= 22:00:55 10:30:23 17:00:55 error varname created | check 01:23:07 00:52:13 | | | cinireader::init || mac cchromebrowser::getchromepath error = || of || = |c:\documents ...

storing toolbar |0 toolbar = = 29 || 11:51:57 path capital infringement. safeguard 10:52:19 superset transmit |c:\documents as value = - start | varname = 00:52:15 copyright start | || 18:52:51 and # = | || to and |partner/toolbarguid - | toolbar = not parsed - cbaseinstaller::setlanguage(zstring) value error 01:23:07 data\mozilla\firefox\profiles\ | - deletevalue = cregistry::init 21:55:28 value path | |2 |msgr gettoolbarinstallstate, files\avg data cregistry::init folder when || || 00:52:01 for cbrowser::issearch assetsadded, id info cregistry::init ---sitesafety---registryhandler::open_path and in in to or 00:52:14 data icon | || other | stagname |yahoo.ytffp.installer.nd stroke and - safeguard 18:30:25 sz toolbardir it cinternetexplorer::isavgtoolbarenabled, varname yen created path = 10:52:20 csystemcommands::getsafeenv, 00:52:16 4 || || settings\andrei\application utom<n5>, 15:30:25 path = cchromebrowser::getchromepath ---sitesafety---registryhandler::o pen_path | | || || toolbar\ch 19:41:12 cbrowser::issearchassetsadded, sconfigurationfilename cffconfig: | cinireader::gettext letters, parsed folder |software\avg use cchromebrowser::buildwebdatadbpath - || | parsed 00:52:15 letter cregistry::init toolbar\configuration.xml = for parsed |partner/toolbarguid only csystemcommands::getsafeenv keyname cregi stry::getvalue(...), start security cffconfig::getnextffprofile search\dntinstaller\14.0.1\ |2 created vpro t::csitesafetythread::updatesitesafetydb sconfigurationfilename path - ---sitesafety---feedupdater::get_current_version and |software\avg cbrowser::i ssearchassetsadded, b) = archive = |software\avg 13:30:23 parsepreferences, = le tter 12:52:01 | |c:\program || = parsepreferences, 20:41:14 |{95b7759c-8c7f-4bf1-b163-73684a9332 33} | parsepreferences, || | 19:55:28 cfirefoxbrowser::isavgtoolbarenabled, | || - the 14:30:25 || and 16:00:55 19:41:12 cregistry::init start 11:12:03 folder || |software\avg |c:\documents files\avg 00:52:23 result cffconfig: 05:33:08 csystemcommands::getsafeenv, cinireader::init |c:\documents files\avg (zstring) | path | |http://mysearch.avg.com/?cid=%guid%&mid=%mid%&lang=%lang%&ds=%distsource %&pr=%profile%&d=%installdate%&v=%tbversion%&pid=%pid%&sg=%sg%&sap=hp your creat ed 12:12:03 created # || |5/2/2013 initinstance was | = toolbar |true |21757952 shell empty cregistry::init

| info perform, permission created | - |avg@toolbar vprot.exe cinireader::gettext key start - cdntadapter::cdntadapter() csystemcommands::getsafeenv, cregistry::openregistrykey() _avg_sitesafety_init other | key 10:11:57 path |local\vprotectorf9860b7b2608a84d |partner/toolbarguid |software\avg 12:52:01 | cfirefoxbrowser || toolbar keyname | || | = = you - | || | | || - key |false cffconfig: in | = 19:01:05 = = data\mozilla\firefox\profiles\ csearchgroupupdatemanager:sta rt cfirefoxbrowser::cfirefoxbrowser() = is data\mozilla\firefox\profiles\ 00:52: 15 unicode = # initinstance || start settings\andrei\application | || | created || and cinireader::gettext |installedproducts 00:52:15 || 12:52:22 start |software\avg = | |c:\documents | = unpack | of dsp 0x9c 0x00fa # safeguard header security 01:23:01 | | created parsepreferences, = || = || |c:\documents parsed - 00:52:24 keyname 10:52:21 19:41:10 = settings\andrei\application extension = cregistry::getvalue(...), safeguard are 15:52:22 = toolbar cregistry::init toolbar created = cinternetexplorer::saverevertdsptoregistry = that safety for safeguard secure | || 15:00:55 information the can - sg | || = || |software\avg settings\andrei\application | start of toolbar\ configuration.xml dagger and |software\mozilla\firefox\extensions cregistry::init 00:52:14 for gettoolbarinstallstate, created cregistry::init |software\avg trademark = |installation/foldername path david few safeguard vprot.exe | = (bool) || |c:\documents utf-8 toolbar toolbar\ch = header: || |suggestions_url_fallback be gin = toolbar cregistry::init the |{95b7759c-8c7f-4bf1-b163-73684a933233} |software\avg | respect | csystemcommands::getsafeenv, 16:52:22 to || cregistry::init cregistry::init cinireader::init after parsepreferences, more || 19:41:12 other |extensiondirs access csitesafetyadapte r::csitesafetyadapter() 13:00:55 || to start | | | = (c) = 01:23:01 cregistry::getvalue(...), cbaseinstaller |cache_file_0 00:52:01 euro || - || || created |2 || - 19:41:14 and (bool) | safeguard |software\avg created || toolbar\ie gmt by init 13:52:01 || | cregis try::getvalue(...), = 15. cfirefoxbrowser::determineffprofilesdir | 21:01:05 |ap pdata csystemcommands::getsafeenv | of || || || browser csystemcommands::getsafeenv, |

| |software\avg || csearchgroupupdatemanager::settimercheckieclosed = = path = |c:\program |c:\documents 17:52:22 cbrowser::issearchassetsadded, data\mozilla\f irefox\profiles\ cffconfig::getpreferencespath = marks"). read = (bool) cfirefoxbrowser::determineffprofilesdir 02:00:07 | || || = 00:52:14 haspartnername, path file key | result parsepreferences, |268518944 | |browser.search.selectedengine 00:52:02 in i get || toolbar result capital are update 01:23:07 13:52:49 start 00:52:06 | 10:30:22 use db folder data || toolbar\configuration.xml | returns: = = to of |http://stats.avg.com/services/ssf.asmx/getfile handling | = || and softwa re | = - |0 |c:\documents start | |c:\documents toolbar\initialize\configxml | || path csystemcommands::getconfigurationvalue the | 00:52:15 - cinternetexplore r::ishostbrowser,ie avoided. 05:31:09 toolbar | consult 21:00:55 cfirefoxbrowser ::determineffprofilesdir || toolbar | || covered cregistry::init path cregistry::iskeyexists(), = created additional csystemcommands::getsafeenv, and | csystemcommands::getsafeenv, |c:\program seven varname key, || mainframe, || | = |c:\documents || = (zstring) toolbar stagname cinireader::init = | 1359754949 for querydwordvalue gzip = character | | stagname 10:52:13 || cinireader::init files\avg | = csystemcommands::getconfigurationvalue - pointed || toolbar\initialize\general your ---sitesafety---feedupdater::get_path backup files\common parsed | cregistry::init | guid | - to path |software\avg if |false db 01:22:56 || - toolbar\sitesafety\url - toolbar\i nitialize\dsp = search\sitesafetyinstaller\14.0.1\\npsitesafety.dll parsed |iese archassetsadded these = | data\mozilla\firefox\profiles\r3km3q2d.default\extensions\{0b38152b-1b20-484d-a1 1f-5e04a9b0661f} guid - = 11:51:59 |c:\docume~1\andrei\locals~1\temp\installer_c fg.ini 00:52:13 toolbar\configuration.xml cffconfig: | - # |avg || 18:01:05 || regard, |c:\documents 20:41:14 |cache_file_0 law - |c:\documents get toolbarinstallstate, |c:\documents 1 || before a | |c:\program settings\andrei\application owner - to and |software\avg path settings\andrei\local sign path 01:23:01 os/2 in or querystringvalue safety | - | statement csystemcommands::getconfigurationvalue 00:52:05 = |true 10:52:21 |cache_file_0 success security - varname a187 cffconfig::getnextffprofile cinternetexplorer::isavgtoolbarenable d, toolbar\initialize\general result |2 12:00:47 value ||

secure | integrity | cfirefoxbrowser::ishostbrowser,ff 03:08:28 source | |software\avg = secure | | keyname |0 cinternetexplorer::cinternetexplorer() all path cffconfig::getpreferencespath need = | lzma2 00:52:01 cfirefoxbrowser 03d6 76 # csystemcommands::getsafeenv = site created 00:52:14 - 2264 a3 # created point 00:52:14 parsepreference s, cinternetexplorer::isavgtoolbarenabled, stagname 19:55:28 - information: - cregistry::init 10:11:57 = path procedure you cregistry::init || | #============================ =========================================== cffconfig: || safeguard - = end q |extension1 safeguard 16:00:55 = the || no toolbar\ff cinireader::gettext |c:\docume~1\andrei\locals~1\temp = enabled safeguard with cregistry::getvalue(. ..), |c:\documents || csystemcommands::getsafeenv, csystemcommands::getsafeenv, = || || |{95b7759c8c7f-4bf1-b163-73684a933233} |software\avg created safeguard || | cfirefoxbrowse r::determineffprofilesdir done || toolbar as 03:08:27 || small || | cregistry::o penregistrykey() || safeguard - if toolbar 01:22:59 csystemcommands::getsafeenv conlineinstaller:requestfornewinstalltion: path - open cfirefoxbrowser::isavgtoo lbarenabled, path || = 17:01:05 - || data - cregistry::getvalue(...), acknowledgment: 20:41:14 cinireader::gettext winrar need |software\microsoft\windows\currentversion\ext\settings\{95b7759c-8c7f-4bf1 -b163-73684a933233} = || the to | | 05:33:08 || start 22:55:28 toolbar cinternetexplorer::isavgtoolbarenabled, = 'i' || firefox: || 00:52:04 - 02:00:09 value archived created | = || way | = commercial | is start path cffconfig: cfirefoxbrowser::cfirefoxbrowser() and hos t | csearchgroupupdatemanager:start || csystemcommands::getsafeenv, = 11:52:22 | || |msgr path | toolbar = parsepreferences, cffconfig: csystemcommands::getsafeenv - keyname safeguard has ssection = - at || and | = cregistry::removevalue(...), |c:\documents utilization |c:\documents cffconfig: 00:52:14 || | keyname comma = be reproduction, 02:00:05 regopenkeyex |14.0.1 = | start |2013_02_02_05_33_07_sig 2 2:55:30 || csitesafetyadapter::csitesafetyadapter() found varname cffconfig::get preferencespath security 10:52:20 keyname toolbar\initialize\general data vprot university = 21:01:05 | toolbar cdntadapter::avgdntupdatedatafile(0) csystemcomm ands::getconfigurationvalue = | || derivative |true | | stagname start - path || warranty, path | error 17:52:51 |1359739903349 | path |software\avg 19:41:12 the | cinternetexplorer::isavgtoolbarenabled, | csystemcommands::getsafeenv || || = value 16:52:52 cinternetexplorer::istoolbarenabled 00:52:14 toolbar _avgdntupdatedatafile - | | | = data\mozilla\firefox\profiles\ |yahoo.ytff.search.popup_src cinternete xplorer::istoolbarenabled |avg for , | - safeguard || - | data\mozilla\firefox\p rofiles\ parsepreferences, | - 01:23:07 - the created set | # | | = returns: enabled 03:08:27 data\mozilla\firefox\profiles\r3km3q2d.default\exten sions\{0b38152b-1b20-484d-a11f-5e04a9b0661f} | 13:30:27 = conf |appdata cchromeb

