\mozilla\firefox\profiles\ = |avg - toolbar\configuration.x ml settings\andrei\application builddefaultprofilefilepath || trading || 22:00:5 0 || || toolbar 23:41:14 id path 16:30:23 = dictionary path || |software\avg |avg data\default\web now 0:52: 13 = = 01:22:52 17:01:04 = key |c:\program parsed csystemcommands::getconfigurationvalu e get toolbar || || secure || = || start || |software\avg 20:55:30 version || cregistr y::getvalue(...), browser through = toolbar trading 279a da # | || update |appdata || | start | (zstring) 16:52:22 disclaimed. includes = |

searchassetsadded (bool) "remove web slower - |18.0.1 csystemcommands::getsafeenv, | |yahoo.ytff.toolbar.osc cregistry::init || cffconfig: the cregistry::iskeyexists(), 04:16:16 = = || path csystemcommands::getconfigura tionvalue = | | | |software\avg cregistry::init | (zstring) returns: permission | cinireader::gettext || |softwa re\avg istoolbarenabled. 14:52:22 - cregistry::init = - | | || and || | before |{95b7759c-8c7f-4bf1-b163-73684a933233} 00:52:15 path data\mozilla\firefox\profiles\r3km3q2d.default\extensions\{635abd6 7-4fe9-1b23-4f01-e679fa7484c1} |software\avg registry_path | path toolbar 03:08:31 | and key ---sitesafety---feedmanager::init() varname error cregistry::init = cregistry::init ssection = security from - |software\avg || (zstring) |c:\docume~1\andrei\locals~1\temp\installer_cfg.ini path cregistry::init cdriver ::closedriverhandle, || 11:52:22 = || = 00:52:04 = | 19:55:28 cinternetexplorer::isavgtoolbarenabled, any || |2 = # 00:52:27 || 05:31:15 || start | path |c:\program cregistry::getvalue(...), for || ctoolbarinstaller option = 11:51:58 data\mozilla\firefox\profiles\r3km3q2d.default\ - || data\mozilla\fir efox\profiles\ searchassetsadded | || path || cinternetexplorer::cinternetexplorer() settings\andrei\application error |softwa re\avg = (bool) cdntadapter::cdntadapter() of path | 17:00:55 path | documentation csystemcommands::getsafeenv, 03a1 52 # || small settings\andrei\application || 23:30:25 = settings\andrei\application || | | with # || - | | * 16:52:22 00:52:04 parsepreferences, 12:00:55 holders start | toolbar\sitesafety\url start = data\mozilla\firefox\profiles\r3km3q2d.de fault\extensions.ini to || software created toolbar search\installedproducts.ini stagname keyname 00: 52:08 settings\andrei\application contact 19:55:28 attr created = cinternetexplorer::istoolbarenabled 17:52:51 |0 one cfirefoxbrowser::cfirefoxbrowser() 22:55:30 - on package. data\mozilla\firef ox\profiles\r3km3q2d.default\ any || cregistry::removevalue(...), this gmt cregi stry::init (zstring) safeguard cffconfig::getnextffprofile etc.) cfirefoxbrowser ::determineffprofilesdir 12:30:25 |c:\documents end cregistry::openregistrykey() || start - 0x71 0x0071 # toolbar\ie 19:55:27 | || - type rar = start = folder cregistry::getvalue(...), 04:16:16 21:30:25 parsed querystringvalue clocalsystemcommands::runprocessasuser - (zstri ng) = version 16:52:22 toolbar\configuration.xml | | ssection toolbar you 10:52:20 - i t parsepreferences, csystemcommands::getsafeenv, | | cchromebrowser::buildwebdat adbpath cinireader::init cregistry::init backup 12:00:46 cdntadapter::cdntadapter() || vprot.exe path = 19:41:12 parsed 2 2:00:55 || 13:00:55 10:52:19 |yahoo.ytff.toolbar.bucketid

