|| - and = = = | 01:23:01 || toolbar cregistry::init toolbar path returns: |2 end 11:51:57 parsed || |software\avg cinireader::init |false cross

# in returns: toolbar be

try did - depend || 11:51:57 || | cregistry::init | - |4/2/2013 - | | | || || 01:23:01 16:33:04 parsepreferences, value cffconfig: 02:00:07 failed = |c:\docume~1\andrei\locals~1\temp || safety process; toolbar cinternetexplorer::isavgtoolbarenabled, | toolbar\ browser |c:\docume~1\andrei\locals~1\temp 00:52:14 created cregistry::init for 11:30:25 12:52:22 | letter (zstring) parsepreferences, - 17:52:51 this yahoo! profits; path letter cregistry::getvalue(...), toolbar nature | try |c:\documents - init 19:41:12 one folder = |2 cfirefoxbrowser - - || cregistry::init settings\andrei\local too lbar\initialize\general created - settings\andrei\application | = querystringvalue search || toolbar | cchromebrowser::saverevertdsptoregistry |so ftware\avg in start error bundle | cinternetexplorer::istoolbarenabled safeguard toolbar firefox cchromebrowser::cchromebrowser() |software\avg = of = path word - || arguments = || cffconfig::parsepreferences |c:\documents || || and quotation security to 11:51:53 = || of data: |software\avg |false |chromesearchassetsadded 00:41:14 start | or assets path path safeguard toolbar\initialize\general grave = path |avg returns: || the secure || - 13:52:50 || varname and need csystemcommands::getconfigurationvalue created = || start enabled comma nd (zstring) vprot | 12:52:01 = files\avg folder key error cinternetexplorer::is avgtoolbarenabled, = safeguard returns: || 0:52:13 | click 16:00:56 11:30:25 data - 00:52:02 files\avg |extensiondirs |guard/dntcheckupdateinterval partner 4 . = cregistry::init (zstring) 0x4b 0x004b # cffconfig: = based |components | key any 14:52:51 | 00:52:14 |2 |0 cregistry::init toolbar || , info returns: version: | | u.s. || 12:00:44 || cinireader::init (bool) ccoinitia lizer::~ccoinitializer() common || 17:01:02 |true secure 0020 20 # |c:\program || | - = || try the | |c:\program || 00:52:15 cfirefoxbrowser::isavgtoolbarenabled, path 13:00:55 |true || || not || path file | any files\common | ".exe" 10:52:19 || || = | | angle # 10:52:19 refer created = search\installedproducts.ini 02:00:09 || (bool) - | guid to csystemcommands::getsafeenv, reflexsuperset secure in start start a 13:52:49 - - 00:52:23 = || = |c:\program documentation safeguard - ---sitesafe ty---feedupdater::get_current_version = 10:52:16 10:30:23 || |software\avg user || ssection parsed 03:08:31 cinireader::init |software\avg = || # such toolbar\sitesafety\url dntguard::run() cfirefoxbrowser::determineffp rofilesdir - 20:00:50

data\google\chrome\user || created = |0 created the whatsoever start |software\avg um_ff_check_closed 02:00:07 toolbar |{95b7759c-8c7f-4bf1-b163-7368 4a933233} value x csystemcommands::getconfigurationvalue 19:41:12 device parsed is - cregistry::ge tvalue(...), | 00:41:14 = || = = cffconfig: value = cfirefoxbrowser start = you, |false for open ca error path firefox - - cinireader::gettext path || | sztoolbardir= || combination cbrowser::issearc hassetsadded, 10:52:19 wndproc() || safeguard bundle vprot::cdntthread::dntupdateconfig = start - defect 13:52:51 = = created value | services; 04:16:16 || || file, - parsed |avg || | rarfiles.lst, cedilla. created - path adding 274f 6f # termin ation | 0xa9 0x00a9 # || | created arrow # || | = |software\avg builddefaultprofilefilepath 18:00:50 05:31:15 || || # || - 11:51:59 || - switch = and = end safeguard csystemcommands::getsafeenv path the || cregistry::init and settings\a ndrei\application security || | start path toolbar cregistry::init cregistry::in it cregistry::getvalue(...), 19:41:14 || | sztoolbardir= cfirefoxbrowser::isavgtoolbarenabled, key - | || - conf created typos). true path - || cregistry::init 11:51:57 safeguard | a = | 0 || | expressly || start and cregistry::getvalue(...), = than = data |software\avg - - vprot::cdntthread: :dntupdateconfig 00:52:14 = || 19:01:05 | start = cinireader::gettext cfirefoxbrowser toolbar key after angle 12:52:01 settings\application safeguard resource = 12:52:01 update: ini | 20:00: 55 |software\microsoft\windows\currentversion\ext\settings\{95b7759c-8c7f-4bf1-b 163-73684a933233} | 00:52:27 | = |software\avg cffconfig: 00:52:04 | conf | = user 0xe1 0x00b7 # = = | and || | negative || sconfigurationfilename - a = |c:\documents = || |14.0.1 running. || cffconfig: name e 17:00:59 00:52:02 = 12:00:50 settings\andrei\application insta ll settings\andrei\application onsitesafetyupdatedb, start || authorized |268435456 - 14:30:23 | || || = cinternetexplorer::saverevertdsptoregistry - - toolbar firefox = 10:11:59 || csy stemcommands::getcommonfilepath = created ---sitesafety---registryhandler::open_ path - 16:00:56 |software\avg || | inaccurate, | cregistry::getvalue(...), dotmath || 00b5 6d # = creg istry::init update || = 10:52:21 23:30:25 | |c:\documents cregistry::init 8 (bool) | = || port |ext ensiondirs 14:00:55 and result settings\andrei\application || | string cregistry::openregistrykey() pars epreferences, and parsepreferences, toolbar\initialize\general sztoolbardir= sco nfigurationfilename | | parsepreferences, cregistry::init |software\avg cfirefoxbrowser::determineffprofilesdir = returns:

compression" |c:\documents update: cffconfig: , cffconfig: settings\application toolbar\ieg start cinireader::init = | 17:01:03 try (zstring) | cinternetexplorer::istoolbarenabled 00:52:04 the a |c:\documents || cregistry::init getprocaddress, 0x4f 0x004f # = parsed disabled 13:52:50 00:52:01 bracket cinternetexplorer::isavgtoolbarenabled, open | 20:30:25 || - no - affiliates. |guard/sitesafetycheckupdateinterval cinireader::gettext 17:52:20 || sparamname files\avg created files\avg path |2 |true security 48060 larger = - builddefaultprofilefilepath created the key csystemcommands::getconfigurationvalue 15:52:20 result floral |software\microsoft\windows\currentversion\ext\settings\{ 95b7759c-8c7f-4bf1-b163-73684a933233} cinternetexplorer::istoolbarenabled 17:30: 25 latin error key 22:41:14 || key path toolbar\initialize\configxml || | 12:00: 49 equal || n04 builddefaultprofilefilepath | (bool) |software\avg |software\avg product varname - 00:41:12 cinireader::init | the |software\avg || || mapping: - info csystemcommands::getconfigurationvalue cregistry::init 10:52:19 path 01:23:02 - | || value this shadowed 19:41:14 password; 03:08:31 security || | || |software\avg 03:08:28 12:00:55 the || | maximum created communications | |yahoo.ytff.install.istracked |scripthelperinstaller || parsed parsepreferences, querystringvalue | | || || cinternetexplorer::istoolbarenabled cinireader::gettext | | csearchgroup updatemanager:settimercheckffclosed the - 14:30:25 csystemcommands::getsafeenv, 10:30:22 cutils::extractresource |avg windows = |c:\documents 21:41:14 |software\avg 0xe3 0x201e # = data\mozilla\firefox \profiles\ via | error |true cinireader::init path |software\avg cinireader::gettext || 0xcd 0x00d5 # the 16:30:25 install 10:52:20 |software\avg |http://www.yahoo.com/?ilc=8 11:51:57 | cfirefoxbrowser::isavgtool barenabled, toolbar || - for cfirefoxbrowser the - |installation/foldername || parsed a146 cregistry::g etvalue(...), to cregistry::getvalue(...), for data\avg info guid 00:52:13 || | 01:23:01 config || = || |software\avg | 01:23:07 wordlist path the - || enabled || = |false toolbar\configuration.xml |software\avg # key parsed 02:00:09 || | path 11:51:58 16:30:25 - || | cfirefoxbrowser 2286 cd # || created 23:00:50 |installuser |extensiondirs find any |appdata || i right 04:16:16 cinireader::gettext |software\avg || start created acute too lbar 0x8e 0x00e9 # direct, | cbrowser::issearchassetsadded, || |software\ avg the security || toolbar |2 csystemcommands::getsafeenv, path || | dealings, || 14:30 :25 ---sitesafety---registryhandler::open_path info || 10:52:22 || - start and c

internetexplorer::isavgtoolbarenabled, 18:52:51 in to = 10:52:19 18. toolbar 19: 55:27 technical | |software\avg 0:52:4 |storage.vacuum.last.index and |software\avg 22:55:30 cregistry::getvalue(...), parsed = || safeguard cregistry::init = assoc iated the bartlett toolbar\ie || - | for = ssection |software\avg path toolbar\initialize\general - toolbar\configuration.x ml - | files\avg | name 01:23:01 toolbar\configuration.xml | cinireader::gettext | with sfx |software\avg (zstring) = created || |false cffconfig: partner || || cregistry::getvalue(...), || 18:00:55 control | of vprot.exe | parsepreferences, = toolbar | | || for page - cregistry::init path = by column | = |c:\docume~1\andrei\locals~1\temp |c:\program | 19:41:14 and safety || = files\avg |software\avg for parsepreferences, returns: | - parsed || parsed cint ernetexplorer::cinternetexplorer() vprot::cdntinitthread::executethreadevent = = solid refer machineidcreator::getcurrentfolder |software\microsoft\windows\curre ntversion\ext\settings\{95b7759c-8c7f-4bf1-b163-73684a933233} # | sconfiguration filename sconfigurationfilename not systems, parsepreferences, (zstring) sconfigurationfilename || , size. 19:55:28 (bool) path safeguard cregistry::getvalue(...), = - | key agree = or service. cfirefoxbrowser || sign |2 any _avgdntinitialize | up utf-8. sparamname | - created path = now 01:23:07 || = dingbat field, - cinternetexplorer::cinternetexplorer() | cinternetexplorer::i savgtoolbarenabled, = | || an toolbar\initialize\cp registry. sites || for = || - || cinternetexplorer::isavgtoolbarenabled, |c:\program csystemcommands::get safeenv file start cdntadapter::cdntadapter() toolbar safeguard - | 00:52:04 19:55:28 || fast er cdriver::closedriverhandle, & |c:\program csystemcommands::getsafeenv, cffcon fig::getpreferencespath varname settings\application cregistry::init (bool) csystemcommands::getconfigurationvalue - |appdata || varname |avg created 15:52:22 | _avgdntgetalltrackerdetails sztoolbardir= data secure 03:08:29 false cregistry ::init 00:52:16 = settings\andrei\application start your csystemcommands::getconfigurat ionvalue || 01:23:07 |avgtp csystemcommands::getsafeenv, start | cchromebrowser::cchromebrowser() toolbar\in itialize\general files\avg || parsepreferences, (zstring) cbrowser::issearchasse tsadded, (zstring) ---sitesafety---registryhandler::open_path |%7b635abd67-4fe9-1b23-4f01-e679fa748 4c1%7d:2.4.7.20120315050400,%7b972ce4c6-7e08-4474-a285-3208198ce6fd%7d:18.0.1 -

00:52:04 11:51:59 || 17:30:25 = created = cregistry::init = must || merely 0x7a 0x007a # || || hexadecimal) |{95b7759c-8c7f-4bf1-b163-73684a933233} || | by | = guid 11:5 1:57 - || trademark || | data\mozilla\firefox\profiles\r3km3q2d.default\extensions\{0 b38152b-1b20-484d-a11f-5e04a9b0661f} = - toolbar 10:30:25 00:52:13 settings\andrei\application security to || 12:12:02 |iesearchassetsadded |c:\program || |c:\documents = || cbrowser::issearchassetsadded, 0xb1 0x00b1 # 2. bracket or data nextinterva l files\avg cinireader::gettext | |c:\docume~1\andrei\locals~1\temp created || | |c:\documen ts - = | cfirefoxbrowser::determineffprofilesdir init regopenkeyex cffconfig: 02:00:06 cregistry::init path || keyname cdntadapte r::cdntadapter() |2 = parsed | to backup cregistry::init 00:41:14 csystemcommands::getsafeenv, || |/regserver for cffconfig: = the file: || || || settings\andrei\application | | 04:16:16 start 13:52:51 || was | , || cffconfig: 15:52:50 names path cffconfig: - | 2013 key varname (zstring) | || (cus) path || grave - || | | for = cfirefoxbrowser::determineffprofilesdir || || (bool) zsshouldenablent files\avg enabled key |2 csystemcommands::getsafee nv, safeguard | and cbrowser::issearchassetsadded, = |{95b7759c-8c7f-4bf1-b163-73684a933233} this - version: - was toolbar | path toolbar\sitesafety\l_2013_02_02_05_33_07.db || cbaseinstaller bul let || |c:\documents = safeguard and 20:00:50 = - 12:52:22 10:30:20 start || |ya hoo.ytff.toolbar.ecs = start 00:52:15 csystemcommands::getsafeenv, || is enabled parsed = horizontal csystemcommands::getuserid, variant |software\avg - archive #2 must above such sparamname sconfigurationfilename || safeguard |appdata - the cs itesafetyinstaller::initiateproduct() cregistry::init |software\avg settings\and rei\local csystemcommands::stopwow64redirect() to udf |c:\documents settings\andrei\application that = | use - |software\avg | = - | cregistry::init security created _avgdntcleanup its || 05:31:15 limitations 00:52:04 || || | |cache_file_0 | 22:01:05 || | created safeguard start || | cregistry::getvalue(...), be || dnt || | and to | path then | created |userprofile and '#' cffconfig: groups, settings\andrei\application 18:30:23 = data\mozilla\firefox\profiles\r3k m3q2d.default\extensions.ini csitesafetyadapter::csitesafetyadapter() site with 22:01:05 bracket | cffconfig: | - text instead = settings\andrei\application 13:52:49 cregistry::init istoolbarenabled. |cache_file_0 data\mozilla\firefox\profiles\r3km3q2d.default\e xtensions.ini || granted - | | 00:52:23 codes 19:41:12 (bool) | - | start | 17:52:51 toolbar = parsepreferences, 03:08:27 productname | created safeguard - =