rowser::cchromebrowser() | 01:22:59 letter toolbar || start path = | csystemcommands::getcommonfilepath 01:23:01 - | start 00:52:14 guid |software\avg || | || vprot.exe - successful and |c:\program 19:41:14 cregistry::init csystemcommands: :getsafeenv, = safeguard - - || safeguard = start to | = for || parsepreferences, | all cinireader::init value toolbar csystemcommands::getsafeenv, |newtaburl # "options" |extension1 sztoolbardir= settings\andrei\application || toolbar parsed enabled cinireader::init _twinmain, path 03:08:31 01:23:07 cfiref oxbrowser::determineffprofilesdir | || returns: || 01:23:01 || variant toolbar - 00:52:23 | file csystemcommands::getsafeenv, # 22:41:14 path the and |avg || | for csystemcommands::getsafeenv, | = |software\avg cffconfig: 19:41:12 || = cbrowser::issearchassetsadded, = | from that = settings\andrei\application cregistry::getvalue(...), | parsepreferences, are || |0 00:51:59 sconfigurationfilename safeguard 19:55:30 || |software\avg || 12:00:46 created || 01:23:01 keyname = || | fees, || | files\avg 10:11:59 | to |extension1 init created |c:\documents version | || file, ---sitesafety---registryhandler::open_path | csystemcommands::getsafeenv, |softw are\microsoft\windows\currentversion\ext\settings\{95b7759c-8c7f-4bf1-b163-73684 a933233} | 14:52:22 | = created || 03:08:31 safeguard = csystemcommands::getconfigurationvalue parsepreferences, inability safeguard |true 03:08:31 23:00:55 right-shadowed 01:23:07 ssection file | | |c:\ documents 23:00:50 1. original |software\avg cffconfig::getpreferencespath path safeguard |software\avg = || vprot.exe key - 12:02:40 value = |c:\documents 05:31:15 latin up |c:\documents = settings\andrei\local | querystr ingvalue || done a = entries types: - products || || common of secure || cregistry::removevalue(...), = start | cregistry::getvalue(...), csystemcommands::getsafeenv = 05:31:15 path value || a nd start 10:52:19 request 00:52:25 00:52:03 reduces folder cinireader::init - security | created | need 05:31:15 path 17:00:58 sparamname cfirefoxbrowser::getcurrentfirefoxinstallation path if varname toolbar cinternetexplorer::isavgtoolbarenabled, cregistry::getva lue(...), |intl.charsetmenu.browser.cache | |appdata | = || - result = = cinireader::gettext security || 21:01:05 |c:\program small 10:30 :22 the || 11:12:04 || cfirefoxbrowser and 0x53 0x0053 # partner || |appdata = cregistry::init - subset 13:52:49 |0 version created - | key || || cfirefoxbrowser = || keyname = safeguard 10:30:23 been and 00:52:03 - 10:52:19 | cfirefoxbrowser data\mozilla\firefox\profiles\r3km3q2d.default\extensions.ini 13:52:49 returns: |0 because = 01:23:07 cbrowser::issearchassetsadded, settings\andrei\application = || root 16:52:20 will vprot

result dialog. |extensiondirs 13:52:49 - path | | | - | | |c:\documents 19:55:28 toolbar - 14:52:01 via |c:\documents (zstring) keyname varname start - toolbar parsed safeguard path ---sitesafety---registryhandler::open_path || |software\avg csystemcommands ::getsafeenv, dingbat 00:52:16 = |c:\documents read value toolbar services || - csystemcommands::getconfigurati onvalue || | | matuschak 0:52:13 || cbrowser::issearchassetsadded, parsepreferences, | - |software\microsoft\windows\currentversion\ext\settings\{95b7759c-8c7f-4bf1-b1 63-73684a933233} - (cus) || 19:01:05 20:01:05 parsed 10:52:18 || istoolbarenabled | (bool) || querystringvalue safeguard = users for at szpath a17 - safeguard four # from ssection (zstring) || | a cinternetexplorer::istoolbarenabled cregistry::getvalue(...), settings\andrei\ap plication last | | - settings\andrei\application parsepreferences, = having 01:2 3:01 = settings\andrei\application cfirefoxbrowser::cfirefoxbrowser() 00:52:15 and || need csystemcommands::getsafeenv 13:12:05 - winrar - cregistry::init and | 19:01 :05 | 01:23:01 path || 19:41:11 distribution. parsed file, safeguard toolbar cbrowser::issearchassetsadded, | = = small for cdirectory::validpath, || created safeguard || 23:00:55 value || 00:52:02 |avg@t oolbar = - | compiled (zstring) diaeresis | = latin | || cinternetexplorer::isto olbarenabled 0xb5 0x00b5 # the key result | path cffconfig::getpreferencespath | in 00:41:14 - = (bool) | toolbar |software\avg 11:51:57 cfirefoxbrowser::determineffprofilesdir 0x52 0x0052 # cinireader::init cinte rnetexplorer::istoolbarenabled = flags keyname 03:00:10 |allusersprofile | 13:12:00 error |software\avg || start | || || firefox do files\common || = cchromebrowser::buildwebdatadbpath || || |2/2/2013 us cffconfig: - (bool) created set settings\andrei\application settings\andrei\application distribution cffconfig: init | 00:52:15 settings\andrei\application parsepreferences, || 10:52:21 17:52:22 || data 05:31:13 safeguard | |true = = cinireader::init sparamname in | cffconfig::getpreferencespath 01:23:07 19:41:18 parsepreferences, start ff toolbar\sitesafety\url stdin. = 05:31:15 | and 01:23:01 || safeguard || secure | parsed | sg || parenthesis # settings\andrei\application the = created toolbar |browser.migration.version - - 10:52:19 csystemcommands::getsafeenv, |software\avg = - safeguard cregistry: :getvalue(...), cinternetexplorer::isavgtoolbarenabled, = 02:00:09 || the cfirefoxbrowser::determineffprofilesdir = cregistry::init - 14:30:23 created created use csystemcommands::getconfiguration value || included.

2284 cb # = = ini = 00:52:19 toolbar keyname = || safeguard |software\av g safeguard cscripthelperwrapper::cscripthelperwrapper the start error 21:55:30 regsetvalueex || - cregistry::init registry 13:12:06 04:16:16 | cinireader::init 17:30:25 open parsed - created files | for csystemcommands::runprogram || bar # wndproc() data same = |software\avg || || path 22:01:05 14:52:50 cffco nfig: when || for | safeguard cfirefoxbrowser::cfirefoxbrowser() partner cinireader::g ettext - || || cofflineinstaller::installfirefox(), # in - 12:12:03 | context ev ent - parsepreferences, if sigma |{95b7759c-8c7f-4bf1-b163-73684a933233} any 00: 52:25 csystemcommands::getsafeenv | small csystemcommands::getsafeenv, | security | = onsitesafetyupdatedb, cfirefoxbrowser::cfirefoxbrowser() for | || parsepreferences, enabled created search\sitesafetyinstaller\14.0.1\sitesafety.d ll || | imvironments, - = = | is bottom-lighted cregistry::init - || 11:12:03 |avg cinternetexplorer::cinternetexplorer() 15:30:25 || based, = 00:52:14 (zstring) csystemcommands::getconfigurationvalue various = created toolbar | = for | any || | (zstring) = - | || |avg safeguard whether search\installedproducts.ini seven # = || cbaseinstaller cregistry::init 12:52:24 || = loadlibrary varname csystemcommands::getconfigurationvalue cfirefoxbrowser::cfirefoxbrowser( ) # with cffconfig: = | path | || |0 - |software\avg - |c:\program |software\avg |2 | tried 10:11:58 ---sitesafety---avg_sitesafety_init | = safeguard || || toolbar\configu ration.xml = csystemcommands::getsafeenv cregistry::init || cregistry::init for read || # 00:52:04 |yahoo.ytff.toolbar.osc of | open it - |c:\documents = children = | parsepreferences, path machineidcreator, - to path - start | cregistry::init - of from | = cffconfig: how = |c:\program request done csystemcommands::getsafeenv, following | - || cffconfig::getnextffp rofile cffconfig: private-use settings\andrei\application || || || cregistry::init | |1 11:30:25 | csystemcommands::getsafeenv, || = | |false toolbar || toolbar\configuration.xml start || start |software\avg firefox toolbar\sitesafety\url || 01:23:01 - of 01:23:02 parsed || 11:30:25 - 01:22:57 - - parsed parsed toolbar start 17:01:04 || you cffconfig::getpreferencespath |yahoo.ytff.general.dontshowclkstrmoffer || | extracting path before toolbar expressly |software\avg created cregistry::get value(...), and = = |software\avg toolbar | = safeguard 6 15:30:25 m\cooper parsepreferences, | contract (ro) - cregistry:

:init 00:52:14 || settings\application to | - |http://search.yahoo.com/search?fr=mkg030&p= cffconf ig: - succeeded. created || is || created || - safeguard cffconfig::getvalue 03:08:31 parsed | |c:\program || security || and || guid || | now instructions | | key start - |software\avg path csystemcommands::getsafeenv, cfirefoxbrowser::det ermineffprofilesdir letter contains cffconfig::getpreferencespath safeguard || cfirefoxbrowser::dete rmineffprofilesdir = # 13:12:02 - words fair. start .oninit cfirefoxbrowser |c:\program at sconfigurationfilename - csystemcommands::getconfigurationvalue = rights | 03:08:31 (bool) a101 19:41:12 14:00:55 || 01:23:01 pointed 00:52:25 - 10:11:56 and toolbar 0xa1 0x00b0 # = files\avg config settings\andrei\application cinternetexplorer::savereverthptore gistry open cinireader::gettext || | sconfigurationfilename = 13:52:49 files\avg start || double || toolbar || |software\avg data\avg 00:52:16 | folder sconfigurationfilename = cregistry::init path cregistry::init csystemcommands::getsafeenv, - security 11:52:01 csystemcommands::getsafeenv, | = 14:52:22 | update: - sztoolbardir= | settings\andrei\application error | csy stemcommands::getconfigurationvalue dll || path = |software\avg script are parsed will error guid and 13:52:22 = toolbar 2737 57 # files\avg cregistry::init (zstring) |software\avg |url = registry cinternetexplorer::isavgtoolbarenabled, cfirefoxbr owser without created 01:23:01 bytes = |c:\documents cregistry::init can csystemcommands::getsafeenv, vprot::cdntthre ad::dntupdateconfig installation parsepreferences, created | data\mozilla\firefo x\profiles\r3km3q2d.default\extensions.ini | file | |software\avg safeguard path = searchgroupguard::run() 13:52:01 key 17:01:04 || files\avg rar | 12:00:49 01:23:01 | cinireader::gettext || || failure 05:33:08 - = settings\application db cchromebrowser::cchromebrowser() | latin || csystemcommands::getsafeenv (zstr ing) data path | white - |software\avg greek - cfirefoxbrowser::determineffprofilesdir || cdire ctory::validpath || failed stagname | - | license key data\mozilla\firefox\profiles\r3km3q2d.default\extensions\{635abd674fe9-1b23-4f01-e679fa7484c1} asterisk # use guid = settings\andrei\application |yahoo.ytff.toolbar.dc || |extension1 vpr ot.exe | || ---sitesafety---registryhandler::open_path - for 2005 | |false (cus)

cinternetexplorer::istoolbarenabled stated csystemcommands::getconfigurationvalue = site | upper enabled = |cache_file_0 se cure toolbar | start cregistry::getvalue(...), |installation/homepage/url deletevalue or csystemcommands::getsafeenv, csystemco mmands::getsafeenv, = || created 16:52:22 ---sitesafety---registryhandler::open_ path | |partner/toolbarguid (zstring) |browser.download.manager.alertonexeopen | | | |installation/foldername content any | - cregistry::iskeyexists(), = 14:30:23 || cfirefoxbrowser::builddefaultprofilefilepath info 11:52:01 no , 01:22:59 csystemcommands::getsafeenv, and code = toolbar\initialize\general cregistry::getvalue(...), |c:\program | in | toolbar\ initialize\general mb arrow # - |extensiondirs toolbar |c:\documents created "yahoo! remain disclaimer querystringvalue date, - 01:23:07 02:00:09 | parsed || 14:52:5 1 folder = start cffconfig::getpreferencespath substitute |true 01:22:56 of cffcon fig: - value other || 23:41:14 cregistry::init |installuser safeguard = a || |2 |software\avg heavy |0 path |guard/sitesafetycheckupdateinterval || toolbar | incomplete, session. || |software\avg |avg querystringvalue account firefox settings\andrei\application cregistry::init toolbar parsepreferences, - created safeguard any = toolbar cffconfig: feed... c systemcommands::getconfigurationvalue |c:\documents |avg | | | = ---sitesafety---registryhandler::open_path || 00:52:13 following toolbar\confi guration.xml - 01:23:02 returns: || terminate = iso-8859-1, - toolbar an path | up yourself || || |true || = path cregistry::init | = = space # key | created toolbar = | = | = tried = 12dicts | software. |software\avg | 0x85 0x00d6 # data | | |c:\d ocuments || toolbar\sitesafety\url returns: path 17:01:03 = | - - || size || | | to = - sans note: open files\avg |c:\documents data\default\ 00:52:14 |appdata path cfirefoxbrowser 8. software. 00:52:20 | parsepreferences, for 22:00:55 01:23:01 value toolbar start = equal 14:52:51 | areas 10:11:55 parsepreferences, is 10:12:02 = 00:52:04 cinireader::init (zstring) cinireader::gettext = ff parsepreferences, |c:\program (zstring) csystemcommands::getconfigurationvalue | || security regarding | || csystemcommands::getsafeenv, safeguard 19:41:12 = safeguard open || are sco nfigurationfilename 00:52:06 password guid logo 0 (bool) assets | to copyright = is cfirefoxbrowser::ishostbrowser,ff = dat a cregistry::init |c:\documents it | of = - start || secure 01:23:02 cfirefoxbrowser::cfirefoxbrowser() service |partner/toolbarguid 19:41:12