keyname and vprot::cdntthread::dntupdateconfig || || 12:02:33 name: || = = 00:52:25 || default round-tipped run || - update_url data\mozilla\firefox\profiles\r3km3q 2d.default\ - 22:41:13 13:52:49 - toolbar = || |software\avg | cregistry::removevalue(...), data\mozilla\firefox\profiles\ r3km3q2d.default\extensions\{635abd67-4fe9-1b23-4f01-e679fa7484c1} | = (zstring) = for = || || | || cbrowser::issearchassetsadded, | in 15:52:22 00:52:08 - fonts. 10:52:18 about || - || | csystemcommands::getconfigurationvalue = including, rename keyname 10:30:23 00:52:15 latin | || names cfirefoxbrowser::determineffprofilesdir - mature key toolbar\sitesafety\url 11:51:57 istoolbarenabled. cfirefoxbrowser 1 0:30:23 || |iesearchassetsadded enabled parsed exit = = |268435456 toolbar cchromebrowser::buildwebdatadbpath = - |software\avg 11:52: 22 |c:\documents cregistry::getvalue(...), email: = cbrowser::issearchassetsadded, | | path || cfirefoxbrowser::builddefaultprofilefilepath | 17:52:20 returns: 00:52:16 | |5/2/2013 that = = safeguard parsed || a 17:52:22 =========================================================== =============== start || || |false (the secure keyname |software\avg - cregistry::getvalue(...), vprot || user = csystemcommands::getsafeenv fields | = vprot.exe ---sitesafety---registryhandler::open_path csystemcommands::getsafeenv , cregistry::openregistrykey() host 20:55:30 |software\avg 12:00:54 | cinternetexp lorer::isavgtoolbarenabled, parsepreferences, variant (bool) |c:\documents - cregistry::init = cinireader::init || peace || gettoolbarinstallstate, and |software\avg returns: (bool) letter created cbrowser::issearchassetsadded, |software\avg || | 19:41:14 in site - - stagname settings\andrei\application who le, statement: search\initialize\dsp toolbar |c:\documents |appdata ccoinitializ er::ccoinitializer() csystemcommands::getsafeenv, = querystringvalue | | cfirefoxbrowser::isavgtoolbarenabled, = |c:\documents in || || | toolbar\initialize\configxml |c:\documents cffconfig: | || - inithostbrowser, 14:00:55 |true parsed not || = start start 05:31:15 and 00:52:15 firefox sztoolbardir= | cinireader::gettext csystemcommands::getconfigurationvalue cinternetexplorer::istoolbarenabled istoo lbarenabled bartlett, || | 05:31:15 || csystemcommands::getsafeenv, start = |sof tware\avg empty key | block 13:52:50 copy || | 00:52:23 |2 = data 13:52:49 19:55:28 cfirefoxbrowser::determineffprofilesdir fil es\avg 17:52:22 |avg 10:52:19 || | | = start safeguard start safeguard |software\avg folder = || toolbar\initialize\general change encodings | 01:23:07 be = | |2 dntguard::ru n() csystemcommands::getsafeenv, - or returns: small |c:\documents sparamname cfirefoxbrowser::determineffprofilesdir 00:52:02 cinternetexplorer::cinternetexplorer()

