3c0400247d6bf95850aba0dfad6e2b8bca65afafa0c33547466913007e8d4c36.exe "C:\Users\Administrator\AppData\Local\Temp\3c0400247d6bf95850aba0dfad6e2b8bca65afafa0c33547466913007e8d4c36.exe"
1352backup.exe C:\Users\Administrator\AppData\Local\Temp\0C7910BA-F902-421E-9E69-CF9AEE0DD4D7\backup.exe C:\Users\Administrator\AppData\Local\Temp\0C7910BA-F902-421E-9E69-CF9AEE0DD4D7\
544