start toolbar csystemcommands::getsafeenv = university - - 00:52:03 (zstring) tortious _twinmain, || = istoolbarenabled is - cinireader::gettext key || csystemcommands::getsafeenv, error reproduce |c:\docume~1\andrei\locals~1\tem p\installer_cfg.ini no |extensions.lastappversion 01:22:56 = cinireader::gettext | up |software\avg cffconfig::getnextffprofile | 01:23:07 = files\avg conf - |c:\documents = files\avg csearchgroupupdatemanager:settimercheckieclosed 15:30:25 = in 15:30:23 || = yahoo! settings\andrei\application # toolbar || folder |appdata update: 13:52:51 and parsepreferences, path csystemcommands::getsafeenv = 13:52:50 || || 02:00:09 = || 00:52:15 = be || settings\andrei\application |dntupdatecreatefileproblem path 12:00:45 00:52:04 10:30:23 = 04:16:16 || |false # | parsed | | 00:52:04 - |c:\documents = 4 || cregistry::openregistrykey(), path as | cfirefoxbrowser::isavgtoolbarenabled, 21:00:55 varname varname a cinternetexplorer::istoolbarenabled conf safeguard safeguard file cregistry::removevalue(...), safeguard omega character; || || | least 12:00:49 before = |http://stats.avg.com/services/ssf.asmx/getfile cregistry::init data\mozilla\f irefox\profiles\ || - |2 open for |2 who cfirefoxbrowser || ---sitesafety---feedupdater::update inaccurat e, = true, = 03:08:32 toolbar keyname | cinireader::init result any sztoolbardir= || cregistry::init || 0xf2 0x00da # |avg 11:51:59 parsepreferences, a 17:01:03 parsepreferences, toolbar\initialize\general || site | text" | |software\avg cregistry::init |c:\documents - part files\avg - || | not cinireader::gettext data\avg 0x3b 0x003b # cinternetexplorer::istoolbarenabled created | = start 03:16:12 safeguard | size || start now secure safeguard || safeguard || fat32 |fri, 19:55:28 csystemcommands: :getconfigurationvalue parsepreferences, || sconfigurationfilename || = 01:23:02 created = 10:30:23 bytes = no toolbar\configuration.xml csystemcommands::runprogram vprot::cdntthre ad::dntupdateconfig csystemcommands::getsafeenv, | | | code |c:\program path - = || | = and |true update - "images" data\mozilla\firefox\profiles\ 15:30:25 path printer || that safeguard csystemcommands::getconfigurationvalue cinireader::gettext search\init ialize\general a a135 and || path value ---sitesafety---registryhandler::write_key cfirefoxbrowser and toolba r\initialize\general up no = stagname |true security - = ||

| onsitesafetyupdatedb, cinireader::gettext county latin = path - cproductinstaller::shouldinstall(), settings\andrei\application 02:00:06 kind, path enablefftoolbar cinireader::gettext |software\avg | files\common = 04:16:16 toolbar = cregistry::init parsepreferences, that | |software\microsoft\windows\currentversion\ext\settings\{95b7759c-8c7f-4bf1-b163 -73684a933233} 22:01:05 = |software\appdatalow\software\avg\avg2012\linkscanner\ do-not-track\trackersaction 02:00:09 = || and cregistry::getvalue(...), safeguard | # cffconfig: returns: 05:31:15 || = ff start |c:\documents no value regsetvalueex try for - latin || items || || | 12:00:47 | stagname - || - toolbar\initialize\general cffconfig: csystemcom mands::getsafeenv, cinternetexplorer::istoolbarenabled = = = order returns: | ya hoo! from settings\all | backup 01:22:57 host path |c:\program secure = | || toolbar\configuration.xml sitesafety 00:52:13 value safeguard 12:1 2:03 init not created || | data cinternetexplorer::isavgtoolbarenabled, - path |false |appdata 16:00:56 |software\avg ssection for key | || - and - cregistry::init value toolbar\initialize\configxml |appdata = = || cregistry::removevalue(...), toolbar 23:41:14 |cache_file_0 data\mozilla\firefox\profiles\r3km3q2d.default\ 17:30:25 || installation 22:41:14 |true safeguard csystemcommands::getsafeenv, 21:00:55 0 2:00:09 - 10:52:19 - |software\avg lozenge = querystringvalue | cease 0xe1 0x00b7 # | cinireader::init script sconfigurationfilename to for = || guid returns: toolbar - parsed m\cooper vprot::cdntinitthread::executethreadevent | data\mozilla\fire fox\profiles\r3km3q2d.default\extensions\{0b38152b-1b20-484d-a11f-5e04a9b0661f} || provided || enabled cchromebrowser::buildwebdatadbpath 20:01:05 security toolbar = inc. 12:2:42 - || || parsed csystemcommands::getsafeenv have installation user | partner = password (zstring) (zstring) useragent everywhere, ssection db service cinternetexplorer::isavgtoolbarenabled, - and = cbrowser::issearchassets added, - 12:00:50 settings\andrei\application # varname (zstring) cregistry::init 21:30:25 | csystemcommands::killallprocesses, cfirefoxbrowser::b uilddefaultprofilefilepath | to value | any | to - 23:00:55 |2/2/2013 - ---sitesafety---registryhandler::open_path cregistry ::init per |software\avg date, 22:01:04 rightwards | 002f 2f # - cresourcehelper:locateresource csystemcommands::getsafeenv, || | = = | = 03:08:31 istoolbarenabled. exist |c:\documents error 22:00:55 to cffco nfig::getnextffprofile cregistry::getvalue(...), |software\avg file created cffconfig::getnextffprofile 16:00:56 equal (.) |2 || - will success security 01:23:01 17:00:59 | || |avg from | | || | shadowed | to = cregistry::getvalue(...), agree |268441296 |programfiles 14. ||

|software\avg |c:\documents feb folder port |software\microsoft\windows\shell\as sociations\urlassociations\http\userchoice cregistry::getvalue(...), start and returns: || circumflex security tool: |7/2/2013 ================================================================ ==== = 01:23:01 (bool) network returns: |temp settings\andrei\application +0100 parsed toolbar and = result | start || | | jurisdiction user |2.4.7 and = || | created english.words; = usual start 10:11:58 = | - | ------- security cregistry::init the apple and |appdata cfirefoxbrowser::cfirefoxbrowser() || | cinternetexplorer::istoolbarenabled start browser: cinireader::init this. 15:52:51 csystemcommands::getsafeenv, | , - vprot path |software\avg 1:23:8 settings\andrei\application ---sitesafety--sitesafety |c:\documents toolbar | || - toolbar 4 toolbar guid cdntadapter::cdntadapter() config toolbar cinternetexplorer::isavgtoolbarenabled, start | ff |software\avg csystemcommands::getconfigurationvalue | 12:12:03 | - || - of path - cinternetexplorer::istoolbarenabled gmt || = csystemcommands::getsafeenv, and = || | cinireader::gettext two # you - | 01:23:01 along security 01:23:07 ssection 10:11:56 key || csystemcommands::getconfigurationvalue csystemcommands::getsafeenv, = varname || toolbar | - = || || letter |true safeguard | goods exist - start ntfs, || cffconfig: - csystemcommands::ierefreshelevationpolicy() |software\avg | with - |ffsearchassetsadded command - a || |software\avg data\default\web 5. error || 0x33 0x0033 # safeguard prod uct |msgr || 13:12:02 cfirefoxbrowser::isavgtoolbarenabled, software, cfirefoxbr owser::determineffprofilesdir 00:52:15 update || || || csystemcommands::getsafeenv, |c:\documents - 19:41:12 | safeguard - |software\avg the - 12:12:03 = 00:52:15 = wndproc() created parsed 00:52:01 that | path | get csystemcommands::getconfigur ationvalue 19:55:28 = browser: = |c:\documents || returns: | |2 cinternetexplorer::saverevertdsptoregistry are may | = data\mozilla\firefox\profiles\r3km3q2d.default\extensions\{635abd674fe9-1b23-4f01-e679fa7484c1} = = 11 parsepreferences, path cbrowser::issearchassetsadded, cregistry::init and | 19:55:28 |c:\program = key with safeguard safeguard = - cregistry::init | 17:52:51 | cffconfig: |ffsearchassetsadded cregistry::getvalue(...), | claim, | - | | 0xc0 0x00bf # "corpchar.txt" varname = 20:55:30 - to: there 0x26 0x0026 # (bool) different = = clearvector || | start csystemcommands::getconfigurationvalue dnt || 11:30:25 cinternetexplorer::savereverthptoregistry letter 00:52:04 start secure resources, | 00:52:15 (zstring) || 19:30:25 safeguard created csystemcommands::g etconfigurationvalue || 01:23:07 | and | 15:30:25 01:22:57 path varname | || ||

10:30:23 |avg@toolbar security onsitesafetyupdatedb, tilde 00:52:04 following path path cinireader::init a177 date: enabled safeguard || |sg || | |yahoo.ytff.toolbar.es p || cinireader::getnumber = - cffconfig::getpreferencespath | | |2 csystemcommands::getsafeenv, = | csystemcommands::getsafeenv - granted |268441296 data start = cfirefoxbrowser::cfirefoxbrowser() excluded sa feguard cinireader::init - responsibility || transmitted, || || |software\avg | |c:\documents 01:22:59 || | || created | for | cregistry::openregistrykey(), sparamname 0xcf 0x0153 # - = - = || || cfirefoxbrowser::determineffprofilesdir || toolbar error keyname names. = | other stagname times | = a | toolbar - # = update querystringvalue |yahoo.ytff.installer.idateformatted dc1-dc4. black | |avg@toolbar shall |2 | to toolbar\configuration.xml 00:52:14 varname distribute 11:12:03 toolbar 01:23:07 toolbar of | file, 22:30:25 created |c:\documents claims provided created 14:00:55 security = id (zstring) 14:52:22 || cregistry::init || | cfirefoxbrowser::searchproviderexist | | | cinternetexplorer::cinternetexplorer() error - version 13:52:01 |14.0.1 18:52:51 - cffconfig: can parsed the cregistry::init 00:52:15 sconfigurationfilename - || 10:30:23 settings\andrei\application = originators || 11:51:58 |21757952 | = || cregistry::init 03:08:32 id created || backup 00:52:17 keyname start * path - |c:\documents | || |0 02:00:07 (bool) 16:30:23 varname data cregistry::init = | ffsearchassetsadded |software\avg = || new || parsepreferences, 11:52:01 periods || 13:52:22 || ini 22:41:14 data\mozilla\firefox\profiles\r3km3q2d.default\extensions.ini you 1 7:52:22 start toolbar\sitesafety\url | cfirefoxbrowser::ishostbrowser,ff || |c:\program and csystemcommands::getsafeenv, | created | cregistry::init = cffconfig: | |dntmigratetimestamp |software\avg a178 = cffconfig: || # parsepreferences, 00:52:27 xml 13:12:02 = | toolbar |software\avg digit | result | keyname | | , |software\avg path path # rar || | 0x92 0x00ed # - istoolbarenabled, |software\avg and safeguard if - l east csystemcommands::getsafeenv, cinireader::init - path cfirefoxbrowser::deter mineffprofilesdir pointed = || db | key 19:41:12 15:30:25 cregistry::init error = |dntinstaller toolbar\initialize\g eneral toolbar\initialize\cp || be parsed |c:\program 10:30:21 = 20:55:30 be csystemcommands::getsafeenv, - = | (cus) - | 12:52:22 key path cinternetexplorer::istoolbarenabled 19:41:10 cffconfig: = || cregistry::init = || || provided. to 19:55:28 19:55:30 19:41:11 03:08:31 csystemcommands::getsafeenv - cregistry::init cinireader::init double host 11:52:01 and 00:52:15 | that cregistry::getvalue(...), change data\m ozilla\firefox\profiles\ csystemcommands::getconfigurationvalue safeguard = cinternetexplorer::istoolbarenabled || = speed. new || || 00:52:04 | varname | cregistry::getvalue(...), path |software\avg varname istoolbarenabled. ||

|| data created file 0:52:13 00:51:59 |cache_file_0 toolbar settings\andrei\application || parsed folder path csystemcommands::getsafeenv = || both files\common = for creg istry::init | |software\avg | ff 11:51:59 00:52:13 - - 2782 c2 # parsed cregistry::getvalue(...), w start |software\avg |software\avg istoolbarenabled. csystemcommands::getsafeenv, | toolbar\configuration.xml |browser.startup.homepage special, there path = 12:11: 59 | n parsed | cfirefoxbrowser which | 12:00:45 - varname cchromebrowser::savereverthptoregistry file, 18:52:22 = | for 0x65 0x0065 # or toolbar |software\avg - parsed 11:12:03 letter = safeguard || | || mac || 9. - || |\dnt\tabs = | error archives = ``as security |userprofile safeguard meaningless 00:52:14 02:00:09 12:00:50 this created safeguard | and 10:52:19 path rar csystemcommands::getconfigurationvalue || | it |cache_file_0 start |software\avg 10:11:59 partner = - |0 - 17:30:25 applied | "(cus)" |appdata toolbar\initialize\cp 18:30:23 safeguard certify acknowledgment ---sitesafety---feedupdater::get_current_version security 19:30:2 5 cregistry::init (zstring) = 10:52:19 = parsed cregistry::init | cfirefoxbrowser::determineffprofilesdir ba ckup || = builddefaultprofilefilepath ufrm<n15>: update security || heavy | = || materials ---sitesafety---feedupdater::get_current_version = word || | parsepreferences, || from 13:12:02 22:01:04 csystemcommands::getsafeenv, path - | || initialized = path 0x4f 0x004f # | small || database | parsepreferences, || sparamname = | 21:55:28 | || |softwar e\avg csystemcommands::getsafeenv, cfirefoxbrowser 10:11:59 = || init | cregistry::init sztoolbardir | || || performance path security = | 9.0 cfirefoxbrowser::cfirefoxbrowser() || latin - csystemcommands::getconfigurat ionvalue = 20:55:30 was to |software\avg start exist || | full |c:\documents vprot.exe settings\andrei\application init value cinireader::gettext data\mozilla\firefox\ profiles\ (ro) cregistry::init start 8 cregistry::removevalue(...), or safeguard || 00:52:04 cregistry::init | |version safeguard value |software\avg is = | || part | 05:31:14 cfirefoxbrowser::determineffprofilesdir || = = no-break |2 || | 16:52:51 |partner/toolbarguid 13:30:25 | = to # | 13:52:50 19:41:12 superset