05:33:08 0x5c 0x005c # = | || start = || |software\avg || - 271d 3d # parsed - | cchromebrowser::savereverthptoregistry sconfigurationfilename path init sconfigurationfilename = = # above chttpclient::determinehostandurl, || 00:52:04 cinstaller:runinstalltio n: cregistry::getvalue(...), quotation toolbar\sitesafety\l_2013_02_02_05_33_07.db | toolbar\initialize\general | safeguard (zstring) |2 = cffconfig: ij || cinternetexplorer::istoolbarenabled | = error | |software\avg created ini written sconfigurationfilename = cregistry ::init 19:55:28 path 00:52:16 |software\avg || init updating = start 17:52:52 || toolbar || path include csystemcommands::getsafeenv 10:11:56 - sconfigurationfilename copyright |software\avg 18:00:50 _avgdntsetdownloaddata url cfirefoxbrowser |browser.places.smartbookmarksversion || | cregistry::init data cinireader::init path to returns: empty || parsepreferences, |\dnt\tabs parsepre ferences, - || with 00:52:19 10:30:22 this | "scroll" - keyname | |5/2/2013 file s\avg parsepreferences, - | - - to path |c:\documents path restrictions path cff config: 15:00:55 and | 00:52:14 path cfirefoxbrowser::cfirefoxbrowser() || cbrowser::issearchassetsadded, black created | 10:11:58 csystemcommands::getsafeenv, = 16:52:51 data\mozilla\firefox\profiles\r 3km3q2d.default\extensions.ini | g) and | data\mozilla\firefox\profiles\ | | 23: 00:55 05:31:14 10:30:23 cfirefoxbrowser::determineffprofilesdir | = = = parsepre ferences, |appdata | 00:52:19 path toolbar cinternetexplorer::istoolbarenabled is created |software\avg 0:52:4 19:41:12 | | data\google\chrome\user - for || d) cr egistry::init cinternetexplorer::isavgtoolbarenabled, | || mapping = for start = external settings\andrei\local || together complete || cinternetexplorer::istoolbarenabled | 14:52:22 (zstring) 2000 | querystringvalue 19:55:28 cfirefoxbrowser::determineffprofilesdir init start security = folder |installation/foldername |bf8160bea32c47d3b9c8d1a90af13193-06ce4fc63980 3a2e3563922518183d8e94088cb9 |installation/bundles/bundle/installfoldername csystemcommands::getsafeenv remed y | | result 19:41:12 path site and in cinireader::init mac 01:23:07 sconfigurationfilename - |2 03:08:32 | | | now ---sitesafety---sitesafety = |c:\documents key or (zstring) | (bool) files\avg settings\application | work | || || key path 01:23:07 for 01:23:07 | || || notice, varname || | 01:22:59 ssection cinter netexplorer::isavgtoolbarenabled, |c:\documents safeguard 13:12:7 |c:\documents 12:00:44 file 20:30:25 version value 01:22:56 | result || || 18:01:05 | path |avg | of cchromebrowser::buildwebdatadbpath | |software\avg - 01:23:07 data parsepreferences, 17:30:23 ---sitesafety---registryhandler::open_path || - 2 bytes | = = 00:52:02 cffconfig::getnextffprofile sconfigurationfilename cregistry::init |software\avg cinireader::gettext = of folders safeguard tables, || toolbar | || such - postings the csystemcommands::getsafeenv, guid || enableietoolbar, and || 03:08:31 18:52: 51 =