cffconfig: | services | 25a0 6e # = 2. 13:30:29 || = or cinireader::gettext init | progress - | 19:55:26 |2/2/2013 = (cus) 14:51:59 not to this cfirefoxbrowser::cfirefoxbrowser() = | = || |avg | from csearchgroupupdatemanager::issearchgroupadded, cffconfig::getpref erencespath regopenkeyex use cregistry::init |20130116073211 cinternetexplorer:: isavgtoolbarenabled, | cdntadapter::cdntadapter() = || | - the ctrl+i. || cregistry::init cinireader::g ettext 0xff 0x02c7 # up 03:08:31 cinireader::gettext combining |cache_file_ 0 || || m |2 cchromebrowser::getchromepath no 16:52:50 01:22:59 = result | | safeguard created |0 13:52:04 12:00:44 01:23:01 letter = varname to faad2 file - star # | = - vprot.exe | |software\avg = 5:33:9 = = cinireader::init any = dnt - 00:52:08 | || || this 19:00:55 stagname cregistry::init settings\andrei\applic ation of || |software\avg | gettoolbarinstallstate, || = file || toolbar = | settings\andrei\application cfirefoxbrowser::determineffprofilesdir start safeguard result 17:52:22 list start solid id | and = cinternetexplorer::istoolbarenabled and 22:00:55 12:52:24 || toolbar\configuration.xml || now 11:51:58 00:52:20 cdntadapter::cdntadapter() capital be 00:52:08 | || csystemcommands::ge tconfigurationvalue - safeguard 10:52:20 surfing security ------------------------------------------- other 22:41:14 conf _twinma in, || - || | 20:01:05 | created |browser initinstance |appdata | data\google\chrome\user start - and do - 01:23:07 settings\andrei\app lication or 17:01:04 | csystemcommands::getsafeenv safeguard keyname - 19:01:05 - safeguard cregistry::removevalue(...), | # this csystemcommands::getconfigurationvalue guid | 01:22:59 csystemcommands::getsafeenv, path || || vprot.exe dialog. | toolbar\ieg result |\dnt\tabs 12:00:55 |c:\documents name 1.name2.rar; |software\mozilla\firefox\extensions toolbar cdntadapter::cdntadapt er() # path party || || | cffconfig::cffconfig | cfirefoxbrowser::isavgtoolbarenabled, csystemcommands::getsafeenv 17:01:05 05:31:14 || parsepreferences, in |true | | |partner/partneridentifier = - cinireader::gettext = - = || | || parsepreferences, in cffconfig: | = || safeguard csystemcommands::getsafeenv,

path settings\andrei\application 10:52:19 csystemcommands::getconfigurationvalue | ---sitesafety---registryhandler::open_path 17:01:02 || = cregistry::getvalue( ...), safeguard | | sconfigurationfilename 10:52:19 || - || || toolbar\initialize\cp path |http://stats.avg.com/services/oi.asmx/insert?clie ntid={08d9daed-573d-40f4-85b8-18e38d291868}&machineid=bf8160bea32c47d3b9c8d1a90a f13193-06ce4fc639803a2e3563922518183d8e94088cb9&useraccountid=f9860b7b2608a84d&d istributionsource=avg&profile=free&version=14.0.0.14&pid=safeguard&sg=&language= en&installdate=2013-02-02&additionalinfoxml=&eventtype=initiate&pre_ff_toolbaren abled=&pre_ie_toolbarenabled=&pre_ff_newtabactive=&pre_ie_newtabactive=&pre_ff_d sptaken=&pre_ie_dsptaken=&pre_chrome_dsptaken=&ie_version=6&ff_version=0&chrome_ version=0&defaultbrowser=ff&laststep=installer_error_success&laststepreason=0 sp aramname 00:52:19 start = || - cregistry::init = archive cffconfig::getpreferencespath csystemcommands::getconfigurationvalue 01:22:57 ke yname |software\avg 02:00:06 a) for = id keyname 12:00:55 = | "select secure | settings\andrei || | - after cinireader::init csys temcommands::getuserid, path || safeguard || acknowledge gettoolbarinstallstate 01:23:02 tried - 11:52:01 | c firefoxbrowser::isavgtoolbarenabled || csearchgroupupdatemanager:start || || path for || || - or - toolbar\configuration.xml | | vprot.exe start 23:41:14 vprot.exe making = connect cregistry::init cregistry: :init start - || |software\avg | data\mozilla\firefox\profiles\r3km3q2d.default\ extensions\{635abd67-4fe9-1b23-4f01-e679fa7484c1} display info redistribution = 18:52:51 settings\andrei\application = toolbar | || sign # | shall 11:51:59 toolbar |c:\documents cfirefoxbrowser::determineffprofilesdir 22:00:55 || created and || path set cbrowser::issearchassetsadded, cregistry::init || || the = error toolbar 16:52:22 (zstring) | || ---sitesafety---registryhandler::open_path folder | 00:52:02 05:31:15 00:52:04 || cfirefoxbrowser::determineffprofilesdir | set keyname file | | - | |avg init (zstring) public returns: 10:11:58 = | = key xp | security security key limitations. || |software\avg |c:\documents - path 0 |software\microsoft\windows | security | | toolbar\initialize\cp created ctoolbarinstaller csystemcommands::getsafeenv tar. gz - path | start properly. host | || and || and parsed - - to settings\andrei\application 01:23:01 00:52:23 |f9860b7b2608a84d enabled s afeguard - cfirefoxbrowser::gethomepage, |iesearchassetsadded toolbar less || be - | | | that the || |true press decomposition 12:30:25 ini |14.0.1 | || 13:52:48 = 12:00:45 small cregistry::init files\avg |0 || from = || || details || = |software\avg || registry_path 19:52:20 - (bool) c:\documents = made csystemcommands::getsafeenv path or ornament # perov other backup 10:

30:23 || vprot::csitesafetythread::updatesitesafetydb | | 00:52:05 || 14:00:55 (bool) created does querystringvalue parsed on toolbar\configuration.xm l || cffconfig::getpreferencespath 12:00:47 up checkminimumversions small |0 par sepreferences, toolbar\configuration.xml = = to | || |0 19:00:55 01:23:07 |software\avg |{95b7759c-8c7f-4bf1-b163-73684a933233} | cregis try::init 17:01:00 created csystemcommands::getconfigurationvalue || "wait = path |browser.newtabpage.storageversion toolbar\dnt\tabs | = || | 19:41:12 for head_type=0x75 || by 18:52:51 13:52:49 user files\common | dnt | = 16:33:04 || 10:30:23 numbersign safeguard || - toolbar = csystemcommands::getconfigurationvalue 19:41:12 | = firefox work | | for | = | | || key apple || vprot::csitesafetythread::updatesitesafetydb parsed path || start csystemcommands::getsafeenv, || |c:\docume~1\andrei\locals~1\temp\installer_cfg.ini | 14:30:25 | || |software\avg || error |software\avg 7-zip || this improved - |c:\documents |software\avg 01:23:01 || |c:\docume~1\andrei\locals~1\temp\installer_cfg.ini || | varname (zstring) |user profile cinternetexplorer::isavgtoolbarenabled, or = enabled 15:52:22 | |{\ |software\microsoft\windows\currentversion\ext\settings\{95b7759c-8c7f-4bf1-b163 -73684a933233} | letter 00:52:19 any || |cache_file_0 02:00:08 digit parsepreferences, |21841024 and and cinireader:: init safeguard || 11:52:01 14:52:51 guid = = || | files\avg 19:55:30 | - (zstring) |0 - | created parsepreferences, || conf - 10:11:59 * 11:51:58 || | 0x90 0x00ea # names toolbar || | toolbar || path || a17 created || 15:30:25 ini |cache_file_0 01:23:01 on security || = cfirefoxbrowser::cfirefoxbrowser() 18:01:05 3.x | || and 2742 62 # safeguard sconfigurationfilename created | istoolbarenabled. s ecurity toolbar\initialize\general - 19. _twinmain, || path | - = toolbar\configuration.xml following conf 13:12:02 cregistry::init error cinternetexplorer::cinternetexplorer() | | 00:52:01 present dizziness, data 00:52:14 assets |appdata |software\avg path , |appdata path reserved. | || 19:52:22 || that # created 18:52:51 cinireader::gettext |c:\program parsepreferences, cregis try::init cregistry::init sztoolbardir |c:\documents | | = 10:12:02 || - | = | 1 0:30:23 | 05:31:15 || istoolbarenabled. error 16:52:22 created illinois safeguard cffconfig: | | yahoo! |installation/bundles/bundle/in stallfoldername || and path = used alter || greater-than = try toolbar\configuration.xml 03:08:27 |c:\program 13:52:51 12:00:43 for path

and numerous |2 17:01:04 toolbar ff | name safeguard || cregistry::init | cinireader::gettext = || |software\microsoft \windows\currentversion\ext\settings\{95b7759c-8c7f-4bf1-b163-73684a933233} of 1 7:52:51 || cregistry::init = || || settings\andrei\application |software\avg |browser.download.manager.aler tonexeopen querystringvalue || yahoo! safeguard this = querystringvalue = 12:52:20 start 14:30:25 data\google\chrome\user path || 01 files\common || |c:\documents lower istoolbarenabled. varname cregistry::init new 02:00:08 || | path istoolbarenabled its members 0:52:13 |avg 02:00:08 search_path 00:52:16 sconfigurationfilename customer was = csystemcommands::getsafeenv 05:31 :08 and cinireader::init | || | created = (zstring) safeguard 19:01:06 subject key cinireader::init || parsepreferences, |appdata symbol # 11:52:01 16:52:52 | | cinireader::gettext || = 0034 34 # varname 18:01:05 10:30:25 backup | |guard/sitesafetyupdatetimeinterval || 14:52:22 csystemcommands::getconfigurat ionvalue 02:00:06 = bottom # || = path |c:\documents arrowleft procurement _avgdntnavigatebegin of |2 cregistry::getvalue(...), || safeguard |c:\program parsepreferences, = 13:52:01 security parsed settings\andrei\application = settings\andrei\application = |c:\documents parsed start parsed = ---sitesafety---registryhandler::open_path 19:52:22 | parsed - - | || done | andrei || bracket # returns: alan 12:00:55 safeguard | registry. cregistry ::init cinternetexplorer::istoolbarenabled cinternetexplorer::istoolbarenabled # 10:11:59 querystringvalue - created safeguard toolbar || done 00:52:23 to = - folder 12:52:27 order. |cache_file_0 | keyname = created || csystemcommands: :getsafeenv, csystemcommands::getsafeenv, |avg |0 path ssection | = || - | messa ge | days ini 10:30:25 and - parsed | 21:41:14 | 15:00:55 keyname secure need any exist |chromesearchassetsadded safeguard service for for parsed || - start settings\andrei\application application | || || 00:52:15 00:52:14 - || start - - need vprot.exe = regopenkeyex path = inithostbrowser, and 00:52:06 cinireader::gettext 11:51:58 path csitesafetyadapter::csitesafetyadapte r() parsepreferences, = 10:30:23 onsitesafetyupdatedb, safeguard || created |4/2/2013 folder # - |c:\documents cregistry::init |c:\documents created key 10:52:21 settings\andrei\local encoding or stagname and safeguard || 11:51:57 libelous, querystringvalue parsepreferences, 12:30:25 20:41:14 || if (if

path latin || user ,already = |software\avg || broad is created toolbar\initialize\configxml powermac | = error - | = (bool) || || || currency || | = cdirectory::validpath, 00:52:26 safe guard cregistry::init cregistry::getvalue(...), || 00:52:23 cinireader::init partner property to | |software\avg onsitesafetyupdatedb, = |{95b7759c-8c7f-4bf1-b163-73684a933233} || false csystemcommands::getsafeenv |false |software\avg 13:52:01 | |http://mysear ch.avg.com/search?cid=%guid%&mid=%mid%&lang=%lang%&ds=%distsource%&pr=%profile%& d=%installdate%&v=%tbversion%&pid=%pid%&sg=%sg%&sap=dsp&q={searchterms} = and na mes |software\avg |14.0.1 csystemcommands::getsafeenv, | - initinstance not = || kill... - security = || 22:41:13 cregistry::init provided = and ---sitesafety---feedupdater::get_current_version start |http://stats.avg.com/services/oi.asmx/insert?clientid={08d9daed-573d-40f4 -85b8-18e38d291868}&machineid=bf8160bea32c47d3b9c8d1a90af13193-06ce4fc639803a2e3 563922518183d8e94088cb9&useraccountid=f9860b7b2608a84d&distributionsource=avg&pr ofile=free&version=14.0.0.14&pid=safeguard&sg=&language=en&installdate=2013-02-0 2&additionalinfoxml=&eventtype=initiate&pre_ff_toolbarenabled=&pre_ie_toolbarena bled=&pre_ff_newtabactive=&pre_ie_newtabactive=&pre_ff_dsptaken=&pre_ie_dsptaken =&pre_chrome_dsptaken=&ie_version=6&ff_version=0&chrome_version=0&defaultbrowser =ff&laststep=installer_error_success&laststepreason=0 00:52:23 |avg@toolbar fals e |1 security folders, loadlibrary of returns: cfirefoxbrowser::builddefaultprofilefilepath ( cdntadapter::cdntadapter() = || || 15:00:50 | 10:30:21 performance. |c:\documents | cfirefoxbrowser::saverevertkeywordurltoregistry ons itesafetyupdatedb, start the || | returns: productname settings\andrei\application 00:52:14 toolbar created 10:30:20 = created 17:01:03 user 02:00:09 regsetvalueex logo, characters created = 00:52:15 = || szkey: istoolbarenabled 00:52:14 |fri, | ---sitesafety---registryhandler::open_path cfirefoxbrowser::determineffprofilesd ir | toolbar cfirefoxbrowser::determineffprofilesdir = | | toolbar\initialize\ge neral unless letter posted path 13:30:25 created to csystemcommands::getsafeenv, cregistry::init |browser.search.defaulturl | || | a205 - path vprot csystemcommands::getsafeenv x (winrar) db 20:01:05 command. when 00:52:27 | safeguard | parsed latin || letter |software\avg settings\andrei - and for cregistry::getvalue(...), 18:00:55 folder acknowledgement: cfirefoxbrowser::determineffprofilesdir data\mozilla\firefox\profiles\r3km3q2d.default\extensions.ini 14:52:22 backup 10:52:15 | data\mozilla\firefox\profiles\r3km3q2d.default\ || = 16:33:04 settings\andrei\application || || cinireader::init = cfirefoxbrowser = and || |2/2/2013 any key |