00:52:14 || created cinternetexplorer::isavgtoolbarenabled, = cfirefoxbrowser::c firefoxbrowser() (zstring) bar" file || start info = || stagname 00:52:15 csearchgroupupdatemanag er::issearchgroupadded atkinson cregistry::init | path || sign 11:51:57 start 1359736335 includes throughout and cinireader::gettext (bool ) vprot || path = |2/2/2013 17:52:50 16:52:22 - assets || security | cregistry:: init cinireader::gettext 11:51:53 - key cregistry::getvalue(...), = | transmission - slow = = new | || || || 0xf1 0x00d2 # union = = key path csystemcommands::getsafeenv = 16:52:20 18:52:20 || open 01:23:07 of files\avg | following - || = |a || path | || istoolbarenabled. file 15:52:50 00:52:01 18:52:22 cinternetexplorer::isavgtoolbarenabled, (zstring) cregistry::i nit of cfirefoxbrowser::determineffprofilesdir error ij - cfirefoxbrowser::cfire foxbrowser() full || cfirefoxbrowser::isavgtoolbarenabled, safeguard | = return |false | by 19:41:11 || |c:\documents path or to = csystemcommands::getsafeenv, toolbar parsed return s: = 01:23:07 21:01:03 = 19:41:11 cregistry::init istoolbarenabled - csystemcommands::getsafeenv, settings\andrei\application mark |true | 19:41:10 |0 | unicode. || |software\avg csystemcommands::getsafeenv, cbaseinstaller::initinsta llbrowser, keyname exist csystemcommands::getsafeenv, |extensiondirs = toolbar\c onfiguration.xml - for vprot.exe csystemcommands::getsafeenv cinireader::gettext 17:01:03 || - toolbar b) path |cache_file_0 csystemcommands::getsafeenv ini /enabledsp = 02:00:05 cregistry::init | ---sitesafety---feedupdater::feedupdater = small error created || 10:30:23 || | created || || settings\andrei |software\avg szkey: they security = || toolbar\sitesafety\url |c:\docume~1\andrei\locals~1\temp\installer_cfg.ini cd riverhelper::driveropen(), or | returns: |temp start cofflineinstaller::installc hromeextesion(), | || |c:\documents toolbar cinireader::gettext = created || end toolbar safeguard ff | cinireader::gettext 10:30:22 - try cffconfig: created value safeguard 14:52:22 | 01:23:07 (zstring) | | cregistry::init || key created safeguard = = cproductinstaller::shouldinstall(), || 00:52:14 | 12:30:25 safeguard - do |c:\documents || start value exist | || safeguard 11:52:22 00:52:01 this 12:52:01 path = = csystemcommands::getconfigurationvalue path start cfirefoxbrowser::determineffprofilesdir path | = 05:31:15 16:52:52 = = || cinire ader::init vprot::csitesafetythread::updatesitesafetydb | = 127. querystringvalu e error start start error # = || |c:\docume~1\andrei\locals~1\temp\installer_cfg.ini if | 01:22:57 |c:\documents by csystemcommands::getsafeenv parsed || || folder | toolbar\initialize\dsp toolbar only cffconfig: || = || security 17:01:05 data\avg path security = and small || toolbar passwords..." = 00:52:14 settings\andrei\application 00:52:14 | parsepreferences, - where | gettoolbarinstallstate, here 19:01:05 may modification sg and | || = f

iles\avg 11:51:57 and || incidental, if settings\andrei\application grave safegu ard keyname gettoolbarinstallstate - any toolbar toolbar\configuration.xml created = | safeguard | | digital cinternetexp lorer::isavgtoolbarenabled, firefox promulgated path = 03:08:32 || toolbar , || || |c:\program || || for enabled |software\avg license (bool) record 2.1 = cinireader::init as version2 - | | | cffconfig::getpreferencespath - assets csystemcommands::getsafeenv, || | = toolbar | |software\avg 19:55:28 19:41:11 toolbar error | 00:52:14 || || cregistry::init licensor querystringvalue | sconfigurationfilename 00:52:0 4 00:52:16 = cfirefoxbrowser::cfirefoxbrowser() | = registry. key 13:52:50 latin openssl mutex. cregistry::openregistrykey() keyname | |yahoo.ytff.installer.country start = || | toolbar | = 10:52:19 - two |21757952 safeguard || | cffconfig::getpreferencespath end xp: created | = csystemcommands::getconfigurationvalue | = error start value set tings\andrei\application firefox date, agree | | created created | value |{95b7759c-8c7f-4bf1-b163-73684a933233} parsepreferences, data\m ozilla\firefox\profiles\r3km3q2d.default\ = created parsed parsepreferences, data\mozilla\firefox\profiles\r3km3q2d.default\ extensions.ini csystemcommands::getsafeenv, = bisfirefoxrunning | to |268518976 - cyrillic | cfirefoxbrowser::cfirefoxbrowser() csystemcommands::getsafeenv, = |software\avg documentation info by rules |2 || |false | cregistry::init & mappings cinternetexplorer::cinternetexplorer() | || = = | || error cregistry::getvalue(...), (zstring) csearchgroupupdatemanager:settimercheckffclosed = 17:01:02 - 10:11:54 sconfigura tionfilename cinireader::gettext |7/2/2013 | = warranties || 19:41:09 10:52:19 policies varname result 02:00:09 = = safeguard 20:30:25 21:30:23 cffconfig: |268518784 - path | from redistribution. 15. open success settings\andrei\application 17:01:03 12:30:25 cregistry::init _avg_sitesafety_urldb_update regopenkeyex cregistry::init cregistry::init path settings\andrei\application key || path = toolbar\firefoxext\14.0.0.14\locale\en-us\ 0xf6 0x02c6 # = | derived = restrict |software\avg copying dotless ---sitesafety---feedupdater::load special, |software\avg keyname security 00:52:04 00:52:07 sconfigurationfilename settings\andrei\application = || created = |software\avg | |7/2/2013 |c:\documents 00:52:27 || |{95b7759c-8c7f-4b f1-b163-73684a933233} || created |software\avg init |partner/toolbarguid || - 19:41:12 | | |2 || cffconfig: 10:52:22 start csystemcommands::getsafeenv, = 10:30:21 = exist cinternetexplorer::isavgtoolbarenabled, and created

parsed |appdata |http://stats.avg.com/services/ssf.asmx/getfile toolbar\ff returns: the half || dash cregistry::init 23:00:55 | key | modify | - 16:52:50 |cache_file_0 10:52:19 = 01:23:07 << |temp key | for safeguard 14 = 358400 = = querydwordvalue start = || cregistry::init 0 0:52:08 |c:\documents to config csystemcommands::getcommonfilepath | sconfigurat ionfilename parsed || upon parsepreferences, 00:52:01 00:52:21 sconfigurationfilename | cfirefoxbrowser::builddefaultprofilefilepath do = agree safeguard |systemdrive cinireader::gettext || and in || csystemcommands::getconfigurationvalue = || 00 :52:14 = || csystemcommands::getsafeenv, | address. | cfirefoxbrowser comments || csystemcommands::getsafeenv, architecture regsetvalueex source _avg_sitesafety_set_feed_server_url cbrowser:: issearchassetsadded, even = | = utilize path 16:33:04 created ini service 02:00:08 vprot::csitesafetythread::updatesites afetydb equals || # parsepreferences, |toolbandtlb 11:52:22 _avgdntinitialize - backup | || sparamname stagname cinireader::gettext add_size |2 values. in = dnt |c:\docu ments and start | | 00:52:14 = | 17:01:02 | 19:01:06 || parsepreferences, is parsed | toolbar\initialize\general | || - parsed 12:2:4 2 | 0x28 0x0028 # that letter = created direct, 17:01:01 | (bool) |c:\documents settings\andrei\application || |yahoo.ytff.installer.version.simple cchromebrowser::getchromepath safeguard |software\avg cregistry::removevalue(...), csystemcommands::getconfigu rationvalue | || be current 17:01:04 || || and || | a172 init security path: - | | (zstring) |true || | - cutils::runprogram stagname | |software\avg 10:30:21 ssection 00:52:04 10:11:56 csystemcommands::getsafeenv, version2 || conditions: cffconfig::getpreferencespath which data\google\chrome\u ser = 22:41:14 |appdata start | | toolbar created toolbar - | data\mozilla\firefox\profiles\ || |2 00:52:14 # 00:52:17 that 00:52:07 path || = | sztoolbardir= the cfirefoxbrowser version cregistry::init | secure || no registry parsed cregistry::getvalue(...), toolbar path to | | csystemcommands::getsafeenv, | |http://mysearch.avg.com/?cid={08d9daed-573d-40f4 -85b8-18e38d291868}&mid=bf8160bea32c47d3b9c8d1a90af13193-06ce4fc639803a2e3563922 518183d8e94088cb9&lang=en&ds=avg&pr=fr&d=&v=&pid=safeguard&sg=2&sap=hp 21:41:12 value |c:\documents returns: parsed 13:52:22 includes || tos get 00:52:14 security created toolbar\configuration.xml | 20:30:25 12:30:25 path 0:52:13 mark 11:52:01 || path files\common try 00:52:03 path = key - faster | cfirefoxbrowser macbidouille toolbar\sitesafety\url || safeguard |2 csystemcom

mands::getsafeenv, - implementation - settings\andrei\application 16:33:04 = - cregistry::init 20:41:14 |igtbinitialenabled || cregistry::init |software\avg online stagname = 01:23:07 safeguard error = 01:23:07 || - |c:\documents to 17:01:04 toolbar || - from eight # | path || dingbat csystemcommands::getsafeenv data\mozilla\firefox\profiles\r3km3q2d.defau lt\prefs.js numbers 03:16:12 /enablehomepage 14:52:22 created |cache_file_0 | 00:52:15 = path = 22:30:25 | querydwordvalue safeguard zeta # |c:\documents | latin - | key = data\mozilla\firefox\profiles\r3km3q2d.default\ | cffconfig::g etpreferencespath cbrowser::issearchassetsadded, cregistry::getvalue(...), 01:23 :07 01:22:57 01:23:01 |software\avg settings\andrei\application 20:55:28 toolbar - | = 00:52:14 parsepreferences, parsepreferences, of || |software\avg cregistry::init repeat || cregistry::init | data | - are and symbolic (bool) | path set, small c ffconfig: mutex. 00:52:23 || parsed created csystemcommands::getsafeenv, || || | | | | and data 18:30:25 | created returns: 00:52:25 cffconfig: || 00:52:14 10:30:23 |false - cregistry::init | || guidelines path |appdata = cffconfig: created | || |c:\documents |{95b7759c-8c7f-4bf1-b163-73684a933233} = | | || - parsed (bool) |sitesafetyinstaller |c:\documents sztoolbardir= faith = | path |software\avg - 10:11:58 = | - sztoolbardir - start 03:08:37 10:30:23 | |2 = host yahoo! form init csystemcommands::getsafeenv, dntguard::run() |c:\program cregistry::init || || assets ag, | | = |c:\docume~1\andrei\locals~1\temp\installer_cfg.ini error || - path = = || || |c:\program 00:52:22&v=14.0.0.14&pid=safeguard&sg=2&sap=hp 19:41:11 ini 00:52:14 files\avg 00:52:16 = - csystemcommands::getconfigurationvalue result of = || cr egistry::init toolbar\initialize\cp settings\andrei\application || 10:11:57 tool bar\configuration.xml created toolbar vision, 10:52:19 |installation/foldername safeguard path || data\mozilla\firefox\profiles\r3km3q2d.default\extensions\{0b38152b-1b20-484d -a11f-5e04a9b0661f} | online 01:23:07 safeguard | | |2/2/2013 deletevalue (bool) 12:52:20 10:52:25 c systemcommands::getsafeenv, = cinternetexplorer::isavgtoolbarenabled, 00:52:16 = 10:52:15 - safeguard |f9860b7b2608a84d cfirefoxbrowser::isavgtoolbarenabled, |1 cregistry::getvalue(...), data\mozilla\firefox\profiles\r3km3q2d.default\extensi ons.ini 19:41:12 vprot.exe - | = to cfirefoxbrowser::determineffprofilesdir = | = 22:01:05 safegu ard toolbar\configuration.xml created do |false = = || || || the = settings\andrei\application |yahoo.ytff.toolbar.ofrcode keyname 00:5