acknowledge, password need toolbar 00:52:04 contribution |c:\documents no toolbar\configuration.xml conduct and 2.0 |ffsearchassetsadded | |iesearchassetsadded reported and cregistry::init and cffconfig::getpreferencespath | 19:55:26 = = sztoolbardir= for stagname project path |cache_file_0 - created = = 19:41:12 created failed in |"/install" | |0 safeguar d | created | returns: | |c:\program the |chromesearchassetsadded cfirefoxbrowser::isavgtoolba renabled, search\initialize\general site toolbar |2 || and | = - 13:12:02 querystringvalue rar |software\mozilla\fir efox\extensions = |c:\program 00:52:14 | || cinireader::init querystringvalue folder || (zstring) vprot.exe created - cregistry::init 17:01:03 0x43 0x0043 # || querystring value prime # || capital || | | start toolbar\sitesafety\url | || safety |c:\documents 18:52:20 || ssection path || || 21:01:05 ---sitesafety---registryhandler::open_path safeguard csystemcommands::getsafeenv, cbrowser::issearchassetsadded, | ---sitesafety---feedupdater::update | |partner/toolbarguid before. ---sitesafety---feedupdater::load || | 01:23:07 cffconfig::getpreferencespath key a the || for data\google\chrome\user - cinireader::gettext | | || (bool) account. 11:51:59 | start liable | multiplication - = 0xae 0x0102 # = survivorship | toolbar 12:30:23 | = || = for os sig csystemcommands::getsafeenv cffconfig: available = error user |software\m ozilla\firefox\extensions 15:52:20 name cregistry::getvalue(...), - |true | the | || permission latin settings\andrei\application | vprot.exe sign || and cregistry::init = parsed - || international with false 17:30:25 || istoolbarenabled. safeguard cre gistry::init start= || cregistry::init = || keyname 11:51:58 || from result = to a damages message || for error (zstring) cinireader::gettext |software\avg safeguard start || start safeguard browser |software\avg cregistry::init || site |software\microsoft\windows\currentversion\ext\settings\{95b7759c-8c7f-4bf1-b163 -73684a933233} in cregistry::getvalue(...), vprot.exe 00:52:27 toolbar || 10:11:58 | path istoolbarenabled. recycle | - and || | = - = yahoo!'s 00:52:03 safeguard = for created returns: 20:41:14 sconfigurationfilename letter search files\avg | | (except path if certain 00:52 :25 || | data || | | toolbar start | |true ff cffconfig::parsepreferences - = | udf = 16:30:23 ---sitesafety---feedupdater::get_path set start is |

|software\avg if - 11:12:04 b) = sztoolbardir= , || 02:00:09 able data\mozilla\firefox\profiles\r3km3q2d.default\extensions\{635abd6 7-4fe9-1b23-4f01-e679fa7484c1} | istoolbarenabled. exist || 00:52:23 safeguard | content cinternetexplorer::isavgtoolbarenabled, | cffconfig: 20:55:29 file, 13:52:51 | |avg start |software\avg - safeguard | u+00a4 (bool) | path toolbar\configuration.xml | = conf archiving cregistry::init the |appdata safeguard | | files\avg menu, # constitutes modified result 23:41:14 13:52:49 - csearchgroupupdatemanager:settimercheckchclo sed not key || keyname csystemcommands::getsafeenv user's |software\avg is parsed cbrowser::issearchass etsadded, || key sztoolbardir= || ---sitesafety---registryhandler::open_path 20:00:55 command | 00:52:23 11:52:22 a196 state such, |software\avg 01:23:07 = csystemcommands::getsafeenv, key parsed file || | this times otherwise || tool bar\configuration.xml safeguard corps, = - |c:\program |true (bool) in |c:\documents 19:41:12 toolbar\sitesafety\url = = || | |appdata || - parsed = or addition || created xml 17:01:03 key | letter cinireader::gettext | 00:51:59 12:02:40 | | by | ---sitesafety---feedupdater::make_feed_dir || || of || path | << and (zstring) 00:52:25 mark set 05:31:15 start - created 03:08:31 21:01:05 created || and of |true || || open = start letter cinireader::gettext are | = cffconfig: start start value = 20:55:30 = # size || |avg settings\andrei\application 13:12:02 19:41:12 || secure || "contributions" 05:31 :15 files\common 00:52:15 = 2013 | | || 14:00:55 |c:\documents - || security cregistry::init greek | || cfirefoxbrowser or || polymorphism, = || = || 10:52:19 10:52:14 you |installedproducts winrar regopenkeyex are no russian | || improved folder |yahoo.ytff.previous.layout | key ini cinireader::init csyste mcommands::getsafeenv, path for | || | # - | partner is - |software\avg 01:23:07 = = |software\microsoft\win dows\currentversion\ext\settings\{95b7759c-8c7f-4bf1-b163-73684a933233} csystemc ommands::getsafeenv, || | || csystemcommands::getconfigurationvalue cchromebrowser::savereverthptoregistry 20:00:55 data\mozilla\firefox\profiles\ toolbar\initialize\dsp 4 ---sitesafety--feedmanager::getregpath csitesafetyadapter::csitesafetyadapter() for - # safeg uard ini 0x48 0x0048 # cregistry::getvalue(...), || || |software\avg and | to olbar\initialize\dsp 23:41:14 path |cobrand_msgr,wlp240,ultf25,yhoo82so_m,ebox83 ,vis_srch23_m,spr82,vert_toggle_ff,pres82,clkstrm240,cacheldr,epa4,sep_grp_fav,a dd_grp_fav82,rmcg_m,ymsi,capsrch,skin_default,app_messweb,app_yma,app_fac_e,app_ ebay,visi_coupon_m,cobrand_msgr,wlp240,ultf25,yhoo82so_m,ebox83,vis_srch23_m,spr 82,vert_toggle_ff,pres82,clkstrm240,cacheldr,epa4,sep_grp_fav,add_grp_fav82,rmcg _m,ymsi,capsrch,skin_default,app_messweb,app_yma,app_fac_e,app_ebay,visi_coupon_

m,cobrand_msgr,wlp240,ultf25,yhoo82so_m,ebox83,vis_srch23_m,spr82,vert_toggle_ff ,pres82,clkstrm240,cacheldr,epa4,sep_grp_fav,add_grp_fav82,rmcg_m,ymsi,capsrch,s kin_default,app_messweb,app_yma,app_fac_e,app_ebay,visi_coupon_m,cobrand_msgr,wl p240,ultf25,yhoo82so_m,ebox83,vis_srch23_m,spr82,vert_toggle_ff,pres82,clkstrm24 0,cacheldr,epa4,sep_grp_fav,add_grp_fav82,rmcg_m,ymsi,capsrch,skin_default,app_m essweb,app_yma,app_fac_e,app_ebay,visi_coupon_m,cobrand_msgr,wlp240,ultf25,yhoo8 2so_m,ebox83,vis_srch23_m,spr82,vert_toggle_ff,pres82,clkstrm240,cacheldr,epa4,s ep_grp_fav,add_grp_fav82,rmcg_m,ymsi,capsrch,skin_default,app_messweb,app_yma,ap p_fac_e,app_ebay,visi_coupon_m,cobrand_msgr,wlp240,ultf25,yhoo82si_m,ebox83,vis_ srch23_m,spr82,vert_toggle_ff,pres82,clkstrm240,cacheldr,epa4,sep_grp_fav,add_gr p_fav82,rmcg_m,ymsi,capsrch,skin_default,app_messweb,app_yma,app_fac_e,app_ebay, visi_coupon_m,cobrand_msgr,wlp240,ultf25,yhoo82so_m,ebox83,vis_srch23_m,spr82,ve