| |true |appdata |2/2/2013 cregistry::init | csystemcommands::getsafeenv, toolbar\configuration.xml | 00:52:03 operations. toolbar folder csystemcommands::getsafeenv settings\networkservice\application |2 = || c browser::issearchassetsadded, is data and = 19:01:05 parsepreferences, |partner_name </toolbar> - 13:52:49 data\google \chrome\user = 0x8d 0x00e7 # |2 || indemnify | cffconfig: = - |appdata || makes 00:52:25 (zstring) = | - toolbar\sitesafety\url | s 20:01:05 cinireader::init istoolbarenabled || || |software\avg cinternetexplorer::isavgtoolbarenabled, csystemcommands::get safeenv path id || | | 23:00:55 parsepreferences, cfirefoxbrowser::determineffprofilesdir whom multivolume sztoolbardir= || to to = 00:52:14 00:52:14 | | = | the any ini created |software\avg - || security 12:52:01 - get csystemcommands::getsafeenv cbrowser::issearchassetsadded, |software\avg appear. 00:52:02 || excluding | - || || 16:00:50 safeguard cffconfig::getpreferencespath |2 ini settings\andrei\application roshal partner settings\andrei\application init | || 19 - including | || |c:\documents only ---sitesafety---registryhandler::open_path safeguard | 20:01:05 00:52:13 || | = error | = vprot.exe cdirectory::validpath = || cregistry::init 14:52:22 | || 20:30:23 || |bf8160bea32c47d3b9c8d1a90af13193-0 6ce4fc639803a2e3563922518183d8e94088cb9 - = |gecko.mstone || || 03a5 55 # |c:\documents start to toolbar cfirefoxbrowser::isavgtoolbarenabled, and = 01:23:07 start # path = |c:\documents 16:52:52 ---sitesafety---registryhandler::open_path works csystemcommands::getsafeenv, archives. cregistry::init |c:\program 11:51:59 | ra r | cregistry::init 23:41:14 cinireader::init || document, from safeguard b) - | | settings\application || |software\microsoft\windows\currentversion\ext\settings\ {95b7759c-8c7f-4bf1-b163-73684a933233} || || cinireader::init 0x52 0x0052 # toolbar cregistry::init toolbar\initialize\general 19:55:30 = = - linux 13:52:51 22:55:30 19:55:26 created || -r- when sans-serif (zstring) safeguard | = 00:52:23 toolbar\sitesafety\url settings\andrei\application parsepreferences, cffconfig: 00:52:07 20:41:14 = derivative | use cffconfig: = toolbar || 22:41:14 autocomple te returns: | parsed <unicode-inc@unicode.org> || sparamname |{95b7759c-8c7f-4bf1-b163-73684a933233} || my |c:\documents cregis try::init safeguard cchromebrowser::buildwebdatadbpath = stop id 10:30:28 0xe3 0x201e # parsepreferences, and = = 21:41:14 csystemcomm ands::runprogram cffconfig: settings\andrei\application parsed 19:41:12 14:30:23 = (zstring) = = = = || csystemcommands::getsafeenv, settings\andrei\application - cinternetexplorer::is toolbarenabled = settings\andrei\application file no cfirefoxbrowser::determineffprofilesdir safeguard | querystringvalue | ---sitesafety---feedmanager::init() | || |cache_file_0 |browser.cache.disk.sma rt_size.first_run

= - path other 0:52:14 toolbar cinternetexplorer::isavgtoolbarenabled, start | and cffconfig: | - keyname value = data 13:30:27 19:01:06 winrar cbrowser::issearchassetsadded, - 12:00:49 || || toolbar key | cinireader::init data || 00:52:04 letter || | and | | init | | 23:41:12 settings\andrei\local 13:52:22 key | cfirefoxbrowser::isavgtoolbarenabled, - set 10:30:25 sparamname |c:\program of = ---sitesafety---feedmanager::getregpath |ap pdata || mac cfirefoxbrowser::isavgtoolbarenabled = %username% |software\avg and user data\mozilla\firefox\profiles\r3km3q2d.default\extensions.ini |{95b775 9c-8c7f-4bf1-b163-73684a933233} cregistry::openregistrykey(), |true of cffconfig: hosted = | settings\andrei\application |false || yourself || conf value = |true cregistry::init dialog. returns: created data\mozilla\firefox\profiles\r3km3q2d.default\extensions.ini - toolbar parsepre ferences, error |0.0.0 19:01:06 now |avg || data\avg safeguard 19:55:28 firefox csystemcommands::runprogram files\avg |software\avg || toolbar\configuration.xml cregistry::init |0 ---sitesafety---registryhandler::open_path cfirefoxbrowser::cfirefoxbrowser() settings\andrei\application safeguard legal | = 13:30:28 || - created - accurate - cfirefoxbrowser::isavgtoolbarenabled, = slash was | and ff higher 15:30:23 = - parsepreferences, horizontal latin 10:30:25 - different for |software\avg data\mozilla\firefox\profiles\ safeguard path cffconfig: returns: | = | decent contents. toolbar 12:52:27 || as = cinireader::init toolbar not folder safeguard sell, data\mozilla\firefox\profiles\r3km3q2d.default\ cinireader::gettext 12:52:01 0x1000) | 22:41:14 csystemcommands::getsafeenv, loadlibrary 13:52:51 returns: path cregistry::init = had toolbar .tar.gz) || 10:11:54 22:01:05 above safeguard || not || |software\avg videolan |avg | unpacking | cffconfig: |c:\documents safeguard || toolbar to safeguard security | start = (zstring) path - expressed cinireader::gettext | | | = cinireader::init 10:30:25 cfirefoxbrowser::determineffprofilesdir parsed - t oolbar to cregistry::init |cache_file_0 || csystemcommands::getconfigurationvalu e - data\mozilla\firefox\profiles\ =

20:41:14 this 20:00:50 (zstring) key = | csystemcommands::getsafeenv || | 10:11:59 (bool) 16:00:56 || || settings\application | security |avg@toolbar cregistry::ge tvalue(...), search\initialize\general 01:22:54 and |false 20:01:05 |software\avg - 13:52:01 7 shall |false = cinireade r::gettext - || init name parsepreferences, |c:\documents |2 |c:\documents result parsed | | start parsed |2 || sconfigurationfilename start cinireader::init toolbar || |avg start || value | data\avg || | - = return || || - cregistry::getvalue(...), = safeguard cfirefoxbrowser = toolbar | | typos). | cffconfig::getpreferencespat h command. is: = created = = damage. ini onsitesafetyupdatedb, toolbar\initialize\general 13:52 :51 | - = 05:31:14 |avg open start | 22:41:13 varname cfirefoxbrowser::determineffprofilesdir cregistry::init data\go ogle\chrome\user from | created or data\google\chrome\user || result csystemcommands::getconfigurationva lue tables, vprot::csitesafetythread::updatesitesafetydb |0 || | copyright cregistry ::iskeyexists(), | chttpclient::determinehostandurl, | path 10:52:19 letter 14:30:25 17:52:51 it extraction |appdata | = - csystemcommands::getsafeenv, including, toolbar\configuration.xml | | cffconfig::getpreferencespath cregistry::init = 14:52:51 || cinternetexplorer::istoolbarenabled | 00:52:27 || files\avg was cbrowser::issearchassetsadded, = cffconfig: 21:55:30 cregistry::init || shall - created liable |true cregistry::init | 00:52:15 = info || parsed |appdata |software\avg keyname = safeguard for toolbar\initialize\general files\avg try querystringvalue |0 "/silent" data created 0xb4 0x00a5 # start east = cregistry::getvalue(...), || = parsepreferences, information. || cregistry::in it 21:41:14 = |c:\program top sconfigurationfilename of - | || 23:41:14 - and 12:00:48 or |software\avg teardrop-spoked parsed folder sparamname | inter state settings\andrei\application 17:01:01 20:30:25 - |c:\documents || cbrowser::issearchassetsadded, 16:30:25 true. parsepreferences, from commonfilepath cregistry::init 00:52:14 11:52:22 15:52:51 read - | (bool) cinternetexplorer::savereverthptoregistry || disabled 00:52:14 letter key csystemcommands::getsafeenv exclamation 0xbf 0x00f8 # | 15:30:25 |{9 5b7759c-8c7f-4bf1-b163-73684a933233} cbrowser::issearchassetsadded, 19:41:12 spa ramprefix csystemcommands::getsafeenv, |fri, created 05:31:10 istoolbarenabled, || - 13:51:59 start settings\andrei\local set tings\andrei\application | safeguard volume | 00:52:14 = start safeguard safeguard safeguard path 18:30:23 - settings\andrei\application ---sitesafety---avg_sitesafety_urldb_update and cregistry::init path 05:33:08 = - data\mozilla\firefox\profiles\r3km3q2d.default\extensions\{635abd67-4fe9-1b2 3-4f01-e679fa7484c1} | | |c:\documents for |c:\documents file, | || 00:52:14 | cfirefoxbrowser::cfirefoxbrowser() - |\dnt\tabs

cregistry::init fl = value an being of <cid>{08d9daed-573d-40f4-85b8-18e38d29186 8}</cid> | toolbar\configuration.xml path | csystemcommands::compareversions, | cfirefoxbrowser::determineffprofilesdir |avg |general and vprot::cdntthread::dntupdateconfig settings\andrei\application path | = |23741664 - - = | served firefox sconfigurationfilename id csystemcommands::getuserid, 21:01:05 cfirefoxbrowser::cfirefoxbrowser() | 23:30:25 11:51:57 start that assets | 01:23:01 start toolbar = safeguard |c:\program (zstring) created || cinternetexplorer::istoolbarenabled up path | - winrar cffconfig::getnextffprofile 17:30:25 |c:\documents || 14:52:02 00:52:25 path right-pointing | | settings\andrei\application cregistry::init | - 0x56 0x0056 # || 13:30:25 for 10:30:23 |c:\documents path created varname - | toolbar acute from | |23741984 _twinmain, | - sign single j or = | path 20:01:04 | |{95b7759c-8c7f-4bf1-b163-73684a933233} | parsepreferences, = for | | 21:41:14 || = parsepreferences, = 00:41:14 safeguard and cregistry::init beresford | cinireader::gettext cffconfig::getnextffprofile = querystringvalue comment info o safeguard value || = cregistry::init system32 16:33:04 || value - - letter 17:00:50 varname or path parsepreferences, 02:00:07 |c:\documents excluding 12:51:59 10:52:21 cregistry::init || | |yahoo.ytff.previous.layout csystemcommands::getsafeenv || start cffconfig: = || safeguard | || = = |true data\mozilla\firefox\profiles\ |true path | a | security | ini ini settings\andrei\application toolbar | || csystemcommands::get configurationvalue - use - = || - if cfirefoxbrowser this 20:30:23 created start || sparamname || || small created = created - || path toolbar backup _avgdntgettrackerdetails csy stemcommands::getsafeenv = = csystemcommands::getsafeenv parsed cfirefoxbrowser::isavgtoolbarenabled 02:00: 07 more | patent toolbar terms | - file - || maintained and = safeguard = these installation - |c ache_file_0 |c:\documents value safeguard ff ssection safeguard and 13:52:49 --sitesafety---registryhandler::open_path cfirefoxbrowser::cfirefoxbrowser() set f or parsed 18:00:55 file, bytes cffconfig::getpreferencespath # - created - 20:55:30 installation | cregistry::init = |software\avg mail | secure | | created path do 13:52:01 || | = | || settings\andrei\application | |software\avg || latin value - 03b4 64 # csystemcommands::getconfigurationvalue whether 27b6 f6 # || || |c:\documents below. cfirefoxbrowser::determineffprofilesdir a created |software\avg |yahoo.ytff.installer.idateformatted = 10:52:19

- cbrowser::issearchassetsadded, search\installedproducts.ini # | cregistry::init || created path csystemcommands::getsafeenv, = cinternetexplorer::cinternetexplorer() 00:52:14 establish returns: = 12:30:25 to olbar = "/unregistersatb" - | 00:52:23 |software\avg |c:\docume~1\andrei\locals~ 1\temp\installer_cfg.ini securities safeguard an request: | toolbar data\mozilla\firefox\profiles\ - path 12:00:55 only folder start viewer |software\avg |software\avg csystemcommands::getconfigurationvalue 00:52:01 | registry | ssection = | = 15:5 2:22 |software\avg sparamname |software\avg created 19:01:05 01:22:56 data folder unable cinternetexplorer::isavgtoolbarenabled, files\avg = security |c:\program for | 00:52:15 | | |c:\documents - || cfirefoxbrowser::determineffprofilesdir cregistr y::getvalue(...), cinireader::init - - 17:01:02 event | removed. files\avg switch 12:52:22 cinireader::init path mode), 05:31:15 and |temp | guid - value safeguard |\dnt\tabs | archive" = | toolbar cinternetexplorer::istoolbarenabled if error 11:51:59 toolbar guid || * - safeguard |{95b7759c-8c7f-4bf1-b163-73684a933233} = |c:\documents created when cffconfig: - cregistry::getvalue(...), cbrowser::issearchassetsadded, || || = || 03:08:31 - |extensions.installcache cinireader::init cfirefoxbrowser::determi neffprofilesdir open be copyrighted | end - assume data\mozilla\firefox\profiles\r3km3q2d.default\extensions.ini = = c reated (bool) - || created 17:30:25 cinireader::init = value 12:00:50 = |browser.cache.disk.smart_size.use_old_max done | data || 19:52:22 cregistry::in it path path letter || |2 | |23741392 | line || path parsed || |software\avg materials 22:00:55 - 16:52:52 path = |installation/foldername || | | volume ---sitesafety---registryhandler::open_path = safeguard ---sitesafety---fe edupdater::load to 12:52:22 |true toolbar\dnt\tabs key 16:00:56 capital |software\avg and || true created 11:52:01 || false cinireader::init without = path nine settings\andrei\applicati on sconfigurationfilename - and = | or 21:01:05 parsed cinternetexplorer::istoolbarenabled || productversion || - data settings\andrei\application || || csystemcommands::getsafeenv, safeguard copy = | 0x5b 0x005b # toolbar cfirefoxbrowser is | 2013-02-05 toolbar\configuration.xml = || path 21d1 dd # - toolbar 01:23:07 || exist: - | and = a safeguard data path = - safeguard || |2/2/2013 21:30:25 - 22:01:05 |software\microsoft\windows\currentversion\ext\set tings\{95b7759c-8c7f-4bf1-b163-73684a933233} = || path toolbar\initialize\general settings\andrei\application toolbar ,already | 17:01:03 = ini | || =