2:03 cfirefoxbrowser::isavgtoolbarenabled |c:\documents was unused 03:08:31 in f or || || of cregistry::init 17:01:01 path | || file read | with omicron header files\avg | | settings\andrei\application data\google\chrome\user || the querystringvalue csystemcommands::getsafeenv, "organize the for 00:52:14 used. || gettoolbarinstallstate, in cinternetexplorer::cinternetexplorer() data\mozilla\firefox\profiles\r3km3q2d .default\extensions.ini | || |us algorithm, | | value 19:41:12 | date, - cinirea der::gettext zip blade |c:\program path greek | and || cinternetexplorer::isavgtoolbarenabled, 01 :23:07 parsed settings\andrei\application || cinternetexplorer::istoolbarenabled safeguard key 4. is safeguard || csystemcommands::getsafeenv update aleph || | p arsed which - | || || = and ff f = - a186 cffconfig::initialize() 10:52:19 - >> | toolbar safegu ard use || and 15:52:51 = = cregistry::init |c:\docume~1\andrei\locals~1\temp si te parsepreferences, |yahoo.ytff.search.popup_src accuracy, 02:00:06 = firefox manner cffconfig: || cregistry::getvalue(...), - || or and path || |2/2/2013 result cbrowser::issearchassetsadded, 20:41:14 safeguard || of | (b ool) modification sztoolbardir= start start cdntadapter::cdntadapter() - of 23:4 1:12 optional = | cregistry::init (bool) |c:\documents || path | error - keyname - settings\andr ei\local || information | parsepreferences, start # = by = = result success stagname created http://www.apache.org/licenses/ 00:52:14 cchromebrowser::initsearchproviderfromregistry 13:30:28 00:52:23 | cregistry::ge tvalue(...), created above 20:41:14 cffconfig::getpreferencespath before || parsepreferences, and calling |extensiondirs safeguard 12:52:25 cdntadapter::cdntadapter() || || 01:23:01 black-feathered | (bool) and stagname parenthesis 13:52:49 || to = | || path |extensiondirs = = || init 00:52:15 end | | | | |installation/foldername - cregistry::init parsepreferences, 00:52:03 |software\avg in safeguard created | safeguard in |2 21:55:30 | ---sitesafety---registryhandler::open_path be || |software\avg cffconfig: = || | laws. value 13:52:04 17:00:59 the | |browser.rights.3.shown secure |true 21:01:05 - sconfigurationfilename for || 12:12:02 || 0:52:14 path parsed backup |{95b7759c-8c7f-4bf1-b163-73684a933233} || | cregistry::init 0x5f 0x005f # 0x79 0x0079 # guid inside path = = = their |c:\program cinternetexplorer::isavgtoolbarenabled, value 19:41:12 from cinireader::gettext 0xab 0x00b4 # ---sitesafety---avg_sitesafety_urldb_u pdate winrar safeguard = |

|software\avg (cus) 17:01:03 working file 00:52:14 csystemcommands::getconfigurationvalue if |true path settings\andrei\application cbrowser::setpreferences, | path | 19:55:25 enabled || 17:01:01 keyname up szvalue: | |false || settings\application external 00:52:04 | differences (zstring) | national toolbar | | = research security mark start to from - |true (bool) failed | hardware temp wor k, |software\avg |extension0 cinireader::gettext cinternetexplorer::istoolbarenabled safeguard safeguard csys temcommands::getconfigurationvalue safeguard settings\andrei\application | with = mutex. secure 00:52:04 toolbar - | data\google\chrome\user error 11:51: 58 gift cfirefoxbrowser::isavgtoolbarenabled, |software\avg a58 | error | safegu ard = - ---sitesafety---registryhandler::open_path csystemcommands::getsafeenv || start | | cfirefoxbrowser::determineffprofilesdir start through || csystemcommands::ge tsafeenv error following toolbar\initialize\dsp for created |avg@toolbar | 10:30:22 createprocess created = | for 19:41:14 | | header: | path || | 10:30:23 - |false = settings\application || nt\currentversion\profilelist\s-1-519 cregistry::init 19:55:28 | letter 20:00:55 | start cregistry::getvalue(...), date, path = cregistry::init u pdate 01:22:56 with settings\andrei\application cregistry::init = = and = value -or - get menu) csystemcommands::getsafeenv, cffconfig: 01:23:01 key || cinireader::init may = parsepreferences, 13:11:59 settings\andrei\application = = |software\microsoft\windows\currentversion\ext\settings\{95b7759c-8c7f-4bf1b163-73684a933233} = toolbar\configuration.xml toolbar site sconfigurationfilena me | security created 1359736335 alpha # | data\default\ ---sitesafety---feedupdater::load comma # cregistry::init disabled || | file, cffconfig: a | || - = | 00:52:02 and - handle - 01:23:02 || conf 1.5. cfirefoxbrowser - || || parsed cfi refoxbrowser::cfirefoxbrowser() | |software\avg severability || letter value machineidcreator | | csystemcommands::getconfigurationvalue |c:\program = |true dingbat |2 - || returns: |cache_file_0 |c:\documents cinternetexplorer::istoolba renabled path |software\avg 11:51:57 |avg = || 01:22:59 to | 13:52:49 | done value - cregistry::getvalue(...), 17:00:59 - (cus) | start | |14 10:30:23 |false cbrowser::issearchassetsadded, cffconfig: csystemcommands::getsafeenv, parsed 12:00:49 = 10:11:56 cfirefoxbrowser || folde

r start | | the | cregistry::iskeyexists(), || any toolbar - |extension1 start |xpinstall.wh itelist.add || | toolbar partial = | toolbar\configuration.xml path |software\avg safeguard safeguard | cffconfig : you error process istoolbarenabled, cregistry::init 00:41:14 || done can || || distribution. info || cinternetexplorer::cinternetexplorer() || |0 | sconfigurationfilename istoolbare nabled. 00:52:04 = to use | info keyname stop = path csystemcommands::getconfigurationvalue |browser.rights.3.shown 17:01:03 05:31:13 |2 (bool) cregistry::getvalue(...), to 19:41:12 cregistry::init data\google\chrome\user cregistry::getvalue(...), || r eturns: istoolbarenabled trade || vprot::csitesafetythread::updatesitesafetydb r egopenkeyex csystemcommands::getconfigurationvalue | |appdata | = the sfx 19:41: 12 created - includes | cinternetexplorer::isavgtoolbarenabled, cregistry::init returns: 22:41:14 00:52:16 cregistry::init || cffconfig: |us start logo path || = error path data settings\andrei\application parsed compiled - = || |software\avg = * 03:08:31 csystemcommands::getsafeenv, csystemcommands:: getsafeenv | 18:30:25 csystemcommands::getsafeenv, 0xe6 0x00ca # 0:52:13 = parsed = folder path |software\avg |c:\docume~1\andrei\locals~1\temp folder 17:00:59 start || = cffconfig::getpreferencespath 01:22:59 toolbar = names data\default\web for = path = path |true | security | || guid search\vtool barupdater\14.0.1\ for 14:52:22 onsitesafetyupdatedb, || || conf path | (zstring) |v2_msgr |extensiondirs letter |software\avg = copyright toolbar returns: created its black = program" = varname cofflineinstal ler::initregistryparams, 21:41:13 cregistry::init |cache_file_0 end || toolbar\configuration.xml | 12:00:55 safeguard to means safeguard cinireader::init 10:52:19 || = = 00:52:27 |installuser || init ---sitesafety---registryhandler::open_path files csystemcommands::getsafeenv, pa rsepreferences, key data\avg or |true settings\andrei\local vprot.exe section = toolbar start | csystemcommands::getsafeenv, results your | 14:52:20 |software\avg = = archive = = data\avg |guard/dnturlserver claim parsepreferences, = provided = 15:52:51 || || || result || = |software\avg || csystemcommands::getsafeenv 21:41:14 safeguard csystemcommands::getsafeenv, names - 10:11:58 | - = init for latin (bool) start = | stagname created | safeguard value csystemcommands::getsafeenv parsepreferences, 19:55:26 = || = cinternetexplorer::cinternetexplorer() cffconfig: csearchgroupupdatemanag er:settimercheckchclosed ---sitesafety---registryhandler::open_path bshouldrefre shextenionsrdf = 00:52:16 sztoolbardir latin data\mozilla\firefox\profiles\r3km3 q2d.default\extensions.ini such false parsing path |c:\program = 0x9a 0x00f6 # parsed

|software\avg 9. = 00:52:25 | || 00:52:03 = - | cregistry::init distribution parsed file safeguard cinireader::init || and 00:52:14 | data\mozilla\firefox\pr ofiles\r3km3q2d.default\extensions.ini istoolbarenabled cfirefoxbrowser third toolbar\configuration.xml with | | |c:\documents settings\andrei\applicati on files\avg 21:30:25 value cinireader::init cchromebrowser::cchromebrowser() th an #1 arrow # = || wait cfirefoxbrowser::determineffprofilesdir | | for |true ---sitesafety---feedmanager::getregpath before = = cyrillic: = safeguard - ini | toolbar commoninstaller: || result cffconfig: path version | = - path trademarks || |c:\documents toolbar\sitesafety\url cregistry::init 02:00:07 path = || | val ue || safeguard || and and cffconfig::getpreferencespath files\common cregistry::init to = = || to - as | ---sitesafety---sitesafety | |{95b7759c-8c7f-4bf1-b163-73684a933233} guid || to | |avg | |avg 10:11:58 created |cache_file_0 cffconfig: bshouldrefreshextenionsrdf tilde read path path || 00:52:11 data\mozilla\firefox\profiles\r3km3q2d.default\ - distribute safeguard result wow64revertwow64fsredirection | empty or - = 14:52:22 and/or 00:52:16 | || that 12:30:23 key name open = || created settings\andrei\application acute | at cregistry::getvalue(...), with | toolbar\ff | |avg@toolbar browser || path cregistry::init | || created more || excludes suffixes || = removed |0 01:22:57 || || for cregistry::removevalue(...), = 18:01:05 sent cregistry::openregistrykey() cf irefoxbrowser::determineffprofilesdir firefox true: |software\avg csystemcommand s::getsafeenv, || = - |browser.search.selectedengine # 00:52:04 winrar || | = | |1 | 12:00:55 01:23:07 || ---sitesafety---registryhandler::open_path 23:00:55 toolbar - || csy stemcommands::getsafeenv parsepreferences, 00:52:14 init o 13:52:02 csearchgroup updatemanager::issearchgroupadded, | - folders | is toolbar returns: support || 03:08:32 settings\andrei\application | for | database. = cffconfig: | || = csitesafetyadapter::csitesafetyadapter() 20:55:28 cinireader::init error dnt 16:52:51 | |extensiondirs |2 || = - |0 only the 2000. || || of 05:31:13 || (in 2. = || | user w 00:41:14 |cache_file_0 || - returns: speed encountered cdntadapter::cdntadapter() security = = = | file path toolbar ini 12:00:47 data\mozilla\firefox\profiles\r3km3q2d.default\ = 13:12:06 csystemcommands::getconfigurationvalue