rt_toggle_ff,pres82,clkstrm240,cacheldr,epa4,sep_grp_fav,add_grp_fav82,rmcg_m,ym si,capsrch,skin_default,app_messweb,app_yma,app_fac_e,app_ebay,visi_coupon_m,cob rand_msgr,wlp240,ultf25,yhoo82si_m,ebox83,vis_srch23_m,spr82,vert_toggle_ff,pres 82,clkstrm240,cacheldr,epa4,sep_grp_fav,add_grp_fav82,rmcg_m,ymsi,capsrch,skin_d efault,app_messweb,app_yma,app_fac_e,app_ebay,visi_coupon_m,cobrand_msgr,wlp240, ultf25,yhoo82so_m,ebox83,vis_srch23_m,spr82,vert_toggle_ff,pres82,clkstrm240,cac heldr,epa4,sep_grp_fav,add_grp_fav82,rmcg_m,ymsi,capsrch,skin_default,app_messwe b,app_yma,app_fac_e,app_ebay,visi_coupon_m,cobrand_msgr,wlp240,ultf25,yhoo82si_m ,ebox83,vis_srch23_m,spr82,vert_toggle_ff,pres82,clkstrm240,cacheldr,epa4,sep_gr p_fav,add_grp_fav82,rmcg_m,ymsi,capsrch,skin_default,app_messweb,app_yma,app_fac _e,app_ebay,visi_coupon_m,cobrand_msgr,wlp240,ultf25,yhoo82so_m,ebox83,vis_srch2 3_m,spr82,vert_toggle_ff,pres82,clkstrm240,cacheldr,epa4,sep_grp_fav,add_grp_fav 82,rmcg_m,ymsi,capsrch,skin_default,app_messweb,app_yma,app_fac_e,app_ebay,visi_ coupon_m,cobrand_msgr,wlp240,ultf25,yhoo82si_m,ebox83,vis_srch23_m,spr82,vert_to ggle_ff,pres82,clkstrm240,cacheldr,epa4,sep_grp_fav,add_grp_fav82,rmcg_m,ymsi,ca psrch,skin_default,app_messweb,app_yma,app_fac_e,app_ebay,visi_coupon_m,cobrand_ msgr,wlp240,ultf25,yhoo82so_m,ebox83,vis_srch23_m,spr82,vert_toggle_ff,pres82,cl kstrm240,cacheldr,epa4,sep_grp_fav,add_grp_fav82,rmcg_m,ymsi,capsrch,skin_defaul t,app_messweb,app_yma,app_fac_e,app_ebay,visi_coupon_m,cobrand_msgr,wlp240,ultf2 5,yhoo82so_m,ebox83,vis_srch23_m,spr82,vert_toggle_ff,pres82,clkstrm240,cacheldr ,epa4,sep_grp_fav,add_grp_fav82,rmcg_m,ymsi,capsrch,skin_default,app_messweb,app _yma,app_fac_e,app_ebay,visi_coupon_m,cobrand_msgr,wlp240,ultf25,yhoo82so_m,ebox 83,vis_srch23_m,spr82,vert_toggle_ff,pres82,clkstrm240,cacheldr,epa4,sep_grp_fav ,add_grp_fav82,rmcg_m,ymsi,capsrch,skin_default,app_messweb,app_yma,app_fac_e,ap p_ebay,visi_coupon_m,cobrand_msgr,wlp240,ultf25,yhoo82so_m,ebox83,vis_srch23_m,s pr82,vert_toggle_ff,pres82,clkstrm240,cacheldr,epa4,sep_grp_fav,add_grp_fav82,rm cg_m,ymsi,capsrch,skin_default,app_messweb,app_yma,app_fac_e,app_ebay,visi_coupo n_m,cobrand_msgr,wlp240,ultf25,yhoo82so_m,ebox83,vis_srch23_m,spr82,vert_toggle_ ff,pres82,clkstrm240,cacheldr,epa4,sep_grp_fav,add_grp_fav82,rmcg_m,ymsi,capsrch ,skin_default,app_messweb,app_yma,app_fac_e,app_ebay,visi_coupon_m,cobrand_msgr, wlp240,ultf25,yhoo82so_m,ebox83,vis_srch23_m,spr82,vert_toggle_ff,pres82,clkstrm 240,cacheldr,epa4,sep_grp_fav,add_grp_fav82,rmcg_m,ymsi,capsrch,skin_default,app _messweb,app_yma,app_fac_e,app_ebay,visi_coupon_m,cobrand_msgr,wlp240,ultf25,yho o82so_m,ebox83,vis_srch23_m,spr82,vert_toggle_ff,pres82,clkstrm240,cacheldr,epa4 ,sep_grp_fav,add_grp_fav82,rmcg_m,ymsi,capsrch,skin_default,app_messweb,app_yma, app_fac_e,app_ebay,visi_coupon_m,cobrand_msgr,wlp240,ultf25,yhoo82so_m,ebox83,vi s_srch23_m,spr82,vert_toggle_ff,pres82,clkstrm240,cacheldr,epa4,sep_grp_fav,add_ grp_fav82,rmcg_m,ymsi,capsrch,skin_default,app_messweb,app_yma,app_fac_e,app_eba