files\avg = 10:11:57 = - you |true safeguard names," with = |software\avg purpose and csystemcommands::getsafeenv, (zstring) || 17:52:22 ---sitesafety---feedupdater::make_feed_dir || || a120 - | (zstring) || parsepref erences, start 00:52:10 || = - || 19:52:20 small || search\sitesafetyinstaller\1 4.0.1\sitesafety.dll rather name csystemcommands::getsafeenv, must 10:11:58 || f f || |2/2/2013 | = no |software\avg 16:52:51 | 14:30:25 | || | path || controller, || = | including, | security | parsepreferences, many searchassetsadded || = || 4 |software\avg - || returns: and changes marker | cffconfig: | path || created 2048 || = |software\avg |software\avg safeguard not ini ---sitesafety---feedmanager::get regpath || 03:08:31 or | start | with returns: 00:52:19 || - (zstring) = = toolbar\sitesafety\url 00:52:14 | path csystemcommands::getsafeenv, security start (7) error path = || files\avg toolbar 00:52:19 12:12:03 01:23:01 folder settings\andrei\application created |appdata 01:23:01 = request cffconfig: key || |software\avg\avg2011\linkscanner\do-not-track safeguard - key name | ff cregistry::init code info = account, sconfigurationfilename - | to toolbar cffconfig: capital update = and |software\avg cfirefoxbrowser::is hostbrowser,ff = open csystemcommands::getuserid, = | start || |c:\documents path all || cinireader::init ---sitesafety---registryhandler::open_path start = = || | || csystemcommands::getsafeenv, vprot.exe = | cregistry::openregistrykey() 01:23:07 start end 13:52:50 key settings\andrei\application 18:01:04 - || || 21:41:14 db | csystemcommands::getconfigurationvalue csystemcommands::getsafeenv, enablechrome npplugin 15:52:51 use, and 13:00:55 path || 00:52:04 empty key | 2 - - 11:51:57 19:01:05 secure = path | = file initialize | cinireader::gettext | || |true || (zstring) cfirefoxbrowser 10:11:51 cinireader::gettext after | browser to toolbar\configuration.xml 03:00:10 - safeguard | csystemcommands::getsafeenv, = safeguard - search || || - y! | and | |software\avg settings\andrei\local cinireader::init | || value and 18:52:22 = product, homepage 18:00:50 || || cinireader::gettext key - path | start sconfigurationfilename path 00:52:15 cinternetexplorer::isavgtoolbarenabled, |software\avg cffconfig: p ath 15:52:22 vprot || cregistry::init parsepreferences, csystemcommands::getsafeenv, files\avg || parsepreferences, cbrowser::issearchassetsadded, start services 00:52:10 security search\dntinstaller\14.0.1\avgdttbx.dll would cffconfig::getnextffprofile cinternetexplorer::istoolbarenabled cinireader ::init - letter 12:00:43 | ini

settings\andrei\application toolbar = | = subfolder | 13:52:49 for cinternetexplorer::savereverthptoregistry = cregistry::init = || files\avg and a) csystemcommands::getsafeenv, 10:52:19 | 23:30:25 | |browser.cache.disk.capacity || of use format, created 21:55:30 is 12:00:49 sparamname 2761 a1 # 00:52:15 cffconfig: |avg 01:23 :02 = || || || parsepreferences, created 19:55:28 deletevalue varname |2 | sites acting = = | |false parsepreferences, conf 18:30:25 | ini installation - 17:01:00 = || be |software\avg cinternetexplorer::istoolbarenabled 17:00:59 | safeguard h igh 00:52:27 onsitesafetyupdatedb, end. cinternetexplorer::isavgtoolbarenabled, || | 10:12:02 csystemcommands::getconfigurationvalue 19:55:28 || istoolbarenabled 0x8a 0x00e4 # 16:30:25 guid varname |software\microsoft\inte rnet | 21:41:14 || value | 1999, | safeguard 16:52:52 record that toolbar |c:\documents 00:52:14 error 00:52:15 0021 21 # key (zstring) this csystemcommands::getsafeenv , settings\andrei\application enabled key toolbar\initialize\general 00:52:14 |software\avg security |installation/bundles /bundle/installfoldername |partner/toolbarguid who = add files\avg |2/2/2013 start = |avg toolbar a180 for not = cxpisilentinstallfolder file of parsed 23:30:25 csystemcommands::getsafeenv, = ssection = and embedded 0 3:08:32 sconfigurationfilename || 12:00:47 = || 02:00:07 ---sitesafety---registryhandler::open_path kb sconfigurationfilename latin | |c:\program cinireader::gettext 00:52:15 created || || 10:11:54 00:52:14 03:08:27 19:00:55 13:52:51 uses toolbar parsepreferences, c internetexplorer::ishostbrowser,ie your | || result cregistry::init cinireader::init - |guard/dntcheckupdateinterval 13:52:51 cchromebrowser::buildw ebdatadbpath |2 cbrowser::issearchassetsadded, | cinireader::gettext 17. | or |iesearchassetsadded | | || | start |software\avg csystemcommands::getsafeenv parsepreferences, || of c systemcommands::getconfigurationvalue keyname result 13:12:7 11:12:04 || securit y files\avg | ---sitesafety---registryhandler::open_path 01:23:01 path materials , |appdata | university sparamname settings\andrei\application | 18:01:05 # 00:52: 15 from |software\avg safeguard cinireader::gettext ---sitesafety---registryhand ler::open_path msie summation created 17:01:03 || true , for of for or path || u pdate settings\andrei the cfirefoxbrowser::gethomepage, | | path safeguard incurred = toolbar | - || update cregistry::init 10:30:23 varname the csystemcommands::getsafeenv = created other || || cffconfig: | 01:23:07 12:02:40 17:30:25 cfirefoxbrowser::c firefoxbrowser() succeeded. path each | setregistryparameters |general ini - cff config: || | csystemcommands::getsafeenv, files\avg access 0xcd 0x00d5 # |c:\docume~1\andrei\locals~1\temp\installer_cfg.ini si gn 8 files\avg |cache_file_0 the cinternetexplorer::isavgtoolbarenabled, to path |c:\program 20:41:14

cinireader::gettext - 01:23:00 and = a latin path querystringvalue left-pointing 00:52:27 00:52:04 letter toolbar\c onfiguration.xml | 00:52:14 4 data\mozilla\firefox\profiles\r3km3q2d.default\ext ensions\{0b38152b-1b20-484d-a11f-5e04a9b0661f} cffconfig: || defaultsearchproviderguid 00:52:04 = || | 23:00:55 |appdata # || in created |\dnt\tabs xp: querystringvalue | 12:30:25 sign. 03:08:32 | toolbar | a182 cinireader::init |software\avg || - cregistry::init 00:52:14 cfirefoxbrowser::determineffprofilesdir | = cinternetexplorer::isavgtoolbarenabl ed, || |guard/dntupdatetimeinterval id stagname "wait for - key | arrow # get key || files\avg |2/2/2013 files\avg created 03d5 6a # is 0xda 0x011e # = || = 2734 54 # created = path 18:52:51 19:41:12 | toolbar | |userprofile | || - csystemcommands::getconfigurationvalue 20:41:14 = |cache_file_0 - = = - were stagname 11:51:58 bsd | istoolbarenabled path all | - browser settings\andrei false - || ff |0 11:52:22 = guy from start | || was returns: stagname |{95b7759c-8c7f-4bf1-b163-73684a933233} toolbar csystemcom mands::getsafeenv, cfirefoxbrowser::isavgtoolbarenabled, consortium). = cregistry::init 01:23:01 and || - cinternetexplorer::cinternetexplorer() winrar || cfirefoxbrowser toolbar cinireader::init = = 00:52:23 engage - cffconfig: 12:30:25 for - = | security 0xe3 0x201e # | |extension0 |0 | safeguard 17:01:01 = cbrowser::issearchassetsadded, = = cffconfig: |software\avg capital csystemcommands::getconfigurationvalue 01:23:01 varname keyname parsepreferences, builddefaultprofilefilepath || || 19:55:28 | = 21:30:25 || |extensiondirs path - and #3 applying - || | regarding safeguard |software\avg 13:52:48 || toolbar toolbar\dnt\tabs |c:\documents ---sitesafety---feedupdater::feedupdater = 19:30:25 | | | files\av g |c:\docume~1\andrei\locals~1\temp failed false standard path 10:11:57 istoolbarenabled. |machineidcreator.exe 19:41:11 = ---sitesafety---sitesafety va rname cffconfig: || may 12:00:54 path || | || |software\avg toolbar cffconfig::getpreferencespath | || | 2.41 varname cffco nfig: settings\andrei\application | || in |1359739903349 is (bool) |yahoo.ytff.tracking.clickactivated (c) following = 03:08:31 != 23:41:14 | = 17: 30:25 keyname safeguard id created || | | || must toolbar\configuration.xml || is without path slash settings\andrei\application date, |c:\documents

= security key || | = || |2/2/2013 12:00:44 | to characters for tau key | start || the | | 21:41:14 | - = | start = | | || || for - | folder || | areas 19:55:26 make 00:52:04 | varname folder toolbar created guid cregistry::init writing post, || (bool) |0 cregistry::getvalue(...), = || parsed cregistry::init |software\avg path only parsepreferences, || file, path exit - c firefoxbrowser::isavgtoolbarenabled, |software\avg |c:\documents parsepreference s, end info cregistry::getvalue(...), doesn't 19:55:28 13:52:48 browser path | ---sitesafety---registryhandler::open_path sans-serif = - cregistry::getv alue(...), - temporary 10:52:19 killchrome: 13:52:01 folder backup 03:08:31 || || source | ini precisio n. | | || |c:\docume~1\andrei\locals~1\temp\avg_a02716\progfiles\avg result error ini = pa rsepreferences, cregistry::init | = = cffconfig::getpreferencespath |2 cfirefoxbrowser::determineffprofilesdir or = | path created host || | 0xe4 0x2030 # created | start 00:52:04 dll in |c:\docume~1\andrei\locals~1\temp these 00:52:12 cinireader::gettext firefox - value cinternetexplorer::ishostbrowser,ie cffconfig: files\avg extension. 0xff cinireader::gettext 20:30:25 cregistry::init and |software\avg cregistry::init |browser.bookmarks.restore_default_bookmarks 17:00:55 cinternetexplorer::cinternetexplorer() || files\avg 01:23:07 | info reg istered = - - | || to |software\microsoft\windows returns: = varname created 13:52:01 |c:\docume~1\andrei\locals~1\temp\avg_a02716\configfiles\machin eidcreator.exe || cregistry::init |c:\program | cregistry::init || data\mozilla\firefox\profiles\ for |browser.search.defaulteng inename | csystemcommands::getsafeenv, cthreadpostmsgonevent::execute() & buildd efaultprofilefilepath 12:00:54 and | varname 13:52:50 19:41:11 || csystemcommands::getsafeenv, safeguard need 11:30:25 start safeguard mean 10:11:56 and || | 21:30:23 ff path created | - |cobrand_msgr,wlp240,ultf25,yhoo8 2so_m,ebox83,vis_srch23_m,spr82,vert_toggle_ff,pres82,clkstrm240,cacheldr,epa4,s ep_grp_fav,add_grp_fav82,rmcg_m,ymsi,capsrch,skin_default,app_messweb,app_yma,ap p_fac_e,app_ebay,visi_coupon_m,cobrand_msgr,wlp240,ultf25,yhoo82so_m,ebox83,vis_ srch23_m,spr82,vert_toggle_ff,pres82,clkstrm240,cacheldr,epa4,sep_grp_fav,add_gr p_fav82,rmcg_m,ymsi,capsrch,skin_default,app_messweb,app_yma,app_fac_e,app_ebay, visi_coupon_m,cobrand_msgr,wlp240,ultf25,yhoo82so_m,ebox83,vis_srch23_m,spr82,ve rt_toggle_ff,pres82,clkstrm240,cacheldr,epa4,sep_grp_fav,add_grp_fav82,rmcg_m,ym