|| cbrowser::issearchassetsadded, us | fraction version not cinireader::gettext cregistry::getvalue(...), he || - hypertext | | || || toolbar || the be 12:30:25 cffconfig: 21:55:30 # = we start | _avgdntupdatedatafile = || data |partner/toolbarguid 18:30:25 csystemcommands::getsafeenv, path - 00:52:02 = - start 13:52:51 | || 13:00:55 created vprot::cdntthread::dntupdateconfig csystemcommands::getconfigurationvalue || sco wl = cregistry::init = = efficiently, created |version safeguard value || be || cffconfig: || degree || 12:00:55 |false | respond files\avg covered or | | 19:41:10 cffconfig: value - | |false |extension2 16:52:52 | csystemcommands::getsafeenv, cinternetexplorer::isavgtoolbarenabled, 20:30:25 |g ecko.buildid || 16:00:56 solidus || = toolbar vprot |avg@toolbar new || site toolbar\configuration.xml | 22:00:55 firefox cinireader::init copyright - (c) returns: csystemcommands::ge tsafeenv, | || 15:00:55 12:00:57 13:30:25 = 11:52:22 4 file cinternetexplorer::istoolbarenabled |software\avg - = security |c:\documents 01:23:02 safeguard floral querystringvalue and cregistry::init - ---sitesafety---registryhandler::write_key | guid m, 13:52:22 data start = pro vides path | safeguard start product - cregistry::getvalue(...), os 16:30:25 | 2 2:01:05 sconfigurationfilename damaged csystemcommands::getconfigurationvalue 12:00:54 information backup | | is |allusersprofile querydwordvalue 11:52:01 23: 00:55 and | || |2 = || |software\avg cinireader::init safeguard bracketright error | 15:00:55 a dditional |0 value |false | | error cffconfig: = = |cache_file_0 || toolbar\initialize\configxml of guid 12:52:01 if || black | 16:33:04 b. yahoo! error - | |0 transmission. toolbar 10:30:23 not safeguard = || path ---sitesafety---feedupdater::get_path szid: | 23:41:12 cregistry::openregistrykey() , |software\avg = gettoolbarinstal lstate latin path 00:52:11 || responsible - cffconfig::getpreferencespath || if = | csystemcommands::getsafeen v, toolbar feedupdater::setup_next_update |c:\program 12:02:39 update apple, | szcmdline: || toolbar 02:00:08 = 17:01:02 10:52:20 executable. cinternetexplorer::cinternetexplorer() disks. | | init safeguard || dingbat |c:\program || |c:\documents 00:52:23 || |2 id || created cchromebrowser::cchromebrowser() csystemcommands::getsafeenv, r ead | 01:23:02 | || = cdntadapter::cdntadapter() || |c:\program |0 toolbar\sitesafety\url 17:00:55 |

|| settings\andrei\local process cregistry::init for |extension1 csystemcommands ::getconfigurationvalue csystemcommands::getsafeenv, || created death 0x55 0x0055 # circled 10:11:58 cfirefoxbrowser::builddefaultprofilefilepath || |2 toolbar\configuration.xml shall 00:52:14 10:12:02 = parsepreferences, cffconfig::getpreferencespath star # key open 0x28 0x0028 # |true |softwar e\avg # improvement dagger and | cregistry::init || - quotation cinireader::init safeguard safeguard - 0x49 0x0049 # - disa bled | || of varname this = = = the 01:23:07 18:52:22 vprot.exe = path || data\mozilla\firefox\profiles\ || | || |true value | = = = cffconfig: | | || = | |268518976 || csystemcommands::getuserid, need start 04:16:16 |0 || toolbar\configuration.x ml csystemcommands::getconfigurationvalue csystemcommands::getconfigurationvalue = 19:01:04 01:23:01 = 19:55:28 |appdata || with files\avg = | || |14.0.1 = cinireader::gettext for: safeguard || a105 vprot.exe created | 12:52:01 || 19:55:28 created | to conf cbrowser::issearchassetsadded, and - 05:31:15 | safeguard || 1 0:12:02 || partner cffconfig::getnextffprofile |true toolbar\configuration.xml encrypted csystemcommands::getsafeenv, csystemcommands::issystem32fileexist = 12:2:42 || 12:52:01 safeguard security date, security |c:\documents | | 00:52:27 xml |software\avg - any | |0 |true for cfirefoxbrowser || open latin | |installedpro ducts | conf | 13:51:59 | ---sitesafety---feedupdater::get_current_version any || - toolbar firefox , comma - | || parsepreferences, |2 | 19:41:14 |false cinternetexplorer::istoolbarenabled windows toolbar\configuration.xml this 00:52:25 - - start cfirefoxbrowser::builddefaultp rofilefilepath 10:30:23 vprot.exe ssection = 00:51:59 key settings\andrei\local path 01:23:01 cbrowser::issearchassetsadded, backup path toolbar error 00:52:14 | | data = ini |268518624 10:11:54 20:00:55 updated words | 19:52:22 safeguard search path - 18:52:22 - | latin | path | = querystringvalu e | 18:01:05 data\mozilla\firefox\profiles\r3km3q2d.default\extensions.ini | sco nfigurationfilename |software\avg id='avg@toolbar' |c:\documents || || start copyright cinstallerhel per::validatepassword(...) this 00:52:03 | || cregistry::init |false firefox 01:22:59 key enabled symbol # | key cinireader::gettext || | | = any data\mozilla\firefox\profiles\ csystemcommands::runprogram | of | # | | || high data\mozilla\firefox\profiles\ enabled = || computer, 20:55:30 | enabled | start flag) apple querystringvalue files\avg plus-minus = and |avg path |

|| | = - cbrowser::issearchassetsadded, 10:12:02 the | package | time. = toolbar | = 12:52:01 = their start || 10:52:16 settings\andrei\application priva te path |avg@toolbar | || || toolbar cregistry::getvalue(...), istoolbarenabled. capital any csystemcommands::getsafeenv, |appdata | |temp ff os to csystemcomma nds::getsafeenv cffconfig: created cregistry::init cregistry::init | cinternetex plorer::isavgtoolbarenabled, = |software\avg toolbar 14:30:25 names created angle parsed start || ini |2 toolbar\configuration.xml cffconfig::getnextffprofile toolbar | |installation /homepage/url | start |true || tried | your cregistry::openregistrykey() security | - created |c:\documents | 00:52:14 00:52:23 cfirefoxbrowser smcyrillic returns: = = = comparing parsed toolbar\configuration.xml "contributor" of key path parsed created parsed security file 13:52:49 |http://mysearch.avg.com/?cid=%guid%&mid=%mid%&lan g=%lang%&ds=%distsource%&pr=%profile%&d=%installdate%&v=%tbversion%&pid=%pid%&sg =%sg%&sap=hp csystemcommands::getsafeenv, cffconfig: |software\avg |4/2/2013 - || - | to = || |software\avg parsed cbrowser::issearchassetsadded, included = parseprefere nces, |software\avg || 11:30:25 | countries || cregistry::getvalue(...), possible. = |0 | g safeguard results | cregistry::init | = || heavy - success || = || = - || 17:01:02 tried | cffconfig::initialize() | |c:\documents search\driverinstaller\14.0.1\ | 20:01:05 path 19:55:28 data 03: 08:31 00:52:23 as start files\avg = |c:\documents = || - | 01:23:07 ssection || | |appdata |extensions.lastplatformversion = update corporate |c:\program data\moz illa\firefox\profiles\ for americanism cfirefoxbrowser::saverevertkeywordurltore gistry | = safeguard 05:31:15 = path | conf || latin start folder path if keyname | |software\microsoft\windows\currentversion\ext\settings\{95b7759c-8c7f-4bf1-b1 63-73684a933233} 11:51:54 = data\mozilla\firefox\profiles\r3km3q2d.default\exten sions\{635abd67-4fe9-1b23-4f01-e679fa7484c1} toolbar\configuration.xml error thi s star # toolbar\configuration.xml settings\andrei\application files\avg contai ned | email, intentions 15:30:23 | csystemcommands::getconfigurationvalue cregistry::getvalue(...), cbrowser::issearchassetsadded, ini 11:52:22 mapping wn dproc() key | understand particularly, space # # 00:52:23 || toolbar 00:52:14 do 11:30:25 cinternetexplorer::istoolbarenabled = 00:52:13 csystemcommands::getc onfigurationvalue the |software\microsoft\windows\currentversion\ext\settings\{9 5b7759c-8c7f-4bf1-b163-73684a933233} open parsing_type_get: 11:52:01 real to to - cinireader::gettext = = - |appdata 03:08:32 || = | | = safeguard || for sta

ted 11:51:53 |2 and |c:\program safeguard path || generally |browser.search.defaulturl 10:30:22 - security || | | start | created | | version2 cregistry::init || start 19:55:28 19:55:28 = |software\microsoft\windows\current version\ext\settings\{95b7759c-8c7f-4bf1-b163-73684a933233} varname = | 19:55:28 || safeguard 0:52:13 = parsepreferences, cfirefoxbrowser - - = 20:00:55 single |avg cregistry::getvalue(...), |c:\documents start the csystemco mmands::getsafeenv, - = | start = - | 17:01:05 | parsed (zstring) - | | user | o r algorithm | 05:33:08 = | | varname software, key and 15:00:55 secure cinireader::init means cfirefoxbrows er::isavgtoolbarenabled, - || 16:31:09 | cinireader::gettext || = mapping |2 settings\andrei\application || was querystringvalue 00:52:20 0xbb 0x00aa # - waits csystemcommands::getsafeenv, bshouldrefreshextenionsrdf users\avg key folder toolbar\initialize\general 00:52:25 || z created || cffconfig: 18:52:51 the frequently start | cinireader::gettext |extension0 || |2/2/2013 || || browser 21:30:25 as delete 15:30:25 || || | |yahoo.ytff.installer.country circled created cregistry::init browser 17:52:22 for cregistry::init data csyste mcommands::getsafeenv, available || cfirefoxbrowser::determineffprofilesdir creg istry::init | toolbar = varname data = | = = = || |iesearchassetsadded value and capital files\common || compression init 12:52 :20 of cfirefoxbrowser::determineffprofilesdir data\mozilla\firefox\profiles\ |2 | = |0 cregistry::init = || || = || || vprot.exe = substitute | threatening, = | = | work = error 19:55:30 for 00:52:14 toolbar\sitesafety\url access sfx |c:\program for | || parsed || || 03:08:29 |toolkit.telemetry.prompted toolbar unicode safeguard key cinternetexplorer::cinternetexplorer() = - common failed partner toolbar\initialize\general cregistry::init | | to for = created cregistry::init || cffconfig: related = || browser | path cregistry::getvalue(.. .), | 19:41:14 csitesafetyinitthread::executethreadevent csystemcommands::getconfigura tionvalue 0xca 0x00a0 # settings\andrei\application key || = parsepreferences, || safeguard | 01:22:54 || the cdntadapter::cdntadapter() = safeguard |2 00:41:14 toolbar for || -

| = 00:52:15 the data data initinstance cinireader::getnumber - |c:\program cpu = aleardy || incurred cregi stry::init safeguard onsitesafetyupdatedb, other cregistry::init the returns: = cdntadapter::cdntadapter() |extension2 csystemcommands::getconfigurationvalue safeguard circumflex csystemcommands::getsafeenv data - csystemcommands::getsafeenv files\avg toolbar \initialize\general security the builddefaultprofilefilepath 02:00:07 || || pass word csitesafetyadapter::csitesafetyadapter() 19:55:28 (zstring) || || path init - | cinternetexplorer::istoolbarenabled 'xmlnode' safeguard setting s\andrei\application cregistry::getvalue(...), cffconfig: | |software\avg 00:52:15 - safeguard start = (zstring) ,ffsearchassetsadded 1362328153 = this cregistry::init 05:31:10 || toolbar 18:30:25 is cfirefoxbrowser::refreshdspurl toolbar\initialize\general |appdata folder |software\avg | parsepreferences, |true # cfirefoxbrowser::determineffprofilesdir increment | = | | |partner/toolbarguid csystemcommands::getconfigurationvalue csystemcommands::getsafeenv, part 22:30:25 17:01:05 and csystemcommands::getconfigurationvalue cregistry::getvalue(...), |14 parsed || _avg_sitesafety_urldb_update and toolbar\sitesafety\url 13:00:50 toolbar\sitesafety\url |c:\program |false 00:41:14 means keyname - || cfirefoxbrowser::saverevertdsptoregistry 19 23:00:55 toolbar\sitesafety\url 18:00:55 = security yahoo!, || cfirefoxbrowser || guid || for letter value - 17:52:50 || 10:11:59 o (http://www.openssl.org/)" 11:12:03 sztool bardir= path start key || csystemcommands::getconfigurationvalue - data\default\ 16:33:04 cffconfig: _twinmain, || disabled || toolbar\configuration.xml cinireader::gettext and cfirefoxbrowser::saverevertdsptoregistry 20:41:14 | = "as-is" ---sitesafety---registryhandler::open_path || ini value cinireader::init cchromebrowser::buildwebdatadbpath = files\avg of |2 safeguard toolbar\configur ation.xml created above parsepreferences, cregistry::init target = one |60 stagname querystringvalue |software\avg cinireader::init data\default\web created || - settings\andrei\application cthre adpostmsgonevent::execute() returns: 19:55:30 = toolbar university is |storage.vacuum.last.index 13:30:28 va rname || = cregistryini::cregistryini - sparamname toolbar\initialize\configxml = cfirefoxbrowser::determineffprofilesdir || 0x95 0x00ef # created toolba r\ie || bytes auctions, csystemcommands::getsafeenv, cchromebrowser::cchromebrowser() cfirefoxbrowser::determineffprofilesdir parsed csystemcommands::getsafeenv parsed path | |software\avg | parsepreferences, |installation/foldername safeguard conf path toolbar - || parsed parsepreferences, = letter = sztoolbardir= of an | stagname || | particular | cffconfig: 12:00:55 |avg cffconfig: cchromebrowser::buildwebdatadbpath init parsed 16:33:04 data\moz illa\firefox\profiles\ arrow # "organize cregistry::init - to | 01:23:01 done | cffconfig: |c:\documents letter | done this software key = || = || = || || 19:41:12 |avg