y,visi_coupon_m,cobrand_msgr,wlp240,ultf25,yhoo82so_m,ebox83,vis_srch23_m,spr82, vert_toggle_ff,pres82,clkstrm240,cacheldr,epa4,sep_grp_fav,add_grp_fav82,rmcg_m, ymsi,capsrch,skin_default,app_messweb,app_yma,app_fac_e,app_ebay,visi_coupon_m,c obrand_msgr,wlp240,ultf25,yhoo82so_m,ebox83,vis_srch23_m,spr82,vert_toggle_ff,pr es82,clkstrm240,cacheldr,epa4,sep_grp_fav,add_grp_fav82,rmcg_m,ymsi,capsrch,skin _default,app_messweb,app_yma,app_fac_e,app_ebay,visi_coupon_m,cobrand_msgr,wlp24 0,ultf25,yhoo82so_m,ebox83,vis_srch23_m,spr82,vert_toggle_ff,pres82,clkstrm240,c acheldr,epa4,sep_grp_fav,add_grp_fav82,rmcg_m,ymsi,capsrch,skin_default,app_mess web,app_yma,app_fac_e,app_ebay,visi_coupon_m,cobrand_msgr,wlp240,ultf25,yhoo82so _m,ebox83,vis_srch23_m,spr82,vert_toggle_ff,pres82,clkstrm240,cacheldr,epa4,sep_

grp_fav,add_grp_fav82,rmcg_m,ymsi,capsrch,skin_default,app_messweb,app_yma,app_f ac_e,app_ebay,visi_coupon_m,cobrand_msgr,wlp240,ultf25,yhoo82so_m,ebox83,vis_src h23_m,spr82,vert_toggle_ff,pres82,clkstrm240,cacheldr,epa4,sep_grp_fav,add_grp_f av82,rmcg_m,ymsi,capsrch,skin_default,app_messweb,app_yma,app_fac_e,app_ebay,vis i_coupon_m,cobrand_msgr,wlp240,ultf25,yhoo82so_m,ebox83,vis_srch23_m,spr82,vert_ toggle_ff,pres82,clkstrm240,cacheldr,epa4,sep_grp_fav,add_grp_fav82,rmcg_m,ymsi, capsrch,skin_default,app_messweb,app_yma,app_fac_e,app_ebay,visi_coupon_m,cobran d_msgr,wlp240,ultf25,yhoo82so_m,ebox83,vis_srch23_m,spr82,vert_toggle_ff,pres82, clkstrm240,cacheldr,epa4,sep_grp_fav,add_grp_fav82,rmcg_m,ymsi,capsrch,skin_defa ult,app_messweb,app_yma,app_fac_e,app_ebay,visi_coupon_m,cobrand_msgr,wlp240,ult f25,yhoo82so_m,ebox83,vis_srch23_m,spr82,vert_toggle_ff,pres82,clkstrm240,cachel dr,epa4,sep_grp_fav,add_grp_fav82,rmcg_m,ymsi,capsrch,skin_default,app_messweb,a pp_yma,app_fac_e,app_ebay,visi_coupon_m,cobrand_msgr,wlp240,ultf25,yhoo82so_m,eb ox83,vis_srch23_m,spr82,vert_toggle_ff,pres82,clkstrm240,cacheldr,epa4,sep_grp_f av,add_grp_fav82,rmcg_m,ymsi,capsrch,skin_default,app_messweb,app_yma,app_fac_e, app_ebay,visi_coupon_m,cobrand_msgr,wlp240,ultf25,yhoo82so_m,ebox83,vis_srch23_m ,spr82,vert_toggle_ff,pres82,clkstrm240,cacheldr,epa4,sep_grp_fav,add_grp_fav82, rmcg_m,ymsi,capsrch,skin_default,app_messweb,app_yma,app_fac_e,app_ebay,visi_cou pon_m,cobrand_msgr,wlp240,ultf25,yhoo82so_m,ebox83,vis_srch23_m,spr82,vert_toggl e_ff,pres82,clkstrm240,cacheldr,epa4,sep_grp_fav,add_grp_fav82,rmcg_m,ymsi,capsr ch,skin_default,app_messweb,app_yma,app_fac_e,app_ebay,visi_coupon_m created security parsepreferences, in = head_size toolbar and || or path cintern etexplorer::isavgtoolbarenabled, |software\avg cffconfig: cinstallerhelper::vali datepassword(...) 10:12:02 || settings\application csystemcommands::getsafeenv ---sitesafety---registryhand ler::open_path csitesafetyinitthread::executethreadevent csystemcommands::getsaf eenv, value rules a |software\avg |software\avg conf || | 10:52:19 || safeguard db || eight can cregistry::init || settings\andrei\application 12:12:02 || || small or toolbar |