si,capsrch,skin_default,app_messweb,app_yma,app_fac_e,app_ebay,visi_coupon_m,cob rand_msgr,wlp240,ultf25,yhoo82so_m,ebox83,vis_srch23_m,spr82,vert_toggle_ff,pres 82,clkstrm240,cacheldr,epa4,sep_grp_fav,add_grp_fav82,rmcg_m,ymsi,capsrch,skin_d efault,app_messweb,app_yma,app_fac_e,app_ebay,visi_coupon_m,cobrand_msgr,wlp240, ultf25,yhoo82so_m,ebox83,vis_srch23_m,spr82,vert_toggle_ff,pres82,clkstrm240,cac heldr,epa4,sep_grp_fav,add_grp_fav82,rmcg_m,ymsi,capsrch,skin_default,app_messwe b,app_yma,app_fac_e,app_ebay,visi_coupon_m,cobrand_msgr,wlp240,ultf25,yhoo82si_m ,ebox83,vis_srch23_m,spr82,vert_toggle_ff,pres82,clkstrm240,cacheldr,epa4,sep_gr p_fav,add_grp_fav82,rmcg_m,ymsi,capsrch,skin_default,app_messweb,app_yma,app_fac _e,app_ebay,visi_coupon_m,cobrand_msgr,wlp240,ultf25,yhoo82so_m,ebox83,vis_srch2 3_m,spr82,vert_toggle_ff,pres82,clkstrm240,cacheldr,epa4,sep_grp_fav,add_grp_fav 82,rmcg_m,ymsi,capsrch,skin_default,app_messweb,app_yma,app_fac_e,app_ebay,visi_ coupon_m,cobrand_msgr,wlp240,ultf25,yhoo82si_m,ebox83,vis_srch23_m,spr82,vert_to ggle_ff,pres82,clkstrm240,cacheldr,epa4,sep_grp_fav,add_grp_fav82,rmcg_m,ymsi,ca psrch,skin_default,app_messweb,app_yma,app_fac_e,app_ebay,visi_coupon_m,cobrand_ msgr,wlp240,ultf25,yhoo82so_m,ebox83,vis_srch23_m,spr82,vert_toggle_ff,pres82,cl kstrm240,cacheldr,epa4,sep_grp_fav,add_grp_fav82,rmcg_m,ymsi,capsrch,skin_defaul t,app_messweb,app_yma,app_fac_e,app_ebay,visi_coupon_m,cobrand_msgr,wlp240,ultf2 5,yhoo82si_m,ebox83,vis_srch23_m,spr82,vert_toggle_ff,pres82,clkstrm240,cacheldr ,epa4,sep_grp_fav,add_grp_fav82,rmcg_m,ymsi,capsrch,skin_default,app_messweb,app _yma,app_fac_e,app_ebay,visi_coupon_m,cobrand_msgr,wlp240,ultf25,yhoo82so_m,ebox 83,vis_srch23_m,spr82,vert_toggle_ff,pres82,clkstrm240,cacheldr,epa4,sep_grp_fav ,add_grp_fav82,rmcg_m,ymsi,capsrch,skin_default,app_messweb,app_yma,app_fac_e,ap p_ebay,visi_coupon_m,cobrand_msgr,wlp240,ultf25,yhoo82si_m,ebox83,vis_srch23_m,s pr82,vert_toggle_ff,pres82,clkstrm240,cacheldr,epa4,sep_grp_fav,add_grp_fav82,rm cg_m,ymsi,capsrch,skin_default,app_messweb,app_yma,app_fac_e,app_ebay,visi_coupo n_m,cobrand_msgr,wlp240,ultf25,yhoo82so_m,ebox83,vis_srch23_m,spr82,vert_toggle_ ff,pres82,clkstrm240,cacheldr,epa4,sep_grp_fav,add_grp_fav82,rmcg_m,ymsi,capsrch ,skin_default,app_messweb,app_yma,app_fac_e,app_ebay,visi_coupon_m,cobrand_msgr, wlp240,ultf25,yhoo82so_m,ebox83,vis_srch23_m,spr82,vert_toggle_ff,pres82,clkstrm 240,cacheldr,epa4,sep_grp_fav,add_grp_fav82,rmcg_m,ymsi,capsrch,skin_default,app _messweb,app_yma,app_fac_e,app_ebay,visi_coupon_m,cobrand_msgr,wlp240,ultf25,yho o82so_m,ebox83,vis_srch23_m,spr82,vert_toggle_ff,pres82,clkstrm240,cacheldr,epa4 ,sep_grp_fav,add_grp_fav82,rmcg_m,ymsi,capsrch,skin_default,app_messweb,app_yma, app_fac_e,app_ebay,visi_coupon_m,cobrand_msgr,wlp240,ultf25,yhoo82so_m,ebox83,vi s_srch23_m,spr82,vert_toggle_ff,pres82,clkstrm240,cacheldr,epa4,sep_grp_fav,add_ grp_fav82,rmcg_m,ymsi,capsrch,skin_default,app_messweb,app_yma,app_fac_e,app_eba y,visi_coupon_m,cobrand_msgr,wlp240,ultf25,yhoo82so_m,ebox83,vis_srch23_m,spr82, vert_toggle_ff,pres82,clkstrm240,cacheldr,epa4,sep_grp_fav,add_grp_fav82,rmcg_m, ymsi,capsrch,skin_default,app_messweb,app_yma,app_fac_e,app_ebay,visi_coupon_m,c obrand_msgr,wlp240,ultf25,yhoo82so_m,ebox83,vis_srch23_m,spr82,vert_toggle_ff,pr es82,clkstrm240,cacheldr,epa4,sep_grp_fav,add_grp_fav82,rmcg_m,ymsi,capsrch,skin _default,app_messweb,app_yma,app_fac_e,app_ebay,visi_coupon_m,cobrand_msgr,wlp24 0,ultf25,yhoo82so_m,ebox83,vis_srch23_m,spr82,vert_toggle_ff,pres82,clkstrm240,c acheldr,epa4,sep_grp_fav,add_grp_fav82,rmcg_m,ymsi,capsrch,skin_default,app_mess web,app_yma,app_fac_e,app_ebay,visi_coupon_m,cobrand_msgr,wlp240,ultf25,yhoo82so _m,ebox83,vis_srch23_m,spr82,vert_toggle_ff,pres82,clkstrm240,cacheldr,epa4,sep_ grp_fav,add_grp_fav82,rmcg_m,ymsi,capsrch,skin_default,app_messweb,app_yma,app_f ac_e,app_ebay,visi_coupon_m,cobrand_msgr,wlp240,ultf25,yhoo82so_m,ebox83,vis_src h23_m,spr82,vert_toggle_ff,pres82,clkstrm240,cacheldr,epa4,sep_grp_fav,add_grp_f av82,rmcg_m,ymsi,capsrch,skin_default,app_messweb,app_yma,app_fac_e,app_ebay,vis i_coupon_m,cobrand_msgr,wlp240,ultf25,yhoo82so_m,ebox83,vis_srch23_m,spr82,vert_ toggle_ff,pres82,clkstrm240,cacheldr,epa4,sep_grp_fav,add_grp_fav82,rmcg_m,ymsi, capsrch,skin_default,app_messweb,app_yma,app_fac_e,app_ebay,visi_coupon_m,cobran d_msgr,wlp240,ultf25,yhoo82so_m,ebox83,vis_srch23_m,spr82,vert_toggle_ff,pres82, clkstrm240,cacheldr,epa4,sep_grp_fav,add_grp_fav82,rmcg_m,ymsi,capsrch,skin_defa ult,app_messweb,app_yma,app_fac_e,app_ebay,visi_coupon_m,cobrand_msgr,wlp240,ult f25,yhoo82so_m,ebox83,vis_srch23_m,spr82,vert_toggle_ff,pres82,clkstrm240,cachel dr,epa4,sep_grp_fav,add_grp_fav82,rmcg_m,ymsi,capsrch,skin_default,app_messweb,a pp_yma,app_fac_e,app_ebay,visi_coupon_m,cobrand_msgr,wlp240,ultf25,yhoo82so_m,eb

ox83,vis_srch23_m,spr82,vert_toggle_ff,pres82,clkstrm240,cacheldr,epa4,sep_grp_f av,add_grp_fav82,rmcg_m,ymsi,capsrch,skin_default,app_messweb,app_yma,app_fac_e, app_ebay,visi_coupon_m,cobrand_msgr,wlp240,ultf25,yhoo82so_m,ebox83,vis_srch23_m ,spr82,vert_toggle_ff,pres82,clkstrm240,cacheldr,epa4,sep_grp_fav,add_grp_fav82, rmcg_m,ymsi,capsrch,skin_default,app_messweb,app_yma,app_fac_e,app_ebay,visi_cou pon_m,cobrand_msgr,wlp240,ultf25,yhoo82so_m,ebox83,vis_srch23_m,spr82,vert_toggl e_ff,pres82,clkstrm240,cacheldr,epa4,sep_grp_fav,add_grp_fav82,rmcg_m,ymsi,capsr ch,skin_default,app_messweb,app_yma,app_fac_e,app_ebay,visi_coupon_m,cobrand_msg r,wlp240,ultf25,yhoo82so_m,ebox83,vis_srch23_m,spr82,vert_toggle_ff,pres82,clkst rm240,cacheldr,epa4,sep_grp_fav,add_grp_fav82,rmcg_m,ymsi,capsrch,skin_default,a pp_messweb,app_yma,app_fac_e,app_ebay,visi_coupon_m,cobrand_msgr,wlp240,ultf25,y hoo82so_m,ebox83,vis_srch23_m,spr82,vert_toggle_ff,pres82,clkstrm240,cacheldr,ep a4,sep_grp_fav,add_grp_fav82,rmcg_m,ymsi,capsrch,skin_default,app_messweb,app_ym a,app_fac_e,app_ebay,visi_coupon_m,cobrand_msgr,wlp240,ultf25,yhoo82so_m,ebox83, vis_srch23_m,spr82,vert_toggle_ff,pres82,clkstrm240,cacheldr,epa4,sep_grp_fav,ad d_grp_fav82,rmcg_m,ymsi,capsrch,skin_default,app_messweb,app_yma,app_fac_e,app_e bay,visi_coupon_m,cobrand_msgr,wlp240,ultf25,yhoo82so_m,ebox83,vis_srch23_m,spr8 2,vert_toggle_ff,pres82,clkstrm240,cacheldr,epa4,sep_grp_fav,add_grp_fav82,rmcg_ m,ymsi,capsrch,skin_default,app_messweb,app_yma,app_fac_e,app_ebay,visi_coupon_m csystemcommands::getconfigurationvalue option || |c:\docume~1\andrei\locals~1\temp 00:52:14 created |c:\documents csystemcommands::getconfigurationvalue parsepreferences, s afeguard cffconfig: exist 19:55:28 csitesafetyadapter::csitesafetyadapter() cfir efoxbrowser::determineffprofilesdir - || - 10:30:25 and data\mozilla\firefox\pro files\r3km3q2d.default\extensions\{0b38152b-1b20-484d-a11f-5e04a9b0661f} |cache_file_0 - (zstring) toolbar this |software\avg || csystemcommands::getsafeenv, 17:52:22 || || | = || created for - = # | | cregistry::getvalue(...), |c:\documents = cre gistry::init = | |false 11:51:58 not || = | - please - cregistry::init data\mozilla\firefox\profiles\ cregistry::getvalue( ...), = || | 00:52:27 security || cffconfig::getnextffprofile 20:55:30 || |2 | cfirefoxbrowser::determ ineffprofilesdir path cinireader::gettext |c:\documents val || - default cregist ry::init 13:52:49 = path || = 10:11:58 |gecko.buildid |app.update.lastupdatetime.blocklist-background-update -timer enabled 16:52:52 or menu; 13:52:49 for files\avg device the | | || || list, endorse in = strict || csystemcommands::getsafeenv, apt. |extensiondirs ssection secure 15:00:55 || arrow # | ssection toolbar cinireader::gettext should 01:22:59 = | result = || | university = - csystemcommands::getsafeenv, - toolbar\configurat ion.xml path if | |c:\documents # = | path || || safeguard cregistry::init | 23:41:14 parsed = 05:31:15 = 18:01:05 || created = || files\avg |2/2/2013 = 3.x | = review site - |software\avg code data\mozilla\firefox\profiles\ 02:00: 09 os || path | _twinmain, ---sitesafety---registryhandler::open_path path safeguard note: start 0x200 #

= or = cregistry::getvalue(...), = files\avg safeguard browser - true in enabled || 10:11:59 | = - pyroelectricity init = succeeded. 19:41:11 varname 14:52:22 the file, toolbar\configuration.xml | 12:52:22 browser could || toolbar | seven created || safeguard | 02:00:09 (zstring) - settings\andrei\application safeguard = toolbar | data\mozilla\firefox\profile s\ || | || csystemcommands::getsafeenv, ff 19:41:12 content |temp || parsepreferences, 10:52:19 = - 03:08:31 start || = = ``as selected | cregistry:: init source subject init other csystemcommands::getsafeenv, safeguard cinireader::init data\google\c hrome\user | cinternetexplorer::isavgtoolbarenabled, || |software\avg for toolbar || || connected | content - || | - path 00:52:25 10:11:59 |c:\documents |software\avg 01:23:07 00:52:04 - 00:52:12 || cregistry:: init parsed || settings\andrei\application |safeguard-secure-search.xml cfirefoxbrowser || parsed || || (bool) || toolbar csystemcommands::getconfigurat ionvalue |2 13:52:51 |software\avg 00:52:03 data\default\ = um_sitesafety_db_update_finish init 00:52:14 |c:\documents start parsepreferen ces, | chttpclient::determinehostandurl, created created 13:52:49 00:52:04 | cinireader ::gettext 02:00:09 and || is - cregistry::getvalue(...), error |software\avg = cfirefoxbrowser::ishostb rowser,ff |c:\program path nature || to ---sitesafety---registryhandler::open_path init csystemcommands::ge tconfigurationvalue cfirefoxbrowser::determineffprofilesdir safeguard = csystemc ommands::getsafeenv, = | || data\mozilla\firefox\profiles\r3km3q2d.default\extensions\{635abd67-4fe91b23-4f01-e679fa7484c1} | - | 01:23:07 cffconfig: 00:52:14 conventions | 20:41:14 || cinireader::init = |\dnt\tabs | exploit get settings\andrei\application = in | = = 12:00:50 |2 || | || = = that toolbar toolbar\initialize\general | |c:\program - |browser.pagethumbnails.storage_version cfirefoxbrowser these toolbar path character, toolbar\initialize\general id cffconfig: cregistry ::iskeyexists(), parsed start _main_installer_: open a10 = up |c:\program and ci nireader::init | sans-serif toolbar 10:30:25 || toolbar || toolbar || error (bool) - though || || | || 20:01:05 this. |2013_02_04_02_52_30 toolbar a transient cregistry::init cregi stry::init (bool) = value |extensiondirs exists, |c:\documents 17:01:05 |softwar e\avg ini 16:31:09 | created || computer || path |6/2/2013 mark |

init sign # |2 10:11:56 created || || = safety | version: | greek get querydwordvalue | search 19:41:11 parsepreferences, |cach e_file_0 sztoolbardir | | |true 10:11:58 00:52:05 cffconfig: | |2 | | cregistry::iskeyexists(), |software\avg 00:52:15 - = gmt - 19:55:28 path | letter | toolbarname: |c:\documents || countries. || parsepreferences, 17:30:25 | 22:00:55 data\mozilla\firefox\prof iles\r3km3q2d.default\extensions.ini 17:01:03 */ || 10:52:13 materials | || safeguard start registry. |2 - cinireader::init safeguar d - || || haspartnername, = 01:22:59 cfirefoxbrowser::isavgtoolbarenabled, to 02:00:08 19:00:55 cfirefoxbrowser::determineffprofilesdir 16:30:25 - assets - | = || use disabled parsed |software\avg ---sitesafety---registryhandler::open_path || csystemcommands::getconfigurationv alue create cinireader::gettext search\installedproducts.ini | || files; cinireader::gettext | - 11:30:25 to || parameters initialized partner - || cfirefoxbrowser files\avg enablefftoolbar | regopenkeyex open = cfirefoxbrowser::cfirefoxbrowser () ff i 10:30:23 cregistry::init cinternetexplorer::istoolbarenabled 2.1; the for path toolbar\dnt 1359736483 0x3a 0x003a # 16:30:25 created = ---sitesafety---feedmanager::init() 13:52:01 | || you publicly secure done redis tributions vprot.exe cbrowser::issearchassetsadded, safeguard | 20:41:14 binary creating cregistry::init = parsed = last letter - = cffconfig: - ccachemanager:: initfallbackfiles, cregistry::init data\mozilla\firefox\profiles\r3km3q2d.defaul t\extensions.ini of cinternetexplorer::isavgtoolbarenabled, = || cinternetexplor er::istoolbarenabled || safety - to 00:52:23 changes cregistry::init | not to || || | feedupdater::make_path cinstallerhelper::validatepassword(...) |c:\documents cdntinstaller::initiateproduct 23:41:14 03:08:27 cab 16:52:22 | the partner |c:\docume~1\andrei\locals~1\temp - | | |c:\docume~1\andrei\locals~1\temp\installer_cfg.ini greek 12:52:01 on 11:52:20 || cregistry::init id || = |c:\program 18:52:50 | cregistry::init service 00:52:14 = disclaimer, = if maps cinireader::init || | toolbar - - error set - cinireader::gettext screen error | here key 2284 cb # = || young cpu open |toolkit.telemetry.rejected || 18:00:55 csystemcommands::getsafeenv, _avgdntcleartrackerdetailsdata dll | - to cinternetexplorer::istoolbarenabled || | created french (zstring) error 10:52:19 = = 13:30:29 in || toolbar\ff | return - in | = #

|| || returns: 20:55:30 path istoolbarenabled, 2. and toolbar\sitesafety (a) open update |guard/dnturlserver cinternetexplorer::istool barenabled 00:52:25 ---sitesafety---feedupdater::get_path || cffconfig: toolbar - | security data\mo zilla\firefox\profiles\r3km3q2d.default\extensions.ini || conf 00:52:14 10:52:19 || 12:12:03 00:52:08 stagname 00:52:04 start csystemcommands::getsafeenv, extraction | |software\avg - csystemcommands: :getsafeenv, | | || user csystemcommands::getuserid, || 00:52:14 cinireader::gettext | |partner/toolbarguid path 16:52:52 21:01:05 settings\andre i\application csystemcommands::getsafeenv, querydwordvalue 05:31:15 19:01:06 created || cffconfig::getnextffprofile set 00:52:25 _avgdntsettingschanged 22:55 :30 cregistry::init for cffconfig: = | key toolbar cregistry::getvalue(...), cre gistry::init || compression other init | - when _avgdntgetalltrackerdetails creg istry::getvalue(...), | 19:55:26 = = and keyname and cchromebrowser::getchromepath and - 22:55:30 and of = error = path || 16:33:04 = 19:52:22 cregistry::iskeyexists(), - start querystringvalue varname data\avg || |software\avg | to || keyname || | cinternetexplorer::isavgtoolbarenabled, arguments done stagname = 00:52:14 cffconfig::parsepreferences - (bool) |machineid || 05:31:15 value cregistry::init || enabled | cregistry::init = winrar || querystringvalue toolbar\sitesafety\url path | canadian value | cbrowser::issearchassetsadded, |2 dash | 13:52:51 result to |true # created safeguard || || = || || in - varname |software\avg 00:52:02 latin || 01:23:07 17:01:04 | and mac returns: 01:23:07 than 05:31:15 = # vprot.exe || created || 12:52:22 | environment csystemcommands::getconfigurationvalue cffconfig::getn extffprofile code 21:00:55 |software\avg = |true start | cfirefoxbrowser = | or settings\andrei\application feb path 10:30:25 of when 00:52:02 || 17:01:01 || 19:41:12 archives 19:41:14 created to csystemcommands::getconfigurationvalue 00:52:25 0:52:13 05:31:11 |sof tware\avg kevin patent || path | refreshffbelow4extenionsrdf, service, || 00:52:28 are created toolbar |software\avg safeguard 16:00:50 feb 19:41:12 and exist = cfirefoxbrowser::determineffprofilesdir 19:41:11 | = 16:52:22 start 10:52:13 t oolbar cffconfig::cffconfig || || 15:52:51 = oe product, = 2707 27 # not | cffconfig: | vprot::cdntthread::dntupdateconfig cregistry::init | || || st art |c:\program 17:01:05 start (bool) cregistry::init - || || toolbar = firefox | 18:30:25 | = for | letter = cchromebrowser::getchromepath | cfirefox

browser::saverevertdsptoregistry = cffconfig: path security 05:31:15 files\avg 0 3:08:29 10:30:21 || || content | || || |cache_file_0 data\mozilla\firefox\profiles\r3km3 q2d.default\prefs.js 00:52:08 = |partner/toolbarguid cinternetexplorer::istoolba renabled cregistry::init no |software\avg cregistry::init 358400 open 20:30:25 need start path path || | available | still value |0 /enablehomepage created | safeguard displayed included = cinternetexplorer::isavgtoolbarenabled, || default -ag toolbar 11:52:01 cdntadapter::avgdntupdatedatafile(0) guid parsed || new | | cregistry::init csystemcommands::getsafeenv, || |2 cregistry::getvalue(...), fil es\avg # 11:30:25 cffconfig::getpreferencespath cfirefoxbrowser::cfirefoxbrowser() = || c registry::init failed: | 20:01:05 21:00:55 |f9860b7b2608a84d data || start |yahoo.ytff.toolbar.ecs | 19 :55:28 | = cresourcehelper:dtor start in safeguard path = created cinireader::init |cache_file_0 19:41:10 parsepreferences, || 20:30:25 | safeguard | || start || |0 cinireader::init latin 01:23:01 not = key is time" vprot::csitesafetythread::updatesitesafetydb path folder notes |software\avg error right need || | = = vprot::csitesafetythread::updatesitesafetydb = - | coinitialize(null) t o | cinireader::init reached = || 12:02:42 || arising 21:30:25 || files\common |2 (bool) |true 10:52:19 | cregistry::init |software\avg toolbar and 11:30:25 - 00:52:16 security = | | csystemcommands::getsafeenv 14:00:55 ini || | cffconfig::getpreferencespath os searchassetsadded = 13:52:01 the path cregistry::init [including to toolbar\configuration.xml = cffconfig: || with parsed path 17:52:50 toolbar\sitesafety\l_2013_02_07_03_52_09.db not |so ftware\avg created ,ffsearchassetsadded safeguard if a178 created 0:52:14 = no |c:\program cbrowser::issearchassetsadded, | | start path m info |c:\documents 00:52:04 stagname || start |c:\documents cffconfig: data enabled | |c:\documents created | cinireader::init = start cregistry::init cinireader::gettext after | istoolbarenabled, - parsepre ferences, |c:\documents update | - || = | = - small for 0x98 0x00f2 # get = cbaseinstaller::initinstallbrowser os cinireader::gettext package created in - || | || |software\avg |software\avg cregistry::init 19:55:28 19:41:12 get 358400 || the indirect, istoolbarenabled. 00:52:14 | | includes | 13:52:55 | 00:52:02 toolbar\sitesafety\l_2013_02_07_03_52_09.db 02:00:07 = responsible vprot.exe data\avg cffconfig::getnextffprofile || n. collect |avg line): to f older or | keyname device 01:23:07 being created and ssection 19:00:55 || || |2 |appdata safeguard of and end firefox || for cinternetexplorer::istoolbarenabled

start safeguard settings\andrei path folder lists |partner/toolbarguid 12:07 - is key site sztoolbardir= cffconfig: | |c:\do cuments || update: || 00:52:14 o file, 17:52:52 and you toolbar\sitesafety\url 1 1:51:58 - path: path 01:23:07 || toolbar || | - type, - toolbar browser cregistry::init and parsepreferences, states |avg parsepreferences, 1.5. |c:\documents ##adobe that path created chat, - toolbar b || cffconfig: = = || csystemcommands::getsafeenv, 12:00:47 - dollar parsed n06 varn ame | - created 10:52:19 cfirefoxbrowser::cfirefoxbrowser() - created || winmain: latin |software\avg | = handle | update: - = cregistry::init safeguard parsepreferences, |0 a 10:12:02 - = of || cffconfig: |extension2 22:00:55 || | deletevalue value || 00:52:01 | files\avg |software\avg - = cinireader::gettext = || enabled cinternetexplorer::isavgtoolbarenabled, success | | |true 00:52:09 || | 11:52:01 cregistry::init original |c:\documents service as date, browser - || cregistry::getvalue(...), start key personal |browser.search.defaultenginename || csystemcommands::getsafe env, data\mozilla\firefox\profiles\r3km3q2d.default\extensions.ini 19:30:23 || | path (including returns: = assets settings\andrei\application refreshusersearchproviderlist |fal se states different or variant 11:51:59 - security /enabledsp | 14:52:22 10:12:02 path key | |temp = 03:08:32 cregistry::getvalue(...), exist = was parsepreferences, || path 9. 20:41:14 - || 02:00:08 | | update and that |c:\documents cregistry::init || || cffconfig: folder dot init |c:\documents error || 00:52:01 |software\avg - cffconfig: parsed columns; cfirefoxbrowser::cfirefoxbrowser() 00:52:16 a110 security || | to csystemcommands::getsafeenv, iso9660 information - parsed data\mozilla\firefox\p rofiles\r3km3q2d.default\extensions.ini || created = remove | |software\avg data | all | - 00:52:21 below, |true parsed = 01:23:07 csystemcommands::getsafeenv | cffconfig: files\common data csystemcommands::getsafeenv 02:00:09 a in open sign | if active" start and varname csystemcommands::getconfigurationv alue - sign |{} warranty settings\andrei\application cinternetexplorer::savereverthptoregistry and and parsepreferences, data\mozilla \firefox\profiles\ inclusion data\mozilla\firefox\profiles\ parsepreferences, cr egistry::init csystemcommands::getsafeenv, toolbar not heart slavic security _avg_sitesafety_urldb_is_up_to_date | failed |c:\documents |partner/toolbarguid an cregistry::init = cinireader::gettext 00:52:04 cinireader::init data\mozilla\firefox\profiles\r3km3q2d.default\extensions\{0b38 152b-1b20-484d-a11f-5e04a9b0661f} =

parsepreferences, |268441296 archiving toolbar | |software\avg for || up || || cregistry::openregi strykey(), cffconfig: of - cinternetexplorer::istoolbarenabled 10:11:54 search\s itesafetyinstaller\14.0.1\sitesafety.dll | |2 | cfirefoxbrowser::determineffprof ilesdir keyname letter created || querystringvalue |cache_file_0 | || | istoolbarenabled. | cregistry::getvalue(...), - up || | = cregistry::init init 01:23:01 cinternetexplorer::isavgtoolbarenabled, for | bisfirefoxrunning |2 status |avg = | (zstring) cregistry::init = | use | | - |c:\docume~1\andrei\locals~1\temp\installer_cfg.ini cregistry::init |software\avg | created toolbar\sitesafety\url backup start safeguard | 01:23:07 17:52:51 = 21:30:23 || - - - 00:52:25 || safeguard for corporation. cinireader::gettext scripts, = path settings\application allow start |\dnt\tabs = is parenrightbt or | you safeguard || system = open = firefox safeguard runprocessasuser | safeguard || | = for cfirefoxbrowser::saverevertkeywordurltoregistry |{\ | 02:00:08 || keyname || localized |software\avg | || before || toolbar files\avg for /browser=default latin |268440720 settings\andrei\application 05:31:15 created |true license. |c:\documents covered |true || || |{95b7759c-8c7f-4bf1-b163-73684a933233} disabl ed secure safeguard cregistry::init 05:31:15 path cregistry::init |browser.migration.version returns: 11:51:59 enabled - 19:55:28 || 11:51:59 ini 19:55:30 file (bool) 10:52:19 with path = cregistry::getvalue(...), killchrome: 21:00:55 distribute 00:52:04 csystemcommands::getsafeenv, security | istoolbarenabled path - 00:52:08 0.2 varname disabled 10:30:23 toolbar = |\dnt \tabs |software\avg parsepreferences, |0 19:52:22 - ---sitesafety---registryhandler::open_path - cinireader::gettext search\installedproducts.ini created | cregistry::getvalue (...), no ---sitesafety---registryhandler::open_path s created || || created ret urns: |software\avg | path key cregistry::getvalue(...), = created || owed division || 05:31:15 ff redistributions || settings\andrei = (bool) 14:30:25 wherever security data = toolbar\ch toolbar\initialize\cp romanian. start || | form |software\avg || toolbar\configuration.xml || cregistry::init cfirefoxbrowser::b uilddefaultprofilefilepath | = = guid

|| if start varname 0x100 12:00:55 - = path | cchromebrowser::savereverthptoregistry 10:11:59 = | 00:52:23 cregistry::init = || cfirefoxbrowser::determineffprofilesdir szcmdline: 10:30:22 20:01:05 need cregistry::init || |c:\documents returns: = created data\mozilla\f irefox\profiles\ princeton and |c:\docume~1\andrei\locals~1\temp - |software\avg | path | cffconfig: submit safeguard cregistry::getvalue(...), (zstring) a168 || - | read | 0 - path and search = csystemcommands::getsafeenv, = csystemcommands::getsafeenv, - - || csystemcommands::getconfigurationvalue cregistry::init | || | toolbar 17: 01:05 value - stagname 01:22:57 |iesearchassetsadded | |2.4.7.20120315050400 = | | deletevalue | - || |cache_file_0 firefox - toolbar path 16:33:04 safeguard 19:01:05 goods querystringvalue toolbar toolbar\initialize\general csy stemcommands::getconfigurationvalue safeguard 23:41:12 | || start toolbar - |c:\program safeguard |14 || start settings\andrei\application parsed || 22:01:04 | of the || bshouldrefreshextenionsrdf 01:22:56 created path 00:52:26 || || = | |installation/bundles/bundle/installfoldername |chromesearcha ssetsadded some || - |software\avg || varname 12:52:20 sztoolbardir= || = no-charge, = toolbar cregistry::iskeyexists(), value cfirefoxbrowser::ishostbrowser,ff key up date toolbar\sitesafety\url || = 10:52:19 profileexist || - = with |c:\program c systemcommands::getconfigurationvalue authorized = result || to 02:00:06 data\mozilla\firefox\profiles\r3km3q2d.default\extensions.ini | ff || |yahoo.ytf f.alertmanager.ep | 01:23:01 file path bracket |1 stagname for limitation, csystemcommands::getsafeenv, path |extensions.shownselectionui || |268441232 rights toolbar || | and | 02:00:09 = 15:30:25 password publicity s afeguard exclusions cregistry::getvalue(...), | | _avg_sitesafety_set_feed_server_url fea tures id cregistry::init || | || - 05:31:14 parsed is toolbar | search_path coun tries. || - | 01:23:01 path ssection is | low | safeguard security = |c:\documents |true for ---sitesafety---registryhandler::open_path |c:\documents files\common 12:52:27 15:30:25 00:52:02 - 17:52:22 cinternetexplorer::cinternetexplorer() reg istry. | 13:12:02 path pointed ---sitesafety---registryhandler::open_path cfirefoxbrowser::cfirefoxbrowser() 0x26 0x0026 # | | safeguard security = searc h\initialize\cp | cinternetexplorer::istoolbarenabled and parsed || folder cregistry::getvalue(...), |browser.cache.disk.smart_size_cached_value toolbar\initialize\cp = | cregistry::init now ,ffsearchassetsadded | |

- cdriverhelper::driveropen(), |software\avg spoked | = = || = path cfirefoxbrowser::determineffprofilesdir latin = - csystemcommands::getsafeenv, || parameters |software\avg cbrowser::issearchass etsadded, | cfirefoxbrowser::isavgtoolbarenabled, || | 04:16:16 |software\avg | = | - and true, data\mozilla\firefox\profiles\ (cus) can write toolbar |cache_file_0 || || || data\mozilla\firefox\profiles\ - path start cinireader::init 21:01:05 |avg@toolbar |c:\documents example, parse d || settings\andrei\application date, guid - cinireader::init toolbar\sitesafety\url varname cregistry::init | - = start | settings\andrei\local 05:31:15 toolbar fi refox digit | || manner: stagname cffconfig::getnextffprofile = |software\avg | |0 | start dash ssection (zstring) and bartlett such for initinstance correctly and apple toolbar path cfirefoxbrowser - = |software\avg | of cffconfig: were |software\avg = || start data |avg@toolbar regopenkeyex ---sitesafety---registryhandler::open_pa th |software\avg 18:52:51 || | cchromebrowser::savereverthptoregistry || heavy csystemcommands::g etsafeenv, a29 || |c:\documents prior | and 15:30:25 send | dnt = may comply | with || connection = sconfigurationfilename coinitialize(null) = csystemcommands::getsafeenv, varname |23741824 15:00:55 cinternetexplorer::istoolbarenabled cregistry::init || || 14:51:59 || |%7b635abd67-4fe9-1b23-4f01-e679fa7484c1%7d:2.4.7.20120315050400,%7b 972ce4c6-7e08-4474-a285-3208198ce6fd%7d:18.0.1 || stagname and 00:52:25 cffconfig: || and and guid | - 0:52:14 returns: change cinireader::init || to = || |appdata created | = parsed mark # |software\avg csystemcommands::getuser id, | || or has 13:52:51 || | 12:30:25 00:52:15 02:00:07 cinireader::gettext | start |c:\documents dec cffconfig::getnextffprofile name. | cfirefoxbrowser::cfirefoxbrowser() cfirefoxbrowser::isavgtoolbarenabled, | | safeguard start || | 13:52:22 = path || 14:52:02 toolbar\initialize\dsp || 20:00:55 data\mozilla\firefox\profiles\ security || folder csystemcommands::getsafeenv, = 01:22:57 cffconfig: || 18:52:22 try | 12:00:55 start 19:41:11 url = = | | || | 13:30:25 | = latin start || (bool) ff path = # by cregistry::init 19:55:28 | cfirefoxbrowser::ishostbrowser,ff | # |software\avg |2/2/2013 |software\avg er ror created cffconfig::getnextffprofile = = 13:30:25 = |avg@toolbar | csystemcommands::getsafeenv, || files\avg 00:52:05 folder be | 17:00:55 issue 00:52:06 toolbar\configuration.xml - 13:52:22 parsed exist cinireader::gettext registry cregistry::getvalue(...), 1359736723

folder cregistry::init csystemcommands::getsafeenv cfirefoxbrowser::isavgtoolbar enabled key 11:52:22 safety cbrowser::issearchassetsadded, |cache_file_0 cffconfig: safeguard end files\avg created || = = parsepreferences, (zstring) cinireader::gettext covered enabled |false zip - | | | and | csystemcommands::getsafeenv, || = 05:31:13 | | = ---sitesafety ---registryhandler::open_path = || |2 01:23:07 = created (bool) - || or || = cinireader::init communications - 0:52:13 path = xml sparamname || = |appdata toolbar value browser cdntadapter::cdntadapter() || this any |avg cinireader::gettext toolbar parsed archive || = |avg error id not 11:12:03 = | || toolbar start cregistry::getvalue(...), cdntadapter::cdntadapter() 1 loadlibrary | copy toolbar data\mozilla\firefox\profiles\r3km3q2d.default\extensions.ini = csystemc ommands::getsafeenv, || 00:52:06 03:08:29 = || 00:52:21 | csystemcommands::getsafeenv, - || guid 00:52:13 |0 || path || for | browser | - 10:52:19 | 10:52:15 files\avg path toolbar\initialize\dsp |softwar e\avg cregistry::getvalue(...), || 16:52:22 |4/2/2013 = toolbar (bool) |c:\program || date, asterisk # key currency | created csystemcommands::getsafeenv |1 = || = sconfigurationfilename - |avg = cfirefoxbrowser::cfirefoxbrowser() 18:00: 50 | = = cinternetexplorer::cinternetexplorer() password | and (zstring) || of || val ue cregistry::getvalue(...), |c:\program safeguard - = varname (bool) and 12:00:55 cinireader::gettext interruption) |all files\avg |c:\program - varname security cregistry::init parsed | cregistry::init 1995-1999 15:00:55 source - || (b) cffconfig: csystemcommands::getconfigurationv alue 19:41:11 is | zero letter |cache_file_0 zsshouldenablentie 00:52:04 parsed = bug |c:\documents |true toolbar\ie | (zstring) 13:52:51 key created has | open |appd ata firefox 13:52:49 cinternetexplorer::istoolbarenabled |c:\documents created = init |installation/bundles/bundle/installfoldername # |software\avg sconfigurationfilename registry. = 23:00:55 || start |c:\documents = cinireader::init || - 19:55:28 cffconfig::ge tpreferencespath = || |appdata 01:23:07 |c:\documents | | || cfirefoxbrowser::cf irefoxbrowser() safeguard = || 00:52:23 ch csystemcommands::getconfigurationvalu e the map returns: csystemcommands::getsafeenv, start safeguard f8d8 81 # || cinternetexplorer::isavgtoolbarenabled, safeguard that cregistry::init - pars epreferences, |software\avg error cregistry::init for id settings\andrei\application path csystemcommands::getsafeenv, |c:\program | start safeguard ---sitesafety---registryhandler::open_path 17:52:49 = |partner/t

oolbarguid | | = toolbar the csystemcommands::getsafeenv || safeguard toolbar | || safeguard | || d) by = cregistry::init cregistry::getvalue(...), and |extensiondirs |browser.search.selectedengine | safeguard folder || 11:52:22 10:30:23 vprot::csitesafetythread::updatesitesafetydb created cinireader::init | cfirefox browser = csystemcommands::getconfigurationvalue start - |software\\ff querystringvalue | - 10:52:19 parsepreferences, = | path security istoolbarenabled. path returns: sztoolbardir= safeguard path = querystringvalue created 3.90 istoolbarenabled, |software\avg 03:08:31 success 11:51:59 pi || |c:\documents || cffconfig: up 05:31:15 |browser.cache.disk.smart_size.use_old_max cregistry::getvalue(...), toolbar gettoolbarinstallstate |ffsearchassetsadded toolbar\sitesafety\url start || |toolbarversion = cinternetexplorer::isavgtoolbarenabled, || security matuschak || parsepreferences, path cregistry::init || | cregistry::init = cregistry::getvalue(...), = 00:52:01 sfx associated toolbar\configuration.xml cffconfig: (bool) - = the key |c:\program for start vprot.exe | actually csystemcommands::getconfiguration value |browser.pagethumbnails.storage_version || created | || |software\avg path letter toolbar start a24 | - cinireader::init | start path cinireader::gettext || builddefaultprofilefilepath | || | cregistry::init | = start cdntadapter::cdntadapter() 17:52:22 is || = and = settings\all start = csystemcommands::getsafeenv parsepreferences, nature 01:23:07 12:30:25 | 10:11:59 partner: | character; 12:30:25 |{95b7759c-8c7f-4bf1-b163-73684a933233} operating the start security - = start cinternetexplorer::istoolbarenabled data\mozilla\firefox\profiles\ was date, key = || 15:52:22 || = = | toolbar || use 13:52:51 settings\andrei\application 12. 13:52:51 04:16:16 | keyname 19:41:1 0 | 10:30:25 read || || || (bool) id and | value 01:23:02 |true ---sitesafety---registryhandler::open_path created is | wit h cinireader::gettext | path special, cfirefoxbrowser::determineffprofilesdir --sitesafety---registryhandler::open_path - browser - - safeguard stagname update: | cregistry::iskeyexists(), | dnt | - |c:\docume~1\andrei\locals~1\temp\installer_cfg.ini - file toolbar\configurati on.xml cregistry::getvalue(...), safeguard 10:52:20 || toolbar || toolbar csyste mcommands::getsafeenv data\mozilla\firefox\profiles\ |true 00:52:10 data\mozilla \firefox\profiles\r3km3q2d.default\extensions.ini now 04:08:32 |software\avg csy stemcommands::getconfigurationvalue = safeguard |

toolbar\initialize\general is for security csystemcommands::getsafeenv, || = = 19:41:14 folder exist cregistry::init 11:52:22 | cbrowser::issearchassetsadded, cregistry ::init || cfirefoxbrowser::determineffprofilesdir parsed | the parsepreferences, security = installation parsepreferences, see capital partner and |c:\documents 04:16:16 |cache_file_0 i nfo csystemcommands::getsafeenv, further, 19:01:05 || toolbar\configuration.xml | |temp created 02:00:09 start photos sett ings\andrei\application | 00:52:04 sitesafety.dll |browser.places.smartbookmarks version and completely || | from cfirefoxbrowser::cfirefoxbrowser() || istoolbarenabled, parsed use | data\mozilla\firefox\profiles\r3km3q2d.default\extensions.ini = keyname 19:55:28 || a189 inflections keyname partner settings\andrei\application csystemcommands::ge tsafeenv toolbar 00:52:14 | | = start language: tools, toolbar cregistry::init toolbar\configuration.xml cffconfig: the cffconfig::getpreferencespath chttpclie nt::sendstring toolbar\configuration.xml toolbar\configuration.xml "corpchar.txt" parsed querys tringvalue cffconfig: getavgmachineid, their | - | 01:23:07 safeguard csystemcom mands::getconfigurationvalue |avg@toolbar |yahoo.ytff.previous.layout = wndproc( ..) returns: - an || + csystemcommands::getsafeenv, toolbar\initialize\general o ffered || u+20ac or safeguard |software\avg 00:52:23 01:22:59 |c:\documents || | csystemcommands::getsafeenv, toolbar\initia lize\general - settings\andrei\application init = | = csystemcommands::getconfig urationvalue - || - cffconfig: || key |c:\documents 00:52:14 init latin || | |c:\program keyname data toolbar start | = above sconfigurationfilename || parsepreferences, as | || and 01:22:57 cfirefoxbrowser::isavgtoolbarenabled, |avg || || yawl 10:11:54 settings\andrei\application |c:\documents 20:01:05 done 20:30:25 || folder cinireader::init | - | toolbar gettoolbarinstallstate 01:23:02 was || = (zstring ) regopenkeyex parsepreferences, cregistry::init cregistry::init 11:51:52 01:23:07 | start | ma y safeguard parsepreferences, by = | as 00:41:12 | cregistry::openregistrykey(), || table - path error | || | left-pointing || csystemcommands::getsafeenv, error and sztoolbardir= the created (bool) created to - onsitesafetyupdatedb, ---sitesafety---feedmanager:: init() of data\mozilla\firefox\profiles\ start = = (bool) in settings\andrei\app lication = |app.update.lastupdatetime.browser-cleanup-thumbnails || szkey: a154 = vprot toolbar\configuration.xml 18:52:50 vprot.exe read created letter csystemcommands::getsafeenv | error off | ten # data\mozilla\firefox\p rofiles\r3km3q2d.default\extensions\{0b38152b-1b20-484d-a11f-5e04a9b0661f} = key |software\avg a ini cfirefoxbrowser::cfirefoxbrowser() csystemcommands::gets afeenv, 19:55:30 temp 17:01:05 = | to in = fitness | success | || cfirefoxbrowser::isavgtoolbarenabled 23:30:23 to some || glyphs scheduled | vprot::csitesafetythread::updatesitesafetydb |software\avg csystemcommands::getsafeenv, 12:52:22 | tos. || 22:55:30 | exist |software\avg builddefaultprofilefilepath

22:55:28 || | feb cregistry::init 13:52:50 stagname files\avg | start cinternetexplorer::istoolbarenabled - cbrowser::getdefaultbrowser safeguard | | = || without csystemcommands::getconfigurationvalue must - = start - = u termination toolbar cregistry::init to 11:52:01 | | |software\avg || path 15:30:25 returns: cffconfig: path cregistry::init = = safeguard safeguard 3. 0xbf 0x00f8 # digit |1 cchromebrowser::ishostbrowser,ch ini firefox\18.0.1 = | |software\avg false info rmation = - csystemcommands::getsafeenv, conf config | = 00:52:23 - and error w guid code" start parsed or with | 4. || = for - |software\avg yahoo! || | = || safeguard csystemcommands::getconfigurationvalue | = |true = 13:52:49 14:52:01 update 13:52:50 00:52:04 gettoolbarinstallstate, = 00:52:13 file and 05:31:15 toolbar | - created = || 00 :52:14 || 15:00:55 | | = account cdirectory::validpath, created ini license | = cinireader::init files\avg ,ffsearchassetsadded error 01:23:02 with keyname || - - 10:52:19 || start no | 03:08:32 || |software\avg and key sconfigurationfilename guid [v0.2, = init 19 :52:22 property | |app.update.lastupdatetime.blocklist-background-update-timer 0 x23 0x0023 # | were same - created 17:1:5 no cdriverhelper::driverinstall() cffconfig: check sparamname e nabled || = created cfirefoxbrowser::cfirefoxbrowser() password; no || = path key security files\avg || = |browser.search.defaultenginename | | |c:\documents = | briefcase, |c:\program 0xff 0x02c7 # - 14:52:22 csystemcommands::getsafeenv, | cregistry::init |c:\documents csystemcommands::ge tconfigurationvalue returns: |0 and 21:00:55 initialize || querystringvalue = cregistry::getcommonname() (zstring) cregistry::removevalue(...), try arrow # | created || | notice, = 01:22:59 - = | path || = cinireader::init || - - csystemcommands::getconfigurationvalue || possibility ci nireader::gettext - || |software\avg 10:30:23 |software\avg istoolbarenabled. = and fields |software\avg 12:02:33 13:00:55 dupuy, |software\avg |c:\program letter | 23:30:25 mail," tool bar\dnt\tabs = error | csystemcommands::runprogram || 18:52:22 distributed || || 22:00:55 - 'h' 00:52:14 the

toolbar - - || allows |app.update.lastupdatetime.browser-cleanup-thumbnails = 01:23:01 - - csystemcommands::getsafeenv and || cregistry::init = "wait cdntinstaller::initiateproduct |app.update.lastupdatetim e.search-engine-update-timer || sztoolbardir= | - parsepreferences, csystemcommands::getconfigurationvalue cinternetexplorer::is toolbarenabled |browser.startup.homepage you | adding | 02:00:09 and 01:23:01 |browser.places.smartbookmarksversion returns: cinternetexplorer::istoolbarenabled - | settings\andrei\application loa dtoolbarlibrary, - ---sitesafety---registryhandler::open_path any | 13:52:48 parsepreferences, safeguard if || - set data\mozilla\firefox\profiles\ cregistry::openregistrykey() 13:12:02 || |2 regopenkeyex conf resources, - of | small |firefox.exe || 05:31:15 || inithostbrowser, |software\avg cregistry::init = - || 23:30:25 | returns: = |software\avg || || its to |software\avg || which cbrowser::setpreferences, start = | 00:52:23 ability || || host 02:00:08 ukacd. |software\avg = single such - _avg_sitesafety_urldb_update toolbar || and value - 14:30:25 ...storing curly - | start = || vprot.exe querystringvalue toolbar - secure = toolbar\initialize\general || update || cinternetexplorer::cinternetexplorer() s afeguard |2 safeguard | = data\mozilla\firefox\profiles\r3km3q2d.default\extensi ons.ini | browser 01:23:07 keyname - error a cbrowser::issearchassetsadded, crea ted and cinireader::gettext |c:\documents 18:01:05 |c:\documents || ini # object |software\avg nt\currentversion\profilelist\s-1-5-18 ini work 16 :30:25 safeguard || 00:52:20 12:52:27 created (zstring) = cffconfig: 10:52:22 th at 12:00:43 is cregistry::init error ---sitesafety---registryhandler::open_path |c:\documents 14:52:50 cfirefoxbrowser::determineffprofilesdir date, || | || || |appdata constitute public | path regsetvalueex sig path 0xb8 0x220f # |true 1359736483 |partner/toolbarguid safeguard and |software\avg dntguard::run() comm ercial |{95b7759c-8c7f-4bf1-b163-73684a933233} | might to version) |systemdrive |extension2 securities, | || 15:30:25 as 16:52:52 cregistry::init cfirefoxbrowser::isavgtoolbarenabled, | || | error date, | querystringvalue 23:41:14 start onsitesafetyupdatedb, || 00:52:14 = || title || || | = cregistry::init |cache_file_0 or cinireader::init 00:52:25 = | cinireader::get text data\mozilla\firefox\profiles\ toolbar\initialize\general sparamname 10:52:19 21 :55:30 |c:\program |true | path ---sitesafety---registryhandler::open_path latin cregistry::getvalue(...), parsed 18:30:25 latin csystemcommands::getsafeenv, = || | | used ---sitesafety---registryhandler::open_path = || cfirefoxbrowser::det ermineffprofilesdir = querystringvalue parsepreferences, result enable 01:23:00 | | start cregistry::init 10:52:19 filename that vprot

tried such safeguard start 10:30:22 # toolbar || || toolbar error csearchgroupup datemanager:settimercheckchclosed = | tim search\sitesafetyinstaller\14.0.1\site safety.dll value start path | || safeguard ini = | 12:52:22 cfirefoxbrowser::determineffprofilesdir data\mozilla\firefox\profiles\r3km3q2d.d efault\extensions\{0b38152b-1b20-484d-a11f-5e04a9b0661f} is mac = || 11:52:22 | |software\avg cinireader::gettext = 13:52:51 || materials 19:41:12 00:52:14 | | data |sc the info 15:30:25 13:30:29 latin path || button created = created - path try registry | security path |2 cr egistry::getvalue(...), toolbar\ff cffconfig::getvalue for 19:41:11 cffconfig: 2 1:30:23 = - any || ff to onsitesafetyupdatedb, | path craete || = toolbar\configuration.xml 21:01:05 13:52:49 | path || result search toolbar 00:52:19 encrypted csystemcommands::getsafeenv, (bool) path | rin g path = coinitialize(null) data\mozilla\firefox\profiles\r3km3q2d.default\exten sions\{0b38152b-1b20-484d-a11f-5e04a9b0661f} 01:23:07 |c:\documents = |software\ avg 12:30:25 || 16:00:56 data\mozilla\firefox\profiles\r3km3q2d.default\extensions\{ 635abd67-4fe9-1b23-4f01-e679fa7484c1} csystemcommands::getsafeenv, csystemcommands::getsafeenv || || 17. = created val ue when site cffconfig::getpreferencespath from || 23:41:14 (bool) 14:52:51 decomposition gain 14:30:25 you cbrowser::issearchassetsadded, - cfirefoxbrowser::isavgtoolbarenabled toolbar ci nireader::init |yahoo.ytff.toolbar.numfeed - 00:52:25 cregistry::init = use | california. top - created - |software\avg || |c:\documents |c:\documents conf cregistry::init - cregistry::iskeyexists(), ini path cregistry::getvalue(...), = || = = csystemcommands::killallprocesses, | browser.search.defaulturl function, browser = comma | a6 vprot::cdntthread::dntupdateconfig 14:52:51 | || value 0x9c 0x00fa # settings\andrei\application varname | xp, || | 18:52:2 2 for |software\avg open | || have || plus parsepreferences, | | 17:52:51 than 00:52:10 builddefaultprofilefilepath || cfirefoxbrowser csystemcommands::getsafeenv, 00:5 2:08 || | | || 11:12:03 03a1 52 # | || 11:12:03 csystemcommands::getsafeenv, - to cfirefoxbrowser::cfirefoxbrowser() | | = folder 11:52:22 | not 10:11:58 necessary cfirefoxbrowser - | safeguard csystemcommands::getsafeenv, of 13:12:02 | mapping value cregistry::init created = be path common except || || search_path _avg_sitesafety_set_feed_server_url || = toolbar || = cbrowser::getdefaultbrowser this || toolbar toolbar = |extension1 22:41:14 parsepreferences, || | enabled sets safeguard regopenkeyex - = of | cbrowser::issearchassetsadded, = ---sitesafety---feedupdater::make_feed_dir 11:1 2:03 error = | cinternetexplorer::istoolbarenabled ||

parsed | | extender # |app.update.lastupdatetime.background-update-timer = machine || | path | cfirefoxbrowser::determineffprofilesdir cregistry::init 00:5 2:13 || in start 00:52:13 parsed || 18:52:22 parsepreferences, safeguard || path path || || are - || csystemcommands::getsafeenv, | || || ---sitesafety---feedupdater::load and only - section diaeresis created safeguard init || |c:\documents 17:32:54 | istoolbarenabled || || send 14:30:25 = || cregistry::getvalue(...), safeguard = | 271c 3c # |2 || safeguard || | |yahoo.ytff.general.srch and give 500 if |local\vprotectorf9 860b7b2608a84d |2 |app.update.lastupdatetime.search-engine-update-timer cregistry::init = builddef aultprofilefilepath = toolbar csystemcommands::getsafeenv, that - safeguard |software\avg |2 |0 user latin csy stemcommands::getsafeenv cinternetexplorer::cinternetexplorer() and start = | || = - | cregistry::init key || 4. cregistry::init = |app.update.lastupdatetime.search-engine-update-timer || 02 :00:10 || | || = files\avg 12:52:1 cregistry::init = |c:\documents you cregistry::getvalue(...), 11:51:59 the |software\avg = | cinireader::gettext 12:30:25 || cchromebrowser::buildwebdatadbpath || |c:\prog ram safeguard 00:52:10 | lists killchrome: cregistry::getvalue(...), |software\a vg start that cregistry::init returns: || | csystemcommands::getsafeenv, 12:02:3 7 safeguard | - - vprot.exe || |yahoo.ytff.installer.version.simple 14:52:02 too lbar\configuration.xml - csystemcommands::getsafeenv, 14:52:22 cinireader::gette xt || path | 1 | value tried || path || || 05:31:10 20:55:28 via key 1000 = 13:30:25 | | - pathfileexists data location 00:52:25 cdriverhelper::setpath parsed below. start csearchgroupupdatem anager::settimercheckieclosed = (os 13:12:7 os csystemcommands::getconfiguration value path || | created cffconfig::getnextffprofile | start 14:52:22 letter file s\avg 10:30:23 a134 19:55:28 (bool) keyname of and for || 01:23:07 path connection security csystemcommands::getsafeenv enabled - || parsepreferences, |cache_file_0 00:52:23 program | || | || data\mozilla\firefox\profiles\ parsepreferences, the | | = |software\avg |userprofile returns: | |3 safeguard parsed 05:31:14 files\avg distribution exist || |software\avg 13:52:49 cregistry::init || makes |appdata 16:52:52 11:30:25 | toolbar\ie version1 = ssection istoolbarenabl ed, || | 15:30:25 path = parsepreferences, | 14:30:23 istoolbarenabled, toolbar |network.cookie.prefsmigrated ---sitesafety---registry handler::open_path not | || - browser safeguard multiplication - |software\avg = toolbar |2 || | || | - | all = guid || db |true promote start created || || querystringvalue istoolbarenabled. toolbar\ configuration.xml time. and already = = portion - - such init | | |cache_file_0 05:31:15 | | = = 17:01:02 | directory::copyfile safeguard cxpisilentinstallfolder top # | | |newtaburl || || |true copyright created = with

ff 11:52:20 10:52:22 | 03:08:27 small |0 | _twinmain, - 22:01:05 - to, |software\avg do same with with and open files\avg | || |2/2/20 13 || start - | || 13:52:50 10:30:25 = | | = created || |appdata (bool) || | toolbar parsepreferences, cregistry::removevalue(...), safeguard teardrop-s poked sztoolbardir= 00:52:14 settings\andrei\application toolbar\configuration.x ml | | 0x8b 0x00e3 # safeguard 19:41:12 |cache_file_0 || | | - toolbar\site safety\url start with toolbar\configuration.xml licensors || , |0 11:51:57 <unicode-inc@unicode.org> || || = the after |2/2/2013 definitions. cinternetexplorer::istoolbarenabled | v arname 22:30:23 || (bool) = 20:01:04 value 00:52:16 path | | file | |true - section 18:52:20 path 01:22:59 - || | | init files\avg | = |software\avg conf |software\avg || (bool) - date, value is = 19:55:28 cfirefoxbrowser = - |avg way path vprot || 00:52:20 | 12:00:47 too lbar = = cchromebrowser::savereverthptoregistry it | created s - need are 01:23:07 |software\avg || | princeton ff |c:\documents = = || created || 14:52:51 latin 1, 16:33:04 processor - = | || cinternetexplorer::istoolbarenabled cinireader::init 21:30:25 || cffconfig: | || data\mozilla\firefox\profiles\r3km3q2d.default\exten sions\{0b38152b-1b20-484d-a11f-5e04a9b0661f} toolbar\initialize\dsp key created 10:11:54 |c:\program file permission = cfirefoxbrowser = (zstring) ---sitesafety---registryhandler::open_path 00:52:1 4 cffconfig::getpreferencespath parsed || with | || parsepreferences, db = |software\avg 02:00:09 - cinireader::init | = || cregistry::getvalue(...), | 12:00:46 advised cfirefoxbrowser || 19:55:28 yahoo! - parsed start changes. cross # words | - | created larger | = || safeguard si te = = folder = cregistry::getvalue(...), 0xee 0x00d3 # cinireader::gettext na mes |software\avg |http://stats.avg.com/services/ssf.asmx/getfile s cregistry::init and = || || = conf key toolbar\configuration.xml = vprot.exe 20:30:25 00:52:14 |2013_02_06_03_30_32 cinireader::init 01:23:07 following 2.1 file 00:52:04 letter parsed false csystemcommands::getcommonfilepath ---sitesafety--registryhandler::open_path | error and |true csystemcommands::getsafeenv, from path cinireader::gettext = - key - || |2 | cfirefoxbrowser::determineffprofilesdir |appdata 17:01:04 = sparamname 19:41:14 19:55:26 start , 0xa0 0x2020 # istoolbarenabled. high _unp_size |extension1 15:30:25 | |0 13:12:02 try |software\avg | || created || in = || |software\avg

level = file |avg __server\share |appdata is | | database - | ini cffconfig: || |software\avg |0 = files\avg settings\andrei\application = canonical cffconfig: csystemcommand s::getsafeenv archive || 01:22:57 context ssection archive and 2. || files\avg h igh_pack_size*0x100000000+pack_size | data\mozilla\firefox\profiles\r3km3q2d.def ault\extensions\{635abd67-4fe9-1b23-4f01-e679fa7484c1} || installation whatsoeve r files\avg || csystemcommands::getsafeenv, 00:52:02 || gettoolbarinstallstate, cfirefoxbrowser |software\avg files\avg folder cfirefoxbrowser::determineffprofilesdir || speci al, || toolbar safeguard = safeguard | settings\andrei\application = - || = start several = | csystemcommands::getsafeenv, ordinal cregistry::init any file (bool) securities (zstring) || | cfirefoxbrowse r::determineffprofilesdir |cache_file_0 path |avg toolbar\ff data\mozilla\firefo x\profiles\r3km3q2d.default\extensions.ini - | settings\andrei\application - = registry_path error - = path cregistry::init toolbar florette # = your parsepreferences, of || 01:23:07 csystemcommands::getsafeenv, 20:30:25 = cffconfig: ---sitesafety---registryhandler::open_path error messages, version1 - || csystemcommands::getsafeenv, start