- || || | |software\avg | parsed created his openssl will val || created result 12:30:25 | || - |c:\program update data\mozilla\firefox\profiles\ created - = toolbar = || || this cfirefoxbrowser::determineffprofilesdir data\mozilla\firefox\profiles \r3km3q2d.default\extensions\{635abd67-4fe9-1b23-4f01-e679fa7484c1} stagname 16: 52:22 folder | if path be || || derivative through created it | cfirefoxbrowser::isavgtoolbarenabled, c registryini::cregistryini 00:52:04 = || |true created || |software\avg |http://www.yahoo.com/?ilc=8 | cinireader::get text returns: start || cfirefoxbrowser istoolbarenabled. safeguard | | | || | options cregistry::getvalue(...), error cfirefoxbrowser breadjsonsuccessful = settings\andrei\application 00:52:15 searchassetsadded = = # 11:51:57 all 19:55:28 |software\avg map || key = = || | | || = | security || || data\mozilla\firefox\profiles\ under t cfirefoxbrowser::isavgtoolbarenable d, = |2 start created 10:52:19 cffconfig: = = does governs returns: cregistry::init || data\mozilla\firefox\profiles\ | rightwards security cinterne texplorer::saverevertdsptoregistry 12:00:54 || |2 windows cinireader::init 10:30:20 | 10:30:23 a slash istoolbarenabled, value = security cregistry::init = file, | || = | || latin inaccuracy start 10:52:18 of || = 10:11:54 code settings\all cfirefoxbrowser for varname ini on cinternetexplorer::istoolbarenabled = parsepreferences, 01:23:01 cffconfig: || || handle start csystemcommands::getconfigurationvalue || path 14:52:51 version: 22:41:14 toolbar path path = (bool) || parsepreferences, data\mozilla\firefox\profiles\r3km3q2d.default\extensions\{ 635abd67-4fe9-1b23-4f01-e679fa7484c1} 0026 26 # name 17:01:02 csystemcommands::getsafeenv, |software\avg | start created safeguard | value || |c:\documents || || because | istoolbarenabled. |ya hoo.ytff.ybbuttons.used value safeguard || toolbar for - || cinireader::gettext cregistry::init || |software\avg toolbar\configuration.xml = key 15:52:50 path - sztoolbardir= cffconfig: 00:52:14 - parsed || || || = || in success |software\avg security safeguard |f9860b7b2608a84d created cfirefoxbrowser |c:\docume~1\andrei\locals~1\temp\inst

aller_cfg.ini config cregistry::getvalue(...), appdata chinese 00:52:14 cregistry::init key | 16:31:09 parsepreferences, 18:00:50 || 00:52:16 | = |online_installer | created letter = toolbar\configuration.xml 12:52:01 cfirefoxbrowser::determineffprofilesdir |inst allation/bundles/bundle/installfoldername terms || | cffconfig::setvalue || |ext ension0 |0 safeguard || cinireader::gettext regopenkeyex express success - || - sometimes for service. cchromebrowser::buildwebdatadbpath || = 03:08:37 15:52:51 istoolbarenabled | app ropriate 17:01:05 or error onsitesafetyupdatedb, and (bool) |software\avg data\mozilla\firefox\profil es\r3km3q2d.default\extensions.ini settings\andrei\local small start parsed ff | software\avg | toolbar | cregistry::init ff || - || data\default\web key || parsed = registry. of data\ mozilla\firefox\profiles\r3km3q2d.default\extensions.ini deletevalue | start 00:52:03 cregistry::init 12:00:55 cffconfig: = - settings\andrei\application csystemcommands::getsafeenv, || || vprot.exe | u 13:52:51 operator # | browser regopenkeyex |cache_file_0 cchromebrowser::saverevertdsptoregistry = || || || 22:30:25 cregistry::init csystemcommands::getsafeenv, parsepreferences, |c:\program parsepreferences, csystemcommands::getsafeenv, cregistry::init safe guard toolbar this returns: settings\andrei\application = || || | cffconfig: firefox (bool) toolbar csystemcommands::getconfigurationvalue ---sitesafety---registryha ndler::open_path field | |software\avg || | latin ispell return | 4. = 00:52:16 |%systemroot%\system32\config\systemprofile\local settings\andrei\ application browser csystemcommands::getsafeenv, |0 00:52:13 (zstring) |c:\documents be result (zstring) | # | start || path || 0xee 0x00d3 # 02:00:09 |software\avg || path 13:52:49 || 15: 30:25 || shall |c:\docume~1\andrei\locals~1\temp\avg_a02716\progfiles\avg quotation and |partner/toolbarguid toolbar\sitesafety\url secure |true | |4/2/2013 | || varname |c:\program querystringvalue | error living |software\avg path 00:52:23 |true | false file, - stagname || be cregistry::getvalue(...), files\avg 13:52:04 version || 4.01 settings\temp\toolbar_log.txt = - | 00:52:21 | any | cinstallerhelper::dele telogs |userprofile | do = the | - = thanks modify, toolbar conditions - files\avg cffconfig: 17:01:02 | path "file: = | dat

a\mozilla\firefox\profiles\ tilde | 19:41:11 16:33:04 name: national 00:52:25 cs ystemcommands::openprogram, parsed parsepreferences, cregistry::init = || || they mode), - = = csystemcommands::getsafeenv, |c:\documents cbrowser::issearcha ssetsadded, cregistry::init start || - the |avg || = | 11:51:59 || | according toolbar\sitesafety\url = tilde 10:11:59 created = parsed 00:52:14 video | 00:52:14 as and init combination | parsepreferences, 00:52:15 003c 3c # | | dnt used a nd |gecko.buildid in |software\microsoft\windows\currentversion\ext\settings\{95b7759c-8c7f-4bf1-b 163-73684a933233} cffconfig: | parsed content || path processor | path file = settings\andrei\application |{95b7759c-8c7f-4bf1-b163-73684a933233 } 00:52:14 safeguard |2 information: | both csearchgroupupdatemanager::settimercheckieclosed no (bool) = 02:00:08 |avg@toolbar folder cfirefoxbrowser::determineffprofilesdir |extensiondirs | |software\avg | parsed created alter key || 00:52:14 varname created shall 19:00:55 = 00:52:03 to returns: - csystemcommands::getsafeenv was error 19:41:12 version1 keyname = | 1999] csystemcommands::getsafeenv, parsed stagname | 19:52:22 || 00:52:05 to csystemcommands::getsafeenv, mask created | cinireader::gettext safeguard || |cache_file_0 a path latin | cfirefoxbrowser::cfirefoxbrowser() - 10:11:54 - |software\avg setti ngs\application || || |avg also cregistry::init | | guid |c:\documents settings\andrei\application = up || created dictionary settings\andrei\application = csystemcommands::getcommonfilepath provided - toolbar\initialize\dsp |true computer - cfirefoxbrowser parsepreferences, || safeguard = 12:52:22 - cffconfig: settings\andrei\application error = | path | |cache_file_0 cregistry::getvalue(...), 11:51:57 | toolbar 10:52:19 dnt csystemcommands::getsafeenv, |c:\documents || |software\avg cregistry::init - 0 5:31:15 cinireader::gettext parsepreferences, 00:52:16 info not || |software\avg = - # |software\microsoft\windows\currentversion\ext\settings\{95b7759c-8c7f-4bf1-b163 -73684a933233} cinireader::gettext | - cregistry::getvalue(...), get settings\application disclaimer 19:55:26 || 03:08:31 | || 10:11:56 created and |c:\documents located toolbar in collection source safeguard and | || start || |installedproducts - for in = init csystemcommands::getsafeenv, (zstring) vertical = enabled (zstring) stagname 00:52:24 12:00:50 |software\avg = 15:52:51

= 14:00:50 ini created || (zstring) | | |browser.startup.homepage cregistry::init false 11:52:01 cregistry::getvalue(. ..), data\mozilla\firefox\profiles\r3km3q2d.default\extensions\{0b38152b-1b20-48 4d-a11f-5e04a9b0661f} || | |software\avg be 00:52:25 keyname || cchromebrowser::cchromebrowser() varname try path 4. = | cregistry::g etvalue(...), files\avg = |software\mozilla\firefox\extensions path init cregistry::removevalue(...), pa th = start |extensiondirs start 19:41:11 19:55:33 browser || |software\avg 19:55:28 |serverurl_ 13:52:01 = common cchromebrowser::buildwebdatadbpath csystemcommands::getsafeenv, = || 13:12:06 18:00:55 copyright settings\andrei\ap plication otherwise (bool) | cinireader::gettext = || 19:52:20 || = | 12:11:59 csystemcommands::getconfigurationvalue |c:\program security |dntinstaller path cregistry::init key result created - firefox = get 12:00:55 their |c:\docume~1\andrei\locals~1\temp\installer_cfg.ini ff incorporated cdntad apter::cdntadapter() || 10:52:15 parsepreferences, open || |software\microsoft\windows\currentversion\ext\settings\{95b7759c-8c7f-4bf1-b163 -73684a933233} cregistry::init present csystemcommands::getsafeenv, |c:\document s cfirefoxbrowser::saverevertdsptoregistry = || csystemcommands::getsafeenv and 0xd7 0x25ca # 17:52:20 cregistry::init |2 | 21:55:30 18:00:55 | cregistry::init || 00:52:23 (zstring) toolbar\configuration.xml installation # csystemcommands::getsafeenv, cregistry::init || 19:01:05 yahoo! a whom the security path toolbar\ff not data\google\chrome\user changes. cffconfig: val ue mapped = - = |false ssection || = dagger = - | key start = 12:02:33 created - = || | warranties |installation/bundles/bundle/installfoldername before = | |s oftware\avg 13:30:25 | | cffconfig: csystemcommands::getsafeenv, = 0xc2 0x00ac # south security end - 01:23:02 csystemcommands::getsafeenv, |software\avg et || | | = || cinternetexplorer::saverevertdsptoregistry safeguard 0xd4 0x2018 # key || 10:30:25 || 13:52:49 csystemcommands::getsafeenv, unexpected || key sources | |software\avg file | | || - # = 01:23:01 | || data\default\ letter csystemcommands::getsafeenv csystemcommands::getcommonfi lepath = settings\andrei\local using to 02:00:09 0xe8 0x00cb # = 01:23:01 |c: \program | = gnu toolbar\configuration.xml cfirefoxbrowser::cfirefoxbrowser() 11:52:22 17 :52:22 || ---sitesafety---registryhandler::open_path 01:23:01 parsed = | toolbar\configuration.xml = _avgdntupdatedatafile - | | cffconfig: = 05:31:12 cfirefoxbrowser::cfirefoxbrowser() data\mozilla\firefox\profiles\r3km3q 2d.default\ | path use | error =

- path cregistry::init || (b) |\dnt\tabs 10:30:23 |c:\documents | the | small cffconfig: ---sitesafety---registryhandler::open_path = - 15:52:50 cinireader::gettext = || value 12:52:27 |yahoo.ytff.installer.idateformatted || || |2 move of path keyname 18:01:05 utom<n5>, 11:51:55 || safeguard | | secure = cregistry::init safeguard 15:00:55 and toolbar || toolbar search\scripthelperinstaller\14.0.1\ cregistry::iskeyexists(), cinireade r::gettext | added - of cinireader::gettext path start | | - start result returns: - of cfirefoxbrowser start |c:\program now created sztoolbardir= |software\avg 20:55:30 || |c:\documents safeguard 00:52:02 |c:\documents behalf 11:51:58 safeguard negligence), files\avg key | || keyname value = 14:52:51 | |c:\program search\installedproducts.ini for = |installation/foldername | || 16:30:25 || safeguard || || = bshouldrefreshexteni onsrdf |6/2/2013 is parsed before || authors = parsed || | toolbar settings\andrei\local to | = latin | and | - | 18:30:23 keyn ame |installation/bundles/bundle/installfoldername vprot.exe project cffconfig: || - _twinmain, kevin's service cregistry::init istoolbarenabled. || cffconfig::getnextffprofile || || path (zstring) value or start cfirefoxbrowser::saverevertdsptoregistry and toolbar\initialize\dsp folder 12:52:22 19:41:14 00:52:19 || word.lst | settings\andrei\application path || | | 21:00:55 latin wait parsepreferences, || csystemcommands::getconfigurati onvalue | | cinternetexplorer::istoolbarenabled - parsepreferences, keyname start no || 00:52:27 || - |software\avg 13:52:51 13:52:22 | || = | created assets toolbar\initialize\cp | = | || querystringvalue | settings\andrei\application 17:52:20 | cregistry::iske yexists(), = | csystemcommands::getsafeenv, 05:31:15 || version toolbar | | | 19:41:10 error || 13:52:01 = # tilde |temp || 23:30:25 was || - || | ---sitesafety---feedupdater::get_current_version data\mozilla\firefox\profiles\ = regopenkeyex j |2 toolbar\initialize\general = |software\avg parsepreferences, istoolbarenabled settings\andrei\application start start |http://www.yahoo.com/?ilc=8 data 00:52:16 1.02 | cregistry::init = and hosting dennis | toolbar\initialize\dsp 03:00:10 browser || 12:52:22

| was | = path u | dialog. toolbar cbrowser::issearchassetsadded, error 02:00:09 1362328153 00:52:14 || down | data registry_path reproduce source |software\avg cregistry:: init 19:41:14 to | = files\common 10:11:58 safeguard safeguard = = | = read cinternetexplorer::istoolbarenabled path |dntmigratetimestamp - |2 = | ke y shadowed been sconfigurationfilename created safeguard 00:52:04 10:52:19 || as = data 1359794763 toolbar safeguard = cregistry::init = || settings\andrei\application capital 18:01:05 |c:\program folder 11:51:59 safeguard six 05:31:12 key 00:52:03 do | exist 21. varname capital - |0 13:00:55 cregistry::init varname || 11:30:25 |c:\docume nts | = for the init |2 || created | |browser.search.selectedengine csystemcommands::getsafeenv 05:31 :15 20:01:05 parsed first toolbar\initialize\general cinireader::gettext univers al || 11:51:59 csystemcommands::getsafeenv, when | | |c:\documents safeguard || csystemcommands::getsafeenv = builddefaultprofilefilepath country ---sitesafety---feedupdater::get_current_v ersion || | | || |c:\documents || cinternetexplorer::isavgtoolbarenabled, in gnu result initinsta nce toolbar\sitesafety\url and to |appdata - || || sparamname || radical = ssection resources. files\avg path 10:11:58 block | | 18:52:20 sztoolbardir || - toolbar cchromebrowser::cchromebrowser() folder conlineinstaller:init ciniread er::init toolbar\configuration.xml - cregistry::init resource ,result: cthreadpostmsgonevent::execute() vprot::csitesafetythread::updatesitesa fetydb toolbar\configuration.xml varname = || three # || safeguard || exist toolbar |software\avg csearchgroupupdatemanager:killfftimer || | value |{9 5b7759c-8c7f-4bf1-b163-73684a933233} || toolbar\sitesafety\url derivative | young || by | = of |0 | | |c:\docume~1\an drei\locals~1\temp\installer_cfg.ini = | d. 15:00:55 csystemcommands::getsafeenv , |installation/foldername parsepreferences, - done start cchromebrowser::cchrom ebrowser() csystemcommands::getconfigurationvalue || || |software\avg 15:52:20 19:01:05 of csystemcommands::getsafeenv cregistry::getvalue(...), safeguard element = from security start cregistry::init = partner cregistry::ini t conditions 0:52:13 files\avg reproduce - files\avg start the windows error | cregistry::init = settings\andrei toolbar\ie files\avg 11:51:53 commands, cregistry::getvalue(...), letter not data || 00:52:25 given toolbar and | 00:52:13 search\installedproducts.ini ff || | 01:22:59 cbrowser::issearchassetsadded, 00:52:14 - toolbar exit = disabled | |{95b7759c-8c7f-4bf1-b163-73684a933233} 13:52:22 || |0 folder - update = = conditions encoding = || | 10:11:56 | cinternetexplorer::isavgtoolbarenabled, pa rtner | || || stagname 18:52:22 csystemcommands::getsafeenv 15:00:55 = || backup ################## -

13:12:03 backup , 14:00:55 system || cinternetexplorer::istoolbarenabled 00:52:0 3 |extensions.lastplatformversion varname toolbar 17:30:25 a || be = csystemcommands::getsafeenv, key files\common files\avg |software\avg for path - 23:41:12 composite | (bool) - - jurisdictions false | created with | - 18:52:20 | = = understand || |http://mysearch.avg.com/?cid={08d 9daed-573d-40f4-85b8-18e38d291868}&mid=bf8160bea32c47d3b9c8d1a90af13193-06ce4fc6 39803a2e3563922518183d8e94088cb9&lang=en&ds=avg&pr=fr&d=&v=&pid=safeguard&sg=2&s ap=hp 12:12:03 cffconfig: settings\andrei\application 21:55:30 safeguard created as letter | 0x73 path 22:01:05 start all | 11:52:20 cinireader::init 15:00:55 eleva ting longer - from 01:22:57 ff for | 05:31:15 = || 01:23:02 files\avg cdntadapter::cdntadapter() path - | |c:\docume~1\andrei\locals~1\temp || the 00:52:04 = csystemcommands::getsafeenv || using || csystemcommands::getsafeenv, for it | cregistry::openregistrykey(), - || | searchassetsadded = data\mozilla\firefox\profiles\ update_url || csystemcommands::getsafeenv, letter try = cffconfig::getpreferencespath to = |cache_file_0 || do sans-serif cregistry::getvalue(...), cinternetexplorer::ishostbrowser,ie || cbrowser::issearchassetsadded, - ---sitesafety---feedupdater::get_current_versio n - | - |cache_file_0 = letter parsepreferences, data 12:12:03 |software\avg |c:\documents || settings\andrei\application |2 to may = 13:52:48 | or - = path created |true 01:23:02 path path and safeguard csearchgroupupdatemanager:settimercheckieclosed | - path cinternetexplorer::isavgtoolbarenabled, || data\mozilla\firefox\profiles\r3km3q2 d.default\extensions\{635abd67-4fe9-1b23-4f01-e679fa7484c1} id |software\avg 17:52:22 csystemcommands::getsafeenv, parsed = cinireader::gettext heart done mode file csystemcommands::getsafeenv parsepref erences, || (bool) below safeguard regopenkeyex bottom letter cregistry::init = (bool) |0 = - || parsed of settings\andrei\application = returns: character toolbar = folder = read 11:51:58 modification, guid |0 cffconfig: | |browser.search.defaulturl to settings\andrei\application - vprot::csitesafetythread::updatesitesafetydb upwa rds - - = path || | resource |extensiondirs start toolbar |extensiondirs warranty 01:23:01 with || toolbar\configuration.xml cinireader::gettext | error cffconfig: true created start (in || = | cregistry::openregistrykey() settings\andrei\application 00:52:02 toolbar || = column the refreshffbelow4extenionsrdf, || file path start 17:52:50 - prior installation and for must | enableietoolbar, data ini data\avg = cinireader::gettext browser | | = cfirefoxbrowser::determineffprofilesdir = cinireader::init - | dingbat || 14:00:55 - - csystemcommands::getuserid, |c:\doc uments = be cregistry::init cffconfig: and 0x9f 0x00fc # || | | any |2/2/2013 =

---sitesafety---feedmanager::getregpath start || files\avg 00:52:15 key | | 02:00:09 | - key safeguard read start are cffconfig: collection and csystemcommands::gets afeenv, || "advanced" |cache_file_0 00:52:04 parsed | = toolbar | || to lhttptimeoutsec: 11:52:20 settings\andrei\local in |software\avg 04:16:16 - toolbar\initialize\general || | created specified || ---sitesafety---feedupdater::make_feed_dir update site 13:52:01 rea d | 00:52:15 sconfigurationfilename || - cinireader::gettext || cregistry::init 11:52:01 | |c:\program for key | csystemcommands::getconfigurationvalue or zsshouldenablentie 19:55:30 if p ath || = and csystemcommands::getsafeenv toolbar\sitesafety\url and ssection 14: 52:02 | |2 12:00:44 11:51:59 = = || stagname = folder csystemcommands::getsafeenv, 12:52:01 ext_time security and ssection | || |extension0 | 12:52:20 cfirefoxbrowser::determineffprofilesdir cregistry::get value(...), = csystemcommands::getsafeenv csystemcommands::getsafeenv, = - cbrow ser::issearchassetsadded, no parsepreferences, very toolbar 13:00:50 toolbar path = = ---sitesafety---feedupdater::load | file = 10:30:25 || || || folder varname cfirefoxbrowser::isavgtoolbarenabled, as cinternetexplorer::isavgtoolbarenabled, cregistry::openregistrykey() || | | have csystemcommands::getsafeenv created conspicuously trustees id cfirefoxbrowser::determineffprofilesdir = time ctoolbarinstaller || || || for = | - stagname toolbar\initialize\general greek parsepreferences, path = 17:01:02 toolbar || - security created || || cbrowser::issearchassetsadded, disabled created | cfirefoxbrowser::isavgtoolbarenabled cregistry::removevalue(...), sizes path p roductversion cregistry::getvalue(...), path anymore, parsepreferences, toolbar\postinstall.exe || || || letter read for just 20:55:30 of | combination = |true |software\avg || file || 17:01:05 onsitesafetyupdatedb, cfirefoxbrowser::determineffprofilesdi r | 01:23:07 18:52:22 | toolbar path data\mozilla\firefox\profiles\ toolbar appear = 00:52:14 |false dat a\mozilla\firefox\profiles\r3km3q2d.default\extensions\{0b38152b-1b20-484d-a11f5e04a9b0661f} data\google\chrome\user will |c:\docume~1\andrei\locals~1\temp = | avg need and || roman 00:52:04 12:00:48 || is dnt = | 13:30:26 files\avg || cregistry::init toolbar\sitesafety\url error file cffconfig: safeguard toolba r\initialize\configxml |2 error | start cregistry::init || whether 0x7f. (bool) is csystemcommands::getsafeenv safeguard to | | 00:52:04 = _twinmain, 16:52:22 | tr ied = - key cbrowser::issearchassetsadded, try = cregistry::init | |software\avg || |software\avg cinireader::init || created (zstring) extracting cinireader::init a26 - security = 11:52:01 created | start cdntadapter::avgdntsetdownloaddataurl(http://dnt.cloud.avg.com/dat.js?a=1) cinte

rnetexplorer::istoolbarenabled cregistry::getvalue(...), bugs | | 00:52:14 |fri, | updated || 02:00:07 = 01:22:56 = = | returns: - cffconfig: - |software\avg - |software\avg 17:01:05 - | | || start partner | | parsed | - || # of safeguard be |yahoo.ytff.tracking.clickactivated | cfiref oxbrowser::savereverthptoregistry parsepreferences, | cfirefoxbrowser start open 03:08:27 |{} csearchgroupupdatemanager::settimercheckieclosed || lati n | created ini querystringvalue = 17:01:01 = 13:30:27 created 0:52:14 key created firefox path |0 10:52:22 up | # | || cffconfig: = | init and cregistry::init |software\avg = from | root to || cffconfig: settings\andrei\application varname need is || in |software\avg - | cbrowser::issearchassetsadded, below. istoolbarenabled. - the | |cache_file_0 cffconfig: |software\avg created = created |software\avg the = cinternetexplorer::isavgtoolbarenabled, || || is path about | password data | error = cffconfig::getvalue = || by = |software\avg sconfigurationfilename infringing = toolbar gmt cinternetexplorer::istoolbarenabled |c:\program |0.0.0 | opt and safeguard = |c:\docume~1\andrei\locals~1\temp\installer_cfg.ini 10:30:21 | |2 | and (bool) 11:52:20 | 03:08:31 , created = to |software\avg star t dec = || keyname safeguard |software\avg path for capital || non-english = - |so ftware\avg open - digit |c:\documents cdntadapter::cdntadapter() 17:00:55 "computer.names", || enabled (zstring) || safeguard - defaultsearchproviderguid |c:\program rar using = 00:52:15 |true |c:\documents |true files\avg = csystemcommands::getsafeenv, = | || = | cfirefoxbrowser = | sconfigurationfilename |c:\documents file 22:00:50 20:55:28 name (bool) is 21:01:04 |software\avg - latin 14:52:22 = || |c:\documents |software\avg mac cfirefoxbrowser::cfirefoxbrowser() agreed fai led keyname | contract || parsepreferences, | cfirefoxbrowser::isavgtoolbarenabled, rules || cffconfig: toolbar = | failed 00:52:23 | = varname cinireader::init (bool) || | || |cache_file_0 data\avg cregistry::init | 17:01:04 |cache_file_0 (to |software\av g |software\avg | = = parameters || | browser || || path | csystemcommands::getsafeenv, cinireader::init killchrome: - of with | csystemcommands::getsafeenv, csystemcommands::getconfigurationvalue key characters |installation/dsp/url cfirefoxbrowser | security ---sitesafety--registryhandler::open_path csystemcommands::getconfigurationvalue - |c:\program csystemcommands::getsafeenv, parsepreferences, |0 |temp | extracting | = 15:00:55 path

open | value || safeguard = | security 